XS-Leak/README.md
Cross-Site Leaks (XS-Leaks) are side-channel vulnerabilities allowing attackers to infer sensitive information from a target origin without reading the response body. They exploit browser behaviors, timing differences, and observable side effects rather than traditional XSS data exfiltration.
Unlike classic CORS or XSS attacks, XS-Leaks rely on observable browser behavior:
| Primitive | Leaks |
|---|---|
| Timing | Resource size / complexity |
| Frame count | Content differences |
| Errors | Access control decisions |
| Cache | Previous visits |
| Navigation | Auth state |
| Rendering | Text length |
XS-Search attacks abuse Query-Based Search Systems to leak user information. By measuring the side effects of a search query (e.g., response time, frame count, or error events), an attacker can infer whether a search returned results or not. This boolean oracle can be used to brute-force sensitive data character by character.
Examples:
In a timing attack, an attacker seeks to uncover sensitive information by observing how long a system takes to respond to particular requests. They deploy carefully designed scripts to the target application to execute API calls, send AJAX requests, or initiate cross-origin resource sharing (CORS) interactions. By measuring and comparing the response times of these operations, the attacker can deduce insights about the system’s internal behavior, data validation processes, or underlying security controls.
If a page loads different numbers of iframes based on the user's state (e.g., search results), an attacker can count them to infer data.
// Get a reference to the window
var win = window.open('https://example.org');
// Wait for the page to load
setTimeout(() => {
// Read the number of iframes loaded
console.log("%d iframes detected", win.length);
}, 2000);
In a cache probing attack, a malicious website attempts to determine whether a specific resource from a target site is already stored in the victim’s browser cache. The attacker causes the browser to request a resource (for example, an image, script, or endpoint) that may only be cached if the user is authenticated or has previously visited a particular page. By measuring how quickly the resource loads, or by observing differences in behavior between a cached and non-cached response, the attacker can infer sensitive information.