Scanners
Race and fuzz an HTTP/3 endpoint over QUIC
Black Hat Arsenal HTTP/3 client for Quic-Fin-Sync race testing and fuzzing over QUIC.
overview
What quicdraw does
quicdraw sends HTTP/3 requests over QUIC and is built to make several of them land at the same moment. The technique upstream calls Quic-Fin-Sync holds the requests until their final frames can be released together, which is what turns a theoretical race window into one you can observe: two redemptions of a single coupon, two withdrawals against one balance.
HTTP/3 matters for this because the tooling gap is real. Most fuzzers and race tools speak HTTP/1.1 or HTTP/2, so an endpoint reached over QUIC often ends up tested through a different path than the one users take. quicdraw tests the transport in production rather than a proxy of it, and it fuzzes over the same connection with a FUZZ placeholder and a wordlist on -w.
The node takes a single --url or a one-URL file, with the file port preferred so a baseline pass and a race pass read the same target. Output is findings.jsonl plus the response body, which is what lets the HTTP/3 Race Fuzzer run both passes and diff them into evidence instead of a claim.
use cases
Where quicdraw fits
Test a limit that assumes one request at a time
Race an endpoint that grants a coupon, a credit, or a withdrawal and see whether concurrent HTTP/3 requests both succeed.
Compare a baseline against a race
Run a single request and a concurrent burst against the same URL, then diff the responses so the finding rests on evidence.
Fuzz over HTTP/3 rather than a fallback
Put a FUZZ placeholder in the URL or body and pass a wordlist so the fuzzing path uses the transport that users actually reach.
Cover a QUIC endpoint your scanners skip
Reach hosts that negotiate HTTP/3 with tooling that speaks it, instead of testing a downgraded path that behaves differently.
reference
quicdraw inputs and flags
| Name | Type | Flag | Description |
|---|---|---|---|
| url | STRING | --url | HTTPS URL on an HTTP/3-capable host (optional if url-file is set) |
| url-file | FILE | --url-file | File with one HTTPS URL (preferred, keeps baseline and race in sync) |
| race | STRING | --race | Number of concurrent race requests (-tr) |
| wordlist | FILE | -w | Optional fuzz wordlist (FUZZ placeholder in URL or body) |
Showing key inputs. quicdraw exposes 4 inputs in total.
example
Run quicdraw
# baseline: one request over HTTP/3quicdraw --url https://www.example.com/api/redeem # race: concurrent requests released togetherquicdraw --url-file url.txt --race 20{ "tool": "quicdraw", "url": "https://www.example.com/api/redeem", "alpn": "h3", "race": 20, "accepted": 3, "expected": 1, "severity": "high", "note": "Three concurrent redemptions accepted where the limit allows one"}guidance
Choosing quicdraw
Reach for quicdraw when the target negotiates HTTP/3 and the question is a race window or a fuzz case on that transport. Use ffuf for high-throughput fuzzing over HTTP/1.1 and HTTP/2, and use httpx first when you still need to know which hosts speak HTTP/3 at all.
ffuf
Faster and broader for fuzzing, but it does not speak HTTP/3 and cannot synchronize request completion over QUIC.
httpx
Probes hosts and reports protocol support. Run it first to find HTTP/3 endpoints, then race them here.
nuclei
Template checks across many classes. It covers known issues; a race window needs concurrent requests it does not orchestrate.
workflows
Workflows using quicdraw
faq
quicdraw questions
related
More Scanners tools
ac-scanner
BHUSA Arsenal TLS/SSH crypto inventory with post-quantum readiness signals and CBOM-shaped output.
airixss
Reflection triage for parameter URLs during recon.
bedrock-keys-security
Black Hat Arsenal hunting for phantom IAM users behind Bedrock keys, with offline key decode and org scan.
cmseek
CMS detection and version fingerprinting.
jaeles
Signature-driven web application scanner.
joomscan
OWASP Joomla vulnerability scanner for CMS flaws and misconfigurations.
Run quicdraw yourself
One HTTP/3 URL feeds quicdraw, which sends a baseline and a synchronized race burst and writes findings plus response bodies.
Facts on this page come from the live Trickest tool library.