browser-side-channel

What problem does it solve?

This Skill solves the challenge of extracting cross-origin information when direct XSS attacks are not viable, enabling detection of authentication state, user roles, or sensitive content on third-party origins without direct access.

Core Features & Use Cases

• Connection Pool Exhaustion Leak: Saturate Chrome's 256-connection pool to detect cross-origin redirect destinations via DNS timing differences.
• ETag Length Oracle: Exploit auto-generated Express.js ETags to infer response size and user state via header padding manipulation.
• Timing-Based State Detection: Measure cross-origin resource load times to distinguish between logged-in and logged-out states on target origins.
• Cache Probing: Leverage cached resource load speed differences to detect same-site browsing history. Use Case: For red team engagements where you need to confirm if a target user has access to a sensitive admin panel or privileged content without XSS or direct API access.

Quick Start

Use the browser-side-channel skill to verify if a target user is logged into their corporate admin dashboard by measuring cross-origin image load timing differences from your testing origin.