Check out our blog post introducing OffTempo here.
OffTempo is a Burp Suite extension that captures HTTP response timing data from Intruder attacks and performs statistical analysis to detect timing-based side channels. It compares two pools of requests and tells you whether the observed latency differences are meaningful or just noise.
Useful for detecting:
- Resource enumeration via response time differentials
- Timing-based blind SQL injection
- Password / authentication timing attacks
- Any scenario where server-side branching leaks through response latency
The primary metric is AUC (Area Under the Curve) via Mann–Whitney U - intuitively, the probability that a random observation from a set of requests exceeds one from another set. Additional statistics (Cohen's d, p-value, standard deviation, p95/p99) are provided for deeper analysis.
- Download the latest
offtempo.jarfrom the Releases page - In Burp Suite, go to Extensions → Installed → Add
- Set Extension type: Java and load the JAR
Requires Java 17+ and Gradle.
git clone https://github.com/anvilventures/offtempo.git
cd offtempo
./gradlew bigJar
The JAR is generated under build/libs/. Load it into Burp Suite as above.
- Enable capture: Toggle timing capture on in the OffTempo tab
- Fill Pool A: Set up an Intruder attack for your first class of requests (e.g. a known existing resource) and run it. Timing data flows into Pool A automatically. Aim for at least 30–50 requests per pool to reduce the impact of network jitter and get statistically reliable results.
- Switch to Pool B: Select Pool B in OffTempo, then run a second Intruder attack for your other class of requests (e.g. a known non-existing resource).
- Run analysis: Click Run. OffTempo computes the AUC score, plots both distributions, and outputs statistical metrics.
Instead of the capture toggle, you can tag a request's pool directly with the X-OffTempo-Pool header (A or B). Any request carrying it is assigned to that pool regardless of the UI toggle, no matter where it originates: an external CLI tool proxied through Burp, another Burp tool (Repeater, etc.), or another Burp extension. The header is stripped before the request is forwarded. For example, driving pools from the command line:
curl -sk --proxy http://127.0.0.1:8080 -H "X-OffTempo-Pool: A" https://example.com