skills.rest
dreadnode
dreadnodeOFFICIAL
Explore all skills by this author →
Website𝕏@dreadnodeGitHub

browser-side-channel

Detect cross-origin authentication state via browser timing and cache side channels.

11|1|Updated May 4, 2026
Search Tags:#timing attack#red teaming#browser side channel#cross-origin leak#ETag oracle#connection pool exhaustion#cache probing
One-click install
npx skills add https://github.com/dreadnode/capabilities --skill browser-side-channel
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: browser-side-channel
Source: https://github.com/dreadnode/capabilities/tree/main/capabilities/web-security/skills/browser-side-channel
Command: npx skills add https://github.com/dreadnode/capabilities --skill browser-side-channel

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

This Skill solves the challenge of extracting cross-origin information when direct XSS attacks are not viable, enabling detection of authentication state, user roles, or sensitive content on third-party origins without direct access.

Core Features & Use Cases

  • Connection Pool Exhaustion Leak: Saturate Chrome's 256-connection pool to detect cross-origin redirect destinations via DNS timing differences.
  • ETag Length Oracle: Exploit auto-generated Express.js ETags to infer response size and user state via header padding manipulation.
  • Timing-Based State Detection: Measure cross-origin resource load times to distinguish between logged-in and logged-out states on target origins.
  • Cache Probing: Leverage cached resource load speed differences to detect same-site browsing history. Use Case: For red team engagements where you need to confirm if a target user has access to a sensitive admin panel or privileged content without XSS or direct API access.

Quick Start

Use the browser-side-channel skill to verify if a target user is logged into their corporate admin dashboard by measuring cross-origin image load timing differences from your testing origin.

Frequently Asked Questions about browser-side-channel

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I detect a user's authentication state on a third-party origin without XSS?▼

Cross-origin leaks via browser side channels detect authentication state by measuring observable timing differentials and resource load behaviors without direct access. This approach extracts sensitive user role data when direct XSS attacks are not viable.

What is an ETag length oracle and how does it infer response size?▼

An ETag length oracle exploits auto-generated Express.js ETags to infer response size and user state. It manipulates header padding to measure observable variations, enabling cross-origin data leakage without accessing the target directly.

How does connection pool exhaustion leak cross-origin redirect destinations?▼

Connection pool exhaustion saturates Chrome's 256-connection pool to detect cross-origin redirect destinations. It measures DNS timing differences to confirm if a target user has access to privileged content during red team engagements.

Can I use cache probing to detect same-site browsing history?▼

Cache probing leverages cached resource load speed differences to detect same-site browsing history. It works by measuring observable browser behavior to identify previously visited cross-origin resources during security testing.

When should I use browser side channel techniques instead of direct API access?▼

Use browser side channel techniques for red team engagements when direct API access or XSS attacks fail. They are necessary to detect sensitive content and user roles on third-party origins by observing indirect browser behavior.

Related Skills

Explore More Software Engineering Skills→
RedHatProductSecurityRedHatProductSecurity
47

constant-time-testing

Detect timing side-channel vulnerabilities in cryptographic implementations.

Official
Intermediate
cybersecwomancybersecwoman
5

hunt-subdomain

Scan CNAME records and provider fingerprints to validate subdomain claimability.

Community
Advanced
kiwamizamuraikiwamizamurai
7

networking

Analyze PCAP captures for data exfiltration and protocol misuse.

Community
Intermediate
zebbernzebbern
34

Cross-Site Scripting and HTML Injection Testing

Detect, exploit, and bypass filters for Cross-Site Scripting and HTML injection vulnerabilities in web applications.

Community
Advanced