Skip to content

XS-Leak

Cross-Site Leaks (XS-Leaks) are side-channel vulnerabilities allowing attackers to infer sensitive information from a target origin without reading the response body. They exploit browser behaviors, timing differences, and observable side effects rather than traditional XSS data exfiltration.

Summary

Tools

Methodology

Attack Primitives

Unlike classic CORS or XSS attacks, XS-Leaks rely on observable browser behavior:

Primitive Leaks
Timing Resource size / complexity
Frame count Content differences
Errors Access control decisions
Cache Previous visits
Navigation Auth state
Rendering Text length

XS-Search attacks abuse Query-Based Search Systems to leak user information. By measuring the side effects of a search query (e.g., response time, frame count, or error events), an attacker can infer whether a search returned results or not. This boolean oracle can be used to brute-force sensitive data character by character.

Examples:

  • Opening 50 tabs and use the timing difference from an iframe CSP violation in the search results page to bruteforce the flag character by character.

Cross-site Oracles

Timing Attacks

In a timing attack, an attacker seeks to uncover sensitive information by observing how long a system takes to respond to particular requests. They deploy carefully designed scripts to the target application to execute API calls, send AJAX requests, or initiate cross-origin resource sharing (CORS) interactions. By measuring and comparing the response times of these operations, the attacker can deduce insights about the system’s internal behavior, data validation processes, or underlying security controls.

Frame Counting

If a page loads different numbers of iframes based on the user's state (e.g., search results), an attacker can count them to infer data.

// Get a reference to the window
var win = window.open('https://example.org');

// Wait for the page to load
setTimeout(() => {
  // Read the number of iframes loaded
  console.log("%d iframes detected", win.length);
}, 2000);

Cache Probing

In a cache probing attack, a malicious website attempts to determine whether a specific resource from a target site is already stored in the victim’s browser cache. The attacker causes the browser to request a resource (for example, an image, script, or endpoint) that may only be cached if the user is authenticated or has previously visited a particular page. By measuring how quickly the resource loads, or by observing differences in behavior between a cached and non-cached response, the attacker can infer sensitive information.

Known Oracles

Labs

References