Introducing Agents.·Read
OverviewAgentsWorkflowsExecutionDeveloper ToolsSecurityLibrary
Updated Aug 27, 2026

Scanners

Race and fuzz an HTTP/3 endpoint over QUIC

quicdraw is a Black Hat Arsenal HTTP/3 client from CyberArk for Quic-Fin-Sync race testing and fuzzing over QUIC, driving controlled requests over HTTP/3 to probe timing and state handling in modern servers.

installpip install quicdraw

Python · Apache-2.0 license

Agent
Test a limit that assumes one request at a timeCompare a baseline against a raceFuzz over HTTP/3 rather than a fallback

overview

What quicdraw does

quicdraw sends HTTP/3 requests over QUIC and is built to make several of them land at the same moment. The technique upstream calls Quic-Fin-Sync holds the requests until their final frames can be released together, which is what turns a theoretical race window into one you can observe: two redemptions of a single coupon, two withdrawals against one balance.

HTTP/3 matters for this because the tooling gap is real. Most fuzzers and race tools speak HTTP/1.1 or HTTP/2, so an endpoint reached over QUIC often ends up tested through a different path than the one users take. quicdraw tests the transport in production rather than a proxy of it, and it fuzzes over the same connection with a FUZZ placeholder and a wordlist on -w.

The node takes a single --url or a one-URL file, with the file port preferred so a baseline pass and a race pass read the same target. Output is findings.jsonl plus the response body, which is what lets the HTTP/3 Race Fuzzer run both passes and diff them into evidence instead of a claim.

source github.com/cyberark/QuicDrawH3

use cases

Where quicdraw fits

Test a limit that assumes one request at a time

Race an endpoint that grants a coupon, a credit, or a withdrawal and see whether concurrent HTTP/3 requests both succeed.

Compare a baseline against a race

Run a single request and a concurrent burst against the same URL, then diff the responses so the finding rests on evidence.

Fuzz over HTTP/3 rather than a fallback

Put a FUZZ placeholder in the URL or body and pass a wordlist so the fuzzing path uses the transport that users actually reach.

Cover a QUIC endpoint your scanners skip

Reach hosts that negotiate HTTP/3 with tooling that speaks it, instead of testing a downgraded path that behaves differently.

reference

quicdraw inputs and flags

4 inputs
NameTypeFlagDescription
urlSTRING--urlHTTPS URL on an HTTP/3-capable host (optional if url-file is set)
url-fileFILE--url-fileFile with one HTTPS URL (preferred, keeps baseline and race in sync)
raceSTRING--raceNumber of concurrent race requests (-tr)
wordlistFILE-wOptional fuzz wordlist (FUZZ placeholder in URL or body)

Showing key inputs. quicdraw exposes 4 inputs in total.

example

Run quicdraw

quicdraw · command
# baseline: one request over HTTP/3
quicdraw --url https://www.example.com/api/redeem

# race: concurrent requests released together
quicdraw --url-file url.txt --race 20
sample output
{
  "tool": "quicdraw",
  "url": "https://www.example.com/api/redeem",
  "alpn": "h3",
  "race": 20,
  "accepted": 3,
  "expected": 1,
  "severity": "high",
  "note": "Three concurrent redemptions accepted where the limit allows one"
}

guidance

Choosing quicdraw

Reach for quicdraw when the target negotiates HTTP/3 and the question is a race window or a fuzz case on that transport. Use ffuf for high-throughput fuzzing over HTTP/1.1 and HTTP/2, and use httpx first when you still need to know which hosts speak HTTP/3 at all.

ffuf

Faster and broader for fuzzing, but it does not speak HTTP/3 and cannot synchronize request completion over QUIC.

httpx

Probes hosts and reports protocol support. Run it first to find HTTP/3 endpoints, then race them here.

nuclei

Template checks across many classes. It covers known issues; a race window needs concurrent requests it does not orchestrate.

workflows

Workflows using quicdraw

1 workflow

  1. HTTP/3 Race Fuzzer

    Compare QuicDraw baseline GET vs concurrent HTTP/3 race traffic, then correlate race evidence you can retest.

faq

quicdraw questions

The upstream technique for holding several HTTP/3 requests and releasing their final frames together, so they reach the server inside the same window. It is what makes a race reproducible rather than lucky.

Most race and fuzzing tools speak HTTP/1.1 or HTTP/2, so a QUIC endpoint gets tested through a path that users never take. Behaviour can differ, and so can the race window.

Set --race to the number of concurrent requests, which maps to the upstream -tr flag. Start small enough to keep the responses readable, and treat a baseline pass as the control.

Yes. Put a FUZZ placeholder in the URL or body and pass a wordlist on -w. Both paths run over the same HTTP/3 connection.

Prefer the file port with one URL in it. The Library workflow wires seed to prep that way so the baseline pass and the race pass are guaranteed to read the same target.

CyberArk publishes QuicDraw(H3) at github.com/cyberark/QuicDrawH3. It appeared in the Black Hat USA 2026 Arsenal, and Trickest packages it as the library node documented here.

related

More Scanners tools

  1. ac-scanner

    BHUSA Arsenal TLS/SSH crypto inventory with post-quantum readiness signals and CBOM-shaped output.

  2. airixss

    Reflection triage for parameter URLs during recon.

  3. bedrock-keys-security

    Black Hat Arsenal hunting for phantom IAM users behind Bedrock keys, with offline key decode and org scan.

  4. cmseek

    CMS detection and version fingerprinting.

  5. jaeles

    Signature-driven web application scanner.

  6. joomscan

    OWASP Joomla vulnerability scanner for CMS flaws and misconfigurations.

Run quicdraw yourself

One HTTP/3 URL feeds quicdraw, which sends a baseline and a synchronized race burst and writes findings plus response bodies.

Open quicdraw in the libraryView the workflow

Facts on this page come from the live Trickest tool library.