Timing-Attack on Łukasz Pastuszak

Timing-Attack on Łukasz Pastuszak - security noteshttps://lukaszpastuszak.dev/tags/timing-attack/Recent content in Timing-Attack on Łukasz Pastuszak - security notesHugoen-usSun, 06 Sep 2026 00:00:00 +0000Timinghttps://lukaszpastuszak.dev/writeups/timing/Sun, 06 Sep 2026 00:00:00 +0000https://lukaszpastuszak.dev/writeups/timing/A login timing side channel enumerates users, mass assignment sets role=1, an LFI plus php://filter discloses source, a predictable MD5(time()) upload name gives RCE, a git history leak yields a reused password, and Axel's .axelrc default_filename overwrites root's authorized_keys.