LISTEN TO THE WHISPERS: WEB TIMING ATTACKS THAT ACTUALLY WORK

Summary from the TLDR InfoSec newsletter

James Kettle presented at DEFCON on how he exploited timing attacks with delays as low as 200 microseconds. To reduce noise, Kettle utilized HTTP/2 to send multiple requests that arrived at the same time and interleaved a ping packet to force HTTP header coalescing, trying to hit slow code paths. He was able to effectively demonstrate the efficacy of this technique in discovering hidden parameters, server-side injections, and reverse-proxy misconfigurations.