DEF CON 32 - Listen to the Whispers: Web Timing Attacks that Actually Work - James Kettle

Timing attacks can reveal deep, often overlooked vulnerabilities in web applications by measuring response times to detect subtle differences in server behavior. The speaker demonstrates that with proper techniques, timing attacks are not just theoretical but practical, reliable, and applicable across live systems. 0:31

Key Takeaways:
• Timing attacks can detect hidden parameters and headers by analyzing response time differences, even when content remains unchanged 14:00.
• The single packet attack, enhanced with coalescing and DNS header manipulation, overcomes network jitter and enables universal timing attacks on any HTTP/2 target 8:44.
• Timing analysis reveals server-side control flow changes, enabling detection of web application firewall bypasses and server-side request forgery (SSRF) vulnerabilities 23:06.
• These attacks expose internal systems, staging servers, and admin consoles via reverse proxies and header spoofing, with practical exploitation through timing-based reconnaissance 34:14.

Timing attacks are powerful, underutilized tools for uncovering real-world vulnerabilities—often revealing insights that traditional scanning misses. They work best when applied with a clear, focused question and supported by automated tools. 39:18

Sources:

• 0:31 Introduction to timing attacks and their theoretical vs. real-world divide.
• 14:00 Use of timing to detect hidden parameters and headers.
• 8:44 Single packet attack technique overcoming network noise.