Listen to the whispers: web timing attacks that actually work
Summary: PortSwigger researcher James Kettle presented a paper at Black Hat USA and DEF CON on web timing attacks, validated on a test bed of 30,000 live websites drawn from bug bounty programs via bbscope and Rapid7's Project Sonar DNS database. The paper details three techniques - discovering hidden attack surface, server-side injection vulnerabilities, and misconfigured reverse proxies - now available in the Param Miner tool, and reports that a sub-millisecond timing differential can be detected reliably within ten seconds without prior configuration.
Why it matters: Kettle reports the smallest time gap he has exploited dropped from 30,000 microseconds to 200 microseconds, meaning timing oracles that were previously dismissed as impractical are now measurable against arbitrary live targets - including the hidden parameters and forgotten features most organizations no longer track.
Read the original at PortSwigger Research ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026