Test for process timing

Process timing test is a type of business logic testing that focuses on finding flows in how applications accomplish certain processes, such as authentication. In the process timing testing, the tester looks at how long it takes the application to process valid versus invalid inputs or actions. The tester validates that an attacker is unable to determine the behavior of an application based on the time it takes the application to finish an action. In the authentication example, by monitoring the process timing, based on the timing variation between entering valid credentials versus invalid credentials, an attacker can determine whether the credentials are valid without having to depend on the GUI.

Getting ready

For this recipe, you will need to start PortSwigger’s Username enumerations via response timing lab and ensure that ZAP is intercepting traffic between the lab application and your browser.

How to do it…

The following step-by...