When sending over HTTP/1, Repeater uses last-byte synchronization.This is where multiple requests are sent via a single TCP packet.
When sending over HTTP/2, Repeater sends the group using a single packet attack.It uses different synchronization techniques depending on the HTTP version used: Repeater synchronizes parallel requests to ensure that they all arrive in full at the same time. When you select this option for a tab group, Repeater sends the requests from all of the group's tabs at once. We have added a Send group (parallel) option to Repeater's Group send options menu. We have also introduced various other improvements for Burp Suite Professional and Burp Scanner, including the ability to reuse HTTP/1 connections in Intruder, a new project-level Crawl paths tab in the Target tool, and support for GraphQL introspection during scans. These requests are synchronized to arrive within a very small time window, making it much simpler to test for race conditions. Repeater's new single-packet attack feature nullifies network jitter, enabling you to send multiple requests in parallel. This release introduces new Repeater functionality based on the techniques discussed in James Kettle's talk 'Smashing the State Machine: The True Potential of Web Race Conditions', first presented at Black Hat USA 2023.
