| name | connection-pool-timing-attack |
| description | How to perform timing-based XSS attacks exploiting browser connection pool limits. Use this skill whenever you need to leak data through timing side-channels, exploit Chrome's 6 concurrent connection limit per origin, perform blind XSS exfiltration, or extract secrets when direct data exfiltration is blocked. Make sure to use this skill for any timing-based attack, connection pool exploitation, or when you need to extract data from a blind XSS scenario where traditional exfiltration methods are blocked. |
Connection Pool Timing Attack
A technique to leak data through timing side-channels by exploiting browser connection pool limits (Chrome allows 6 concurrent connections per origin).
Attack Overview
This attack works by:
- Injecting a payload with many
<img> tags loading a resource from the target origin
- Triggering the connection pool limit (6 concurrent requests max in Chrome)
- Timing a request to the same origin
- Detecting whether the pool is blocked (slow = injection active) or free (fast = injection inactive)
- Iterating through possible characters to extract secrets
When to Use This Attack
- Blind XSS scenarios where you can't directly exfiltrate data
- When the target has conditional resource loading based on input
- CTF challenges with timing-based vulnerabilities
- When traditional XSS exfiltration (beacon, fetch, img) is blocked
- When you need to extract secrets character-by-character
Attack Pattern
Step 1: Create Payload with Many Image Tags
Inject a note/payload containing:
- The secret prefix + test character
- 70+
<img> tags pointing to a resource on the target origin
