skills.rest
dreadnode
dreadnodeOFFICIAL
Explore all skills by this author →
Website𝕏@dreadnodeGitHub

timing-attack-recon

Measure server-side timing differentials to identify hidden web attack surfaces.

11|1|Updated May 4, 2026
Search Tags:#web-security#ssrf#timing-attack#red-teaming#hidden-parameters#response-time-analysis#header-fuzzing
One-click install
npx skills add https://github.com/dreadnode/capabilities --skill timing-attack-recon
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: timing-attack-recon
Source: https://github.com/dreadnode/capabilities/tree/main/capabilities/web-security/skills/timing-attack-recon
Command: npx skills add https://github.com/dreadnode/capabilities --skill timing-attack-recon

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Traditional web fuzzing often misses hidden backend parameters, internal routing headers, and scoped SSRF vulnerabilities because all responses return uniform bodies, but server-side processing delays reveal these invisible attack surfaces.

Core Features & Use Cases

  • Hidden Parameter Discovery: Identifies unexposed backend parameters that trigger server-side logic (like database queries or debug modes) without altering response content.
  • Header Abuse Detection: Finds headers such as X-Forwarded-For that modify proxy routing or access control, enabling bypasses of IP-based restrictions.
  • Scoped SSRF Enumeration: Detects proxy endpoints that route to internal services by comparing response times for external domains versus internal IPs and subdomains.
  • Use Case: A red teamer testing a public API that returns 200 OK for all inputs can use this skill to find hidden admin endpoints or internal SSRF vectors that manual testing and body-based fuzzing would miss.

Quick Start

Use the timing-attack-recon skill to discover hidden parameters and scoped SSRF vectors on the target web application at https://target.com.

Frequently Asked Questions about timing-attack-recon

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I discover hidden web parameters when the server returns uniform response bodies?▼

To discover hidden web parameters with uniform response bodies, you measure server-side timing differentials. This timing analysis isolates processing delays caused by backend logic, revealing invisible attack surfaces that traditional body-based fuzzing misses.

Can I detect scoped SSRF endpoints by analyzing server-side response times?▼

You can detect scoped SSRF endpoints by analyzing server-side response times. This technique compares the processing delays of routing to external domains versus internal IPs, revealing proxy endpoints that route to internal services.

How do I eliminate network jitter when measuring response time differentials for red teaming?▼

To eliminate network jitter when measuring response time differentials, you use single-packet HTTP synchronization. This establishes statistical baselines and isolates server-side processing delays from network noise during security assessments.

How does header fuzzing find proxy routing abuses like X-Forwarded-For bypasses?▼

Header fuzzing finds proxy routing abuses by measuring timing differentials when sending headers like X-Forwarded-For. Processing delays indicate the header modifies proxy routing or access control, enabling bypasses of IP-based restrictions.

What is the best way to find hidden admin endpoints on a public API returning 200 OK?▼

The best way to find hidden admin endpoints on a public API returning 200 OK is timing analysis. By measuring server-side processing delays, you can identify unexposed backend parameters triggering debug modes or database queries without altering response content.

Does timing attack reconnaissance work for web fuzzing if all inputs return 200 OK?▼

Timing attack reconnaissance works for web fuzzing when all inputs return 200 OK. It bypasses the need for response body variations by establishing statistical baselines to detect the server-side processing delays of hidden parameters and internal routing headers.

Related Skills

Explore More Software Engineering Skills→
333-333-333333-333-333

go-gin-handlers

Implement standardized Gin HTTP handlers with versioned routing and middleware.

Community
Advanced
yhy0yhy0
518

ssrf

Detect and exploit server-side request forgery vulnerabilities in URL parameters.

Community
Advanced
EntroVyxEntroVyx
3

request-import

Parse HAR exports and raw HTTP requests into structured endpoint and authentication inventories.

Community
Intermediate
ok-helloworldok-helloworld
241

crlf-injection

Detect CRLF injection vulnerabilities in HTTP response headers and bodies.

Community
Intermediate