# Listen to the whispers: web timing attacks that actually work

DevFeed: [Listen to the whispers: web timing attacks that actually work](<https://devfeed.tech/articles/listen-to-the-whispers-web-timing-attacks-that-actually-work-7689.md>)

Original publisher: [Read original article](<https://portswigger.net/research/listen-to-the-whispers-web-timing-attacks-that-actually-work>)

Author: James Kettle

Published: 2024-08-07T18:10:21Z

Content type: article

Language: en

Sources: [PortSwigger Research](<https://devfeed.tech/sources/portswigger-research.md>)

Topics: [Web](<https://devfeed.tech/topics/web.md>), [Server](<https://devfeed.tech/topics/server.md>), [ctf](<https://devfeed.tech/topics/ctf.md>), [Open Source](<https://devfeed.tech/topics/open-source.md>), [configuration](<https://devfeed.tech/topics/configuration.md>), [Data structures](<https://devfeed.tech/topics/data-structures.md>)

Tags: [attacks](<https://devfeed.tech/tags/attacks.md>), [ctf](<https://devfeed.tech/tags/ctf.md>), [open-source](<https://devfeed.tech/tags/open-source.md>), [pdf](<https://devfeed.tech/tags/pdf.md>), [presentation](<https://devfeed.tech/tags/presentation.md>), [research](<https://devfeed.tech/tags/research.md>), [scripting](<https://devfeed.tech/tags/scripting.md>), [server](<https://devfeed.tech/tags/server.md>), [web](<https://devfeed.tech/tags/web.md>)

## AI overview

This research paper presents practical web timing attack techniques for extracting server secrets and exposing hidden attack surfaces. It describes methods involving masked misconfigurations, blind data-structure injection, hidden routes, and automated exploitation, supported by real-world case studies, open-source tools, custom scripting, and a CTF.

## Source excerpt

Websites are riddled with timing oracles eager to divulge their innermost secrets. It's time we started listening to them. In this paper, I'll unleash novel attack concepts to coax out server secrets