assetnote / h3fuzz

# h3fuzz
h3fuzz is a content discovery tool with automatic HTTP/3 acceleration and a
persistent web console. It is a fork of ffuf,
so existing ffuf targets, wordlists, matchers, filters, request files, and most
command-line workflows remain available.
The normal HTTPS protocol order is HTTP/3, then HTTP/2, then HTTP/1.1. Before a
scan, h3fuzz can also qualify `HEAD` or `Range: bytes=-1` as a smaller response
strategy. It uses either strategy only when repeated baseline requests show
that the result metadata remains reliable.
## Responsible use
Run h3fuzz only against systems that you own or have explicit permission to
test. Content discovery, especially at high request rates, can disrupt a
service, trigger defenses, consume bandwidth, and create infrastructure cost.
Start with conservative settings on an unfamiliar target and coordinate load
testing with its operator.
## Why h3fuzz exists
Tom Stacey's PortSwigger research,
HTTP/3 in Burp Suite: it's time to find a bigger wordlist,
showed how response minimization, multiplexed QUIC streams, and multiple
HTTP/3 connections can raise the ceiling for request-heavy security testing.
PortSwigger reported more than 100,000 requests per second from a laptop to a
remote host over Wi-Fi, and about 180,000 requests per second from a cloud host
in the same region as the target.
h3fuzz applies those ideas to ffuf's content-discovery model. It is an
independent Go implementation informed by the research and by the open source
Turbo Intruder and
HTTP3-Adapter projects. It
does not copy Turbo Intruder's request engine and does not claim that every
target can sustain the rates reported in the research.
For an eligible HTTPS target, an automatic scan:
1. Negotiates QUIC with ALPN `h3`, receives HTTP/3 settings, checks connection
 reuse, and runs a bounded concurrent-stream probe.
2. Uses an HTTP/3 connection pool when qualification succeeds. Otherwise it
 negotiates HTTP/2 over TLS and falls back to HTTP/1.1 when needed.
3. Compares repeated full `GET` baselines with `HEAD`, then with a final-byte
 Range request if `HEAD` is unreliable.
4. Runs the content-discovery workload with the selected protocol and response
 strategy.
5. Falls back to a full `GET` for an individual optimized request when its live
 response no longer matches the qualified behavior.
Protocol choice and response minimization are independent. A scan can use
HTTP/3 with full `GET` responses, or a qualified smaller response over HTTP/2
or HTTP/1.1.
## Install a release
Prebuilt archives and checksums are available from
GitHub Releases. Release
archives include the h3fuzz binary, `final.txt`, documentation, license files,
and the local performance harness.
Common archive names are:
| Platform | Archive |
| --- | --- |
| Linux x86-64 | `h3fuzz_0.1.0_linux_amd64.tar.gz` |
| Linux ARM64 | `h3fuzz_0.1.0_linux_arm64.tar.gz` |
| macOS Apple silicon | `h3fuzz_0.1.0_macOS_arm64.tar.gz` |
| macOS Intel | `h3fuzz_0.1.0_macOS_amd64.tar.gz` |
| Windows x86-64