🎄 Join our Annual Holiday wargame and win prizes!


Timing Attack

A timing attack is a side-channel vulnerability where an adversary gains information by measuring differences in the time an application takes to perform operations. For example, an application may respond faster when a username is invalid, but take longer when the username is valid and only the password is incorrect (due to password hash calculation or additional database lookups). By precisely measuring these discrepancies, an attacker can enumerate valid usernames or infer secret values such as cryptographic keys.

Remediation

  • Use constant-time or atomic operations for all security-sensitive comparisons (e.g., authentication, cryptographic checks).
  • Replace standard string or byte comparisons with constant-time functions that do not short-circuit on mismatches.
  • Introduce uniform response times for authentication endpoints, independent of input validity.
  • For cryptographic operations, use well-vetted libraries that already implement constant-time algorithms.

Metadata

  • Severity: medium
  • Slug: timing-attack

CWEs

  • 208: Observable Timing Discrepancy

OWASP

  • A04:2021: Insecure Design

Available Labs

Select a language to explore available labs for this vulnerability.

No matching labs found

Try adjusting your language filter.

Deco line
Deco line

Play AppSec WarGames

Want to skill-up in secure coding and AppSec? Try SecDim Wargames to learn how to find, hack and fix security vulnerabilities inspired by real-world incidents.

For Companies Play Now
Deco line
Deco line

Got a comment?

Join our secure coding and AppSec community. A discussion board to share and discuss all aspects of secure programming, AppSec, DevSecOps, fuzzing, cloudsec, AIsec code review, and more.

Read more