A lot of POS systems have pretty cool levels of tamper detection. Take a look at @colinoflynn ‘s videos tearing down one:
youtu.be/pB8T5wZJLcM
You can wrap @0xnxenon's h2xspacex library pretty quickly in python to perform timing-related SPA tests. Here's a scoped-SSRF detection using that detects DNS behavior changing between 60 and 70 chars of the host header as explained in @albinowax's presentation
I have added some features to get time of the responses in nano seconds on h2spacex library and also enhanced Single Packet Attack method. Now you can exploit the timing attacks 🔥⏱️
github.com/nxenon/h2spacex
I don’t agree with defending against the side-channel measurements as a solution to leakage. It adds performance burden to all users and I’m not yet convinced that SPA is mandatory to detect leaky channels. I firmly believe every specific leak needs its own custom defense.
The whitepaper is live! Listen to the whispers: web timing attacks that actually work. Read it here ->
portswigger.net/research/lis…
