# Listen to the whispers: web timing attacks that actually work

PortSwigger research shows single-packet timing attacks reliably detect scoped SSRF, blind injection, and hidden parameters, enabling reverse-proxy firewall bypass and front-end impersonation.

- Payout: Research
- Program: Web applications
- Credited: PortSwigger Research
- Disclosed: 2024-08-07
- Write-up quality: 9/10
- Original: https://portswigger.net/research/listen-to-the-whispers-web-timing-attacks-that-actually-work
- Library page: https://bugbountylibrary.com/r/blog%3Aportswigger-net-research-listen-to-the-whispers-web-timing-attacks-that-actually-work
- Tags: domain:web impact:data-leak impact:internal-access kind:research platform:research tech:rest technique:blind technique:race-window vuln:misconfiguration vuln:sqli vuln:ssrf

**Target:** HTTP/2 web servers, reverse proxies, and back-end services
**Root cause:** Response timing leaks internal control flow: DNS lookups, exception short-circuits, cache-key handling, and proxy routing reveal hidden parameters, injection points, and scoped SSRF that response content hides.
**Steps:**
1. Use single-packet attack: disable TCP_NODELAY, send ping frame per request, send headers, withhold final data frame, wait 100ms, send ping, send final frames to coalesce header frames
2. Measure bottom quartile of 30 timing samples per payload pair and compare for distinct vs overlapping distributions
3. Detect scoped SSRF by sending `Host: abc.example.com` twice and observing DNS-cache-induced speedup, or use 64-octet DNS label to force fast refusal
4. Detect blind injection by comparing reserved URI chars `%23` vs `%21` in parameters and observing response-order bias across 50 request pairs
5. Detect hidden parameters by adding response-time as a Param Miner attribute and comparing timing distributions
6. Exploit reverse proxy by routing `Host: internal.target` through a discovered open proxy to bypass firewall or front-end rules
**How found:** Kettle revisited prior timing research, recognized network jitter as the dominant noise source, and applied the single-packet attack (originally for race conditions) to eliminate request-order bias. He then added response-time as a Param Miner attribute and scanned 30,000 live bug bounty sites, noticing that exceptions short-circuit code paths and DNS lookups create detectable delays.
**Exploitation:** Route requests through a misconfigured reverse proxy with attacker-controlled Host header to reach internal systems behind firewalls, bypass front-end security rules, or impersonate the front-end by smuggling trusted headers (e.g. Service-Gateway-Is-Newrelic-Admin) to back-ends that implicitly trust them.
**Escalation:** Chain scoped SSRF with subdomain takeover pointing DNS to arbitrary IP to upgrade to full SSRF; use reverse-proxy routes for HTTP request smuggling and front-end impersonation to reach internal admin APIs.
**Insight:** Timing is exceptionally good at detecting exceptions and DNS lookups: an input that triggers an error short-circuits a slow code path and returns faster, so compare timing of malformed vs valid inputs to find hidden parsers and scoped SSRF that OAST cannot see.