Links

An assorted list of links and references, for recent proof of concepts see [Real](Real-World-Examples).

1. Network timing based attacks

Network based attacks suffered from being slow, noisy and often rate limited by DoS protection.

2007 - In [Exposing](https://crypto.stanford.edu/~dabo/papers/webtiming.pdf), Andrew Bortz et al. describe an attack against web servers, in which the time a site takes to respond to a request can be used for leaking information (cross-site timing).

2009 - In [Cross-domain](https://scarybeastsecurity.blogspot.com/2009/12/cross-domain-search-timing.html), Chris Evans explains how to time the response of a site to figure out if a user is logged in or not, and introduces for the first time the concept of cross-site search.

2015 - In [Cross-Site](http://u.cs.biu.ac.il/~herzbea/security/15-01-XSSearch.pdf) Nethanel Gelernter and Amir Herzberg describe the attack again, but present better attacks based on statistical tests, algorithms, and some application-specific behaviors.

1. Client-based attacks

Client-based attacks made these attacks more accessible, as attacks required significantly less time to perform, and were significantly more accurate and exploitable than their network-timing counterparts.

2013 - patrojk described how to [figure](http://patorjk.com/blog/2013/03/01/facebook-user-identification-bug/) by simply checking the image height/width of a Facebook image.

2015 - mala discovered a [vulnerability](http://api.ma.la/redirect_or_not/) that allows to read the size of a response cross-domain [this](https://gist.github.com/mala/f86a849d15b2d60d7119e05f33b4b885#flash-and-cors).

2015 - In [The](https://tom.vg/papers/timing-attacks_ccs2015.pdf), Tom Van Goethem et.al started looking at improvements on the attacks presented in XS-Search by abusing browser APIs.

2016 - As a [follow-up](https://tom.vg/2016/08/browser-based-timing-attacks/) and [presentation](https://tom.vg/talks/AppSecEU-Timing-Attacks.pdf) to the previous paper, Tom Van Goethem explained in more detail the attacks presented.

2016 - In the [Request](https://tom.vg/papers/request-and-conquer_usenix2016.pdf) paper, Tom Van Goethem explained the different types of information leaks and their vectors, and followed with a [whatwg](https://github.com/whatwg/storage/issues/31).

2016 - Nethanel Gelernter followed up with [Advanced](https://www.owasp.org/images/0/04/AppSecIL2016_AdvancedCrossSiteSearch_NethanelGelernter.pdf) described optimizations to the previous attacks based on "Second Order XS-Search".

1. 1. (Annex) XSS Filters information leaks

Independently of the work above, there was also a lot of research into information leaks introduced by XSS filters. The connection to XS-Search didn't happen until 2018.

2013 - Emil Lerner found [a](https://bugs.chromium.org/p/chromium/issues/detail?id=331060) that abused a Chrome's XSS auditor false positive into a more powerful information leak. A similar, but [more](https://bugs.chromium.org/p/chromium/issues/detail?id=331725) was found soon after the fix.

2013 - In [Hacking](http://homakov.blogspot.com/2013/02/hacking-with-xss-auditor.html) Egor Homakov described [a](https://bugs.chromium.org/p/chromium/issues/detail?id=173906) in Chrome that allowed redirect information to be disclosed.

2014 - In [Information](https://www.mbsd.jp/blog/20160407.html) Takeshi Terada described an attack to steal tokens from script elements by brute forcing them.

2015 - In [Abusing](https://portswigger.net/blog/abusing-chromes-xss-auditor-to-steal-tokens) Gareth Heyes described [a](https://bugs.chromium.org/p/chromium/issues/detail?id=498982) in Chrome that could be used to bruteforce tokens.

2015 - In [X-XSS-Nightmare:](https://www.slideshare.net/masatokinugawa/xxn-en) Masato Kinogawa presented attacks against the IE XSS filter to steal content cross-domain.

2018 - In [Exposing](https://portswigger.net/blog/exposing-intranets-with-reliable-browser-based-port-scanning) Gareth Heyes presented a technique for detecting network error pages, which triggered a [discussion](https://twitter.com/sirdarckcat/status/1060952835737747466) about the XSS auditor and XSS Search.

2019 - In [XS-Search](https://youtu.be/HcrQy0C-hEA?t=380) LiveOverflow described a challenge in the [35c3ctf](https://ctftime.org/event/718) inspired by XS-Search and XSS auditor.