By monitoring the time an application takes to complete a task, it is possible for attackers to gather or infer information about how an application is coded. For example, a login process using valid credentials receives a response quicker than the same login process given invalid credentials. This delay in response time leaks information related to system processes. An attacker could use a response time to perform account enumeration and determine valid usernames based upon the time of the response.
Performing process-timing attacks
Getting ready
For this recipe, you will need the common_pass.txt wordlist from wfuzz:
- https://github.com/xmendez/wfuzz
- Path: wordlists | other | common_pass.txt
Using OWASP Mutillidae II...