⚠️ Training Target: This system may leak information through timing differences and error messages.
⏱️ Request Performance Metrics
Patient ID: abc
Query Time: 89ms
Database Status: Connected
Server Load: Normal
🚫 Patient Not Found
No patient record found for ID "abc".
Error Code: PATIENT_NOT_FOUND
Searched ID: abc
Database Status: No matching records
⚡ Fast Response: Very quick response time (89ms)
suggests the patient ID doesn't exist - no database lookup needed.
🎯 Hunter Objective:
- Pay attention to response times and error message differences
- Fast responses (~89ms) = ID doesn't exist
- Medium responses (~1456ms) = Valid patient, accessible
- Slow responses (~2198ms) = Valid patient, access denied
- Very slow responses (~2847ms) = Admin account with extra logging
- Use timing patterns to identify valid IDs, then find admin accounts
🔧 Test Different Patient IDs:
🕐 Response Time Patterns
Timing Analysis Guide:
~89ms - Non-existent ID (immediate rejection)~1456ms - Valid patient (standard database query)~2198ms - Restricted patient (security checks)~2847ms - Admin account (audit logging + permissions)
🚨 Side-channel timing IDOR vulnerability | Let's Jam Training Platform