Merge pull request #2311 from HackTricks-wiki/research_update_src_pentesting-web_xs-search_connection-pool-example_20260602_043930

Research Update Enhanced src/pentesting-web/xs-search/connec...

Author: carlospolop

src/pentesting-web/xs-search/connection-pool-example.md

@@ -308,6 +308,18 @@ Same tactic but different code from [https://blog.huli.tw/2022/10/05/en/sekaictf
 </html>
 ```
 
+
+## Practical Notes for Modern Browsers
+
+These examples are still useful, but some assumptions from 2022 are **less portable** in modern browsers:
+
+- **Do not assume a globally shared socket pool anymore.** Firefox's **State Partitioning / Network Partitioning** also covers **connection pooling**, and Brave shipped **pool-party** mitigations after showing that many browser resource pools could be turned into side channels.
+- When the **global** connection-pool oracle is noisy or simply dead, prefer scenarios where the attacker and victim requests still live in the **same partition** (for example attacker-controlled content rendered by the target site), or switch to the [Connection Pool by Destination Example](connection-pool-by-destination-example.md) where the primitive is the **per-destination queue** instead of the global pool.
+- **Calibrate every browser/profile/run.** The effective limits can change between **headless/headful** runs, and **HTTP/1.1, HTTP/2 and HTTP/3** may **reuse** existing connections. Moreover, **HTTP/2 connection coalescing** means that **different hostnames are not always different sockets** if they end up on the same backend/certificate.
+- In practice, make your probes more stable by using **`cache: "no-store"`**, random query strings, a short **warm-up round**, and keeping the **same `credentials` mode** across all measurements. If your socket blockers stop blocking, suspect **connection reuse/coalescing** before assuming the leak is gone.
+- Thresholds are usually **empirical**. The safelist writeups above relied on averaging multiple rounds and tuning the cutoff on the real bot/browser before bruteforcing characters.
+
+
 ## DiceCTF 2022 - carrot
 
 In this case the first step of the exploit was to abuse a CSRF to modify the page where the flag is contained so it has **much more content** (and therefore loading it takes more time), and then **abuse the connection pool to measure the time it takes to access the page** that could be potentially having the flag.
@@ -525,7 +537,11 @@ In the exploit you can see:
 </script>
 ```
 
-{{#include ../../banners/hacktricks-training.md}}
 
 
 
+## References
+
+- [MDN - State Partitioning](https://developer.mozilla.org/en-US/docs/Web/Privacy/Guides/State_Partitioning)
+- [Brave - Preventing pool-party attacks](https://brave.com/privacy-updates/13-pool-party-side-channels/)
+{{#include ../../banners/hacktricks-training.md}}