I've been researching BREACH, and while I can understand how it might work if you have access to the the browser (to send crafted requests) and the wire (to capture compressed response length), I haven't seen a way to do this without access to the wire, aside from a fragile timing attack on response time. You can get
Content-length with this code, but it only works if the site enabled CORS and isn't used a chunked
var req = new XMLHttpRequest(); req.open('GET', document.location, false); req.send(null); req.getAllResponseHeaders().toLowerCase();
There's also an
iframe approach, but I'm not aware of a way to get the
Content-length for an iframe, and again, this fails if it's chunked.
Am I missing something? I there a technique I haven't covered for getting the
Content-length? It doesn't seem to be a viable attack without both access to the browser and access to either that, or to the wire.