Tick Tock Enumerator
Summary: PortSwigger's BApp Store lists TickTockEnum, a Burp Suite extension by scho-d4n at version 1.0.0, last updated 30 September 2025, that identifies vulnerabilities through response time analysis. It detects discrepancies in server response times between valid and invalid inputs, targeting username enumeration where authentication timing varies based on whether a user exists, and sends requests sequentially for accurate timing measurements.
Why it matters: A login form that answers faster or slower depending on whether a username exists hands an attacker a free list of valid accounts, and this extension automates finding that gap. The tool's own warning about account lockouts is the tell: the same sequential request pattern that measures timing can also trip your lockout controls.
Read the original at PortSwigger Research ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026