OWASP Hunting
Server-Side

Timing Attacks

Timing attacks exploit measurable differences in response time to infer secret data, enumerate users, or bypass rate limiting.

These payloads are for authorized testing only — systems you own, authorized bug bounty programs, or controlled lab environments. Unauthorized testing is illegal.

What it is

Timing attacks are side-channel attacks that exploit measurable differences in the time taken by the application to respond to different inputs. Common targets include user enumeration (different response times for valid vs invalid usernames), timing-based blind SQL injection, and cryptographic timing leaks in token comparison functions.

Attack Vectors

  • Login forms (user enumeration via timing)
  • Password comparison logic
  • Token validation (JWT, API keys, CSRF tokens)
  • SQL injection timing via SLEEP/WAITFOR
  • Any feature comparing secrets non-constantly

Testing Methodology

  1. Measure response times for valid vs invalid usernames in login forms
  2. Test for timing-based blind SQL injection with SLEEP()
  3. Use high-precision timing (multiple samples) to detect sub-millisecond differences
  4. Compare response times for existing vs non-existing password reset emails

Payloads

Reference payloads for authorized testing. Always verify you have permission before use.

User Enumeration Timing
POST /login username=validuser&password=wrongPOST /login username=invaliduser123&password=wrong (compare timing)
SQL Timing Injection
' AND SLEEP(5)--'; WAITFOR DELAY '0:0:5'--' AND 1=BENCHMARK(5000000,MD5('test'))--
Token Comparison
X-API-Key: aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa (single character prefix enumeration)

Indicators of Vulnerability

  • Statistically significant response time difference for valid vs invalid usernames
  • Response delayed by the exact number of seconds specified in SLEEP()
  • Time correlation between first character of token and response time

Detection Guidance

Implement constant-time comparison for secrets and tokens. Add consistent timing to authentication responses. Monitor for unusually high volumes of timed requests.

Mitigation & Remediation

  • Use constant-time comparison functions for all secret comparisons (hmac.compare_digest in Python, crypto.timingSafeEqual in Node.js)
  • Add artificial consistent delay to authentication responses
  • Return identical responses for valid and invalid username inputs
  • Implement rate limiting on authentication endpoints

References

Responsible Use

All content in this reference is for authorized security testing only. Use only on systems you own or have explicit written permission to test.

  • Systems and applications you own
  • Authorized penetration testing engagements
  • Bug bounty programs with defined scope
  • Educational lab environments (DVWA, WebGoat, HackTheBox)