h2time.py is a Python implementation that can be used to test HTTP/2 servers for Timeless Timing Attack vulnerabilities.
pip install h2) - tested with 3.2.0
A very basic example is given below, for additonal examples, please refer to examples.py.
from h2time import H2Request, H2Time r1 = H2Request('GET', 'https://tom.vg/?1') r2 = H2Request('GET', 'https://tom.vg/?2') async with H2Time(r1, r2) as h2t: results = await h2t.run_attack() print('\n'.join(map(lambda x: ','.join(map(str, x)), results)))
H2Request objects are created, which are then passed on to
Note that both requests should be to the same server (as this is the basic requirement to perform timeless timing attacks).
run_attack() method is called, the client will start sending request-pairs and will try to ensure that both arrive at the same time at the server (the final bytes of each request should be placed in a single TCP packet).
On the first request, additional parameters are added to the URL to offset the difference in time when requests can start being processed (the number is defined by the
num_padding_params parameter - default: 40).
H2Time can operate in a sequential mode, where it waits to send the next request-pair until the response for the previous one has been received.
sequential is set to
False, all request-pairs will be sent at once, at an interval of a number of milliseconds defined by the
The results that are returned is a list of tuples with 3 elements: (0) difference of response time (in nanoseconds) between the second request and the first one, (1): response status of the first request, (2): response status of the second request.
If the difference in response time is negative, this means that a response for the second request was received first. To perform a timeless timing attack, one should only need to take into account whether the result is positive or negative (positive indicates that the processing time of the first request takes less time than processing the second request).
Timing attacks can be quite tricky to exploit, so it's best to follow these best practices:
H2Time(r2, r1)to avoid bias that may be introduced by the first request (support for this in
Please be aware that this Python implementation may still be a bit rough around the edges. As it will be further developed, it is likely that there will be breaking changes. If you encounter any issue with it, please file an issue! For any other questions, suggestions and remarks, feel free to contact me.