Professional Community

HTTP/3 Adapter

This extension enables sending HTTP requests over HTTP/3 (QUIC) by intercepting requests, converting them to HTTP/3, transmitting them to the target, and converting the responses back to a compatible HTTP version for display and analysis.

Features

  • Two operating modes: explicit opt-in per request using an X-Http3: 1 header, or automatic HTTP/3 upgrade for all hosts that support it.
  • Bulk HTTP/3 support check via a context menu option on proxy history items, with results reported to the Organizer.
  • Kettled request mode, triggered by adding X-Kettled: 1, sends the header block exactly as written with no normalization, case folding, or header stripping, and supports escape sequences for special bytes.
  • Unsupported Origins tab that lists hosts where the QUIC handshake failed, with the option to clear and retry.
  • Configurable connection and handshake timeouts, connection reuse, TLS certificate verification, and optional logging of adapted exchanges to the Output panel.
  • Automatic stripping of HTTP/3-forbidden headers (Connection, Keep-Alive, Transfer-Encoding, etc.), with an option to disable stripping for deliberate testing.

Usage

  1. Configure the extension mode under Settings → Extensions → HTTP/3 Adapter.
  2. To send a specific request over HTTP/3 in Explicit HTTP/3 only mode, add the header X-Http3: 1 to the request before sending it.
  3. To upgrade all compatible traffic automatically, switch the mode to Always HTTP/3 where possible; no per-request header is needed.
  4. To check whether multiple hosts support HTTP/3, select them in the proxy history, right-click, and choose Check HTTP/3 Support; results appear in the Organizer.
  5. To send a kettled request with an exact, unmodified header block, add both X-Http3: 1 and X-Kettled: 1 headers and write the header block as desired, using supported escape sequences for special characters.
  6. To review hosts where HTTP/3 handshakes failed, enable the Unsupported Origins tab in settings and inspect or clear the list as needed.
  7. To log each adapted request and response, enable Log exchanges to Output in the settings panel.

Author

Author

Tom Stacey, PortSwigger

Version

Version

0.0.1

Rating

Rating

Popularity

Popularity

Last updated

Last updated

23 September 2026

Estimated system impact

Estimated system impact

Overall impact: Empty

Memory
Empty
CPU
Empty
General
Empty
Scanner
Empty

You can install BApps directly within Burp, via the BApp Store feature in the Burp Extender tool. You can also download them from here, for offline installation into Burp.

You can view the source code for all BApp Store extensions on our GitHub page.

Follow @BApp_Store on Twitter to receive notifications of all BApp releases and updates.

Please note that extensions are written by third party users of Burp, and PortSwigger Web Security makes no warranty about their quality or usefulness for any particular purpose.

Go back to BappStore

Note:

Please note that extensions are written by third party users of Burp, and PortSwigger Web Security makes no warranty about their quality or usefulness for any particular purpose.