Performing process-timing attacks

By monitoring the time an application takes to complete a task, it is possible for attackers to gather or infer information about how an application is coded. For example, a login process using valid credentials receives a response quicker than the same login process given invalid credentials. This delay in response time leaks information related to system processes. An attacker could use a response time to perform account enumeration and determine valid usernames based upon the time of the response.

Getting ready

For this recipe, you will need the common_pass.txt wordlist from wfuzz:

• https://github.com/xmendez/wfuzz
  • Path: wordlists | other | common_pass.txt

Using OWASP Mutillidae II...