2 ms·
Do you have any more information on the local network scanning?
by voxadam 8y ago
Do you have any more information on the local network scanning?
- danShumway 8y agoNot sure if this is what grandparent is referring to, but DNS rebinding[0] is what springs to mind. It's simultaneously kind of smart and also really stupid. Basically, you give a valid 3rd-party domain multiple IPs, one of them normal and one of them resolving to a local IP. Then you cut off the normal one and the browser just allows you to make calls to whatever local interface you want. There was a good defcon video about this a while back[1]. It's a much bigger problem than most people realize. This is why it's good practice to have at least some security around devices even if they're only connected to your LAN. [0]: https://www.twistlock.com/2018/02/28/dear-developers-beware-dns-rebinding/ https://www.twistlock.com/2018/02/28/dear-developers-beware-... [1]: https://www.youtube.com/watch?v=stnJiPBIM6o https://www.youtube.com/watch?v=stnJiPBIM6o
- szc 8y agoHere is an example. Start at https://mycloud.com/setup https://mycloud.com/setup. Load the web inspector, find and read scanner.js. The Javascript isn't minimized and there are some comments.