Timeinator, Time Based Attacker
Summary: Timeinator is a Burp Suite extension, authored by FSecureLABS and listed at version 1.0a with a last update of 25 February 2022, that performs timing attacks over unreliable networks such as the internet. It works like Burp Intruder's sniper mode but sends multiple requests per payload and reports minimum, maximum, mean, median, and standard deviation response times, resolving the domain before any HTTP requests and sending HTTP(S) requests sequentially to reduce delays.
What you should know: Timing attacks depend on measuring small differences reliably, and this tool exists specifically because the internet is noisy enough to bury them - it repeats each payload and reports standard deviation so an attacker can tell a real signal from network jitter. The extension's requests do not appear in proxy history, so defenders relying on that log alone would not see the traffic.
Read the original at PortSwigger Research ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026