In a time before HTTPS (which wasn’t too long ago), this would have been a lot more concerning. Of course, the extraction of a target IP may be interesting, but

In a time before HTTPS (which wasn’t too long ago), this would have been a lot more concerning. Of course, the extraction of a target IP may be interesting, but a device currently sends so many requests once it connects to the internet, anything from Apple/MS to all and every piece of software checking for updates… it sounds quite hard to nail the right timing and get a spicy result out of this. And once the attack happens, the target is disconnected and that was your one shot, no? Also, the URL params, headers, Cookies, etc are all encrypted at this point. Not to diminish the effort and write up, I fully get how exciting this is to discover, but it feels a bit more at home in a bug report for router firmware. Am I missing something?