16 ms·

I can see your local web servers

652 points by jamesfisher 7y ago

jsgyx 7y ago
I use NoScript, you can't see shit.
- julienreszka 7y ago
  You can't see shit neither
  - vbsteven 7y ago
    yes, he can, he will see the modern equivalent of "This site is best viewed in Internet Explorer". Which in 2019 becomes "Please enable Javascript to view this page"
    - larkeith 7y ago
      Honestly, such notices are shockingly unusual - most of the time (at least for the sites I encounter) they don't bother with <noscript>, you just get a broken and/or blank page. I mostly use the web for reading blogs and articles, so the loss of dynamic sites isn't troublesome, but it's certainly not for most users. (Edit: Some numerical context I have enabled Javascript for 194 sites over the last five years, whereas I encounter several new sites daily.)
      - vbsteven 7y ago
        I also browse with noscript all the time and I get them quite often. Mostly on product landing pages and Show HN demos.
        larkeith 7y ago
        Hmm, I wonder if it's confirmation bias on my end, or just a difference in what pages we each view.
        npsimons 7y ago
        > Hmm, I wonder if it's confirmation bias on my end, or just a difference in what pages we each view. Yes. Joking aside, I will add that I've been a NoScript/FlashBlock user for quite some time (more than a decade? I honestly can't remember), and while I run into some things that are frustrating (just had to disable NoScript for a tab to order plane tickets), it is refreshingly uncommon. Yes, you can browse with default deny to JS and Flash.
  - alfiedotwtf 7y ago
    That was actually funny
  - icebraining 7y ago
    Actually, they can: even if you enable JS, NoScript's ABE will prevent this attack: https://en.wikipedia.org/wiki/NoScript#Application_Boundaries_Enforcer_.28ABE.29 https://en.wikipedia.org/wiki/NoScript#Application_Boundarie...
    - mrob 7y ago
      Not anymore. It's not included in modern versions (after the changes in Add-Ons for Firefox's Quantum update).
- dwb 7y ago
  This is not helpful, because only an extremely small proportion of Web users run NoScript, and nor should they have to.
  - gnomewascool 7y ago
    > This is not helpful, because only an extremely small proportion of Web users run NoScript, and nor should they have to. Most (non-technical) Web users also don't run their own web servers, so they aren't affected. Among technical users, the proportion with NoScript is probably not as small.
    - tinus_hn 7y ago
      Most users have a modem or router that comes with a web interface, like just about everything in the internet of things.
    - deadbunny 7y ago
      Their routers do, along with an ever growing number of IoT devices people happily hook up to their WiFi without a second thought. Given the long and gory history of companies releasing insecure by default devices methods like this are a legitimate entry point into a network.
  - jsgyx 7y ago
    That's like saying that people shouldn't have to run ad blockers, that instead ad networks should behave. Sit and wait.
- Thorrez 7y ago
  Here's a port scanning technique that doesn't use javascript: https://blog.jeremiahgrossman.com/2006/11/browser-port-scanning-without.html https://blog.jeremiahgrossman.com/2006/11/browser-port-scann...
shakna 7y ago
I can see the list of XHR requests made, and I have half a dozen local web servers running, and there are a bunch of other web servers running on my network. I have a bad habit of spinning up a server on an ESP32 whenever I want to remote control something physical. ... Strangely, despite the XHR's hitting ports and IPs I know are running unsecured web servers, the site sees nothing. Lots of "unreachable". Firefox 67.0, Arch Linux (5.0.10).
- sepbot 7y ago
  The requests should fail unless the servers you are running allow CORS as per the headers.
  - shakna 7y ago
    There's half a dozen that are.
    - ypkuby 7y ago
      Do you have any locked down policy on them though? I assume this would only work if you gave blanket access. I noticed in my tests it found one on port 3000 with blanket access, but didn't see one on port 9999 with restricted access( policy => allow from *.mydomains )
      - shakna 7y ago
        Yes. I'm terrible and have them set to allow all domains, and all methods.
        dillonmckay 7y ago
        Maybe your browsers are up-to-date?
ivolimmen 7y ago
I only run on local on ports: 8080, 9090, 9191, 8081, 8082 and 8083. So scanning only on 3000 is a bit narrow...
- TimWolla 7y ago
  It does not only scan 3000. From the source code: const portsToTry = [ 80, 81, 88, 3000, 3001, 3030, 3031, 3333, 4000, 4001, 4040, 4041, 4444, 5000, 5001, 5050, 5051, 5555, 6000, 6001, 6060, 6061, 6666, 7000, 7001, 7070, 7071, 7777, 8000, 8001, 8080, 8081, 8888, 9000, 9001, 9090, 9091, 9999, ];
- boffinism 7y ago
  On my machine it seems to be scanning for lots of ports between :80 and :9999. I think it's using 3000 as an example in the text only.
- y0ghur7_xxx 7y ago
  It's not scanning only port 3000: const portsToTry = [ 80, 81, 88, 3000, 3001, 3030, 3031, 3333, 4000, 4001, 4040, 4041, 4444, 5000, 5001, 5050, 5051, 5555, 6000, 6001, 6060, 6061, 6666, 7000, 7001, 7070, 7071, 7777, 8000, 8001, 8080, 8081, 8888, 9000, 9001, 9090, 9091, 9999, ]; view-source:http://http.jameshfisher.com/2019/05/26/i-can-see-your-local-web-servers/ http://http.jameshfisher.com/2019/05/26/i-can-see-your-local... :125
majke 7y ago
My favorite is retrieving http://wpad/wpad.dat http://wpad/wpad.dat with ajax. https://bugs.chromium.org/p/chromium/issues/detail?id=123166 https://bugs.chromium.org/p/chromium/issues/detail?id=123166
deleted 7y ago
[deleted]
founderling 7y ago
I started a local webserver listening on localhost:80 just to see what happens, but this thing seems to not detect it. It shows me "Scanning localhost ... localhost complete." Edit: My guess is that this thing can only detect servers that send a CORS header that permits cross domain access. It could probably do way better detection if it did not do xhr requests but added script/css/whatever elements to its own page pointing to localhost and detects if those error out.
- ratsimihah 7y ago
  It's not that it doesn't detect it, but it's not open to external networks, which I guess is a good thing.
  - founderling 7y ago
    What do you mean?
    - timvisee 7y ago
      Probably that your browser is blocking access to the local domain, from the context of an external domain. I'm just guessing here, of course.
- jensneuse 7y ago
  CORS is a security mechanism for browsers to prevent leaking user information (e.g. cookies) when doing cross domain requests from a browser. CORS does not prevent accessing the server at all. You can always curl a CORS protected server but you won't be able to make a requests including the user's cookies from a disallowed domain.
  - jeltz 7y ago
    Well yeah, but CROS prevents his demo from working. And you cannot curl something remotely when it only binds to 127.0.0.1.
  - 7y ago
suyash 7y ago
Can anyone share what measures we can take as web developers to secure local development environment?
- falsedan 7y ago
  don't set up CORS in dev
- deno 7y ago
  Custom DNS server with DNS rebind protection. E.g. if you’re running OpenWRT you’re fine[1]. Also just don’t test on localhost. You can use a proper domain (or claim one in .test TLD[1] if you’re fine with selfsigned certs) and point it to localhost. If you’re going to use any redirect flow like OAuth/OpenID you’re going to need this for testing eventually anyway. [1] https://openwrt.org/docs/guide-user/base-system/dhcp https://openwrt.org/docs/guide-user/base-system/dhcp [2] https://en.wikipedia.org/wiki/.test https://en.wikipedia.org/wiki/.test
  - asdkhadsj 7y ago
    What do you recommend if you're running a local server? Eg, I've developed programs before with the assumption that the user will be running it either for their local machine, or perhaps for their local network. Think self hosted Wiki/etc. I was never sure (and thusly have yet to properly implement it) what would be secure, but also a good UX. A normal auth + self signed https would be simplest I imagine, but I'm not clear if browsers widely accept that. I recall Sandstorm having issues with this area, and required a domain to fully run properly. Which seems.. complex for a minimal install requirement. Thoughts?
    - deno 7y ago
      I actually wanted to do something similar one time and I figured there’s one way to do it: 1) Get a domain name for the project, e.g. mycoolwiki.tld 2) In the installer/setup provision for the user a random subdomain, e.g. d2c8116f19d0.mycoolwiki.tld 3) Use Let’s Encrypt DNS method to provision cert 4) Redirect d2c8116f19d0.mycoolwiki.tld to LAN IP It’s not ideal because you need some external infrastructure and it assumes no DNS rebind protection. However, if your webapp has a client and server, that is communicates via API only, you can actually do a lot better: 4) Setup local server to accept CORS requests from d2c8116f19d0.mycoolwiki.net only 5) Host client at d2c8116f19d0.mycoolwiki.tld Additionally, 6) Make the client a PWA with offline support and/or 6) Offer browser extension to use local copy of the client when user visits ∗.mycoolwiki.tld Though for my use case I actually wanted to have ∗.mycoolwiki.tld/ipfs/<hash> be backed by IPFS and offer generic extension that both verifies that the IPFS gateway is playing nice and (if configured) redirect to local gateway. Also offering Electron client instead of browser would work as well and saves you getting the cert.
deleted 7y ago
[deleted]
lostjohnny 7y ago
Nope, you can't Cross-Origin Request Blocked: The Same Origin Policy disallows reading the remote resource at http://localhost/. (Reason: CORS header ‘Access-Control-Allow-Origin’ missing) Anyway TypeError: /(192\.168\.[0-9]+\.)[0-9]+/.exec(...) is null i-can-see-your-local-web-servers:169:41
- chronial 7y ago
  The Cross-Origin check be circumvented via DNS Rebinding: When you request mypage.com, my DNS returns the ip of my webserver. On all subsequent requests, it will return 127.0.0.1. Now localhost is on the same origin as my page.
  - lostjohnny 7y ago
    It doesn't matter, you should be in control of a DNS the user relies on and you should have your server send Access-Control-Allow-Origin: mypage.com or Access-Control-Allow-Origin: * which is not a default anywhere AFAIK and is domain based, not IP based And your server should be enabled to respond to mypage.com host header
    - chronial 7y ago
      I don't quite understand your comment. Do you mean "shouldn't" whenever you wrote "should"?
      - m12k 7y ago
        I think they write 'should' when they mean 'need to if you want the aforementioned to be a practical attack vector'
      - lostjohnny 7y ago
        yeah, I meant need, sorry
    - chronial 7y ago
      Based on m12k's suggested interpretation of your comment: > you should be in control of a DNS the user relies on You always are when a users visits your domain – you control the DNS of your domain. > Access-Control-Allow-Origin: * You don't need access-control headers, because you stay on the same domain. > Your server should be enabled to respond to mypage.com host header Most servers listening on localhost ignore the host header.
jsty 7y ago
"If you see any results like 192.168.0.4:3000 is available!, you should tell your colleague to secure whatever she has running on that port" Someone's going to access this page at $BIGCORP with an overly trigger-happy IDS and get a fun morning meeting with IT to un-quarantine their machine.
- chrisan 7y ago
  edit: I am a dolt. Thank you :) I got this address as well, do you have anything running on .4? It's just weird because I have .1 router, .2 AP, .3 pi-hole then .10 is when I start my static IPs and .100 is where my dhcp starts nmap says that host is down as well
  - coob 7y ago
    That just the example in the description, not the scan results.
  - jsty 7y ago
    I think that's just the hardcoded example in the text, considering it's still there when I viewed with no scripts enabled (and I'm on a network that doesn't have anything assigned in 192.168.0.0/16).
  - hanslet 7y ago
    The page is using JavaScript with the JS WebRTC interface RTCPeerConnection[0]. Maybe that can help. [0] https://developer.mozilla.org/en-US/docs/Web/API/RTCPeerConnection https://developer.mozilla.org/en-US/docs/Web/API/RTCPeerConn...
- nostalgk 7y ago
  Yup, excited for the meeting. Haven't seen those guys in a while. Was expecting to learn some security techniques, instead got essentially port scanned :)
  - jschwartzi 7y ago
    Whereas I'm learning that my network is fairly secure against this type of port scanning.
gnomewascool 7y ago
If you use uMatrix, you can easily block the localhost and local network "sniffing" with the following rule[0]: * 127 * block ### block access to IPv4 localhost 127.x.x.x * localhost * block * [::1] * block ### block access to IPv6 localhost * 192.168 * block ### block access to LAN 192.168.x.x In principle, you can use this without any other blocking, i.e. with the rule: * * * allow and hence without disabling javascript on any sites. [0] https://github.com/ghacksuserjs/ghacks-user.js/wiki/4.2.3-uMatrix https://github.com/ghacksuserjs/ghacks-user.js/wiki/4.2.3-uM... Edit: as pointed out by DarkWiiPlayer below, if you want to be able to access the localhost websites from the same browser, you need: localhost localhost * allow and similarly for the LAN. In full: 127 127 * allow localhost localhost * allow [::1] [::1] * allow 192.168 192.168 * allow
- black_puppydog 7y ago
  that's awesome, using it! but to be fair, the point seemed to be more that if you run something that's "only" exposed locally... don't. securing each and every machine with uMatrix doesn't seem the answer to this.
- DarkWiiPlayer 7y ago
  you'd need at least localhost localhost * allow to be able to open sites on localhost directly.
- OJFord 7y ago
  Presumably also: * 10 * block ### block access to LAN 10.x.x.x
- captn3m0 7y ago
  uMatrix blocked all of it for me by default.
  - gnomewascool 7y ago
    Yes, but by default uMatrix might be overly strict for many people. For instance, by default it blocks all third-party javascript.
jand 7y ago
Funny enough, the site is reporting port 3000 to be running a web server. It is not - according do nmap and my knowledge. Any ideas on this?
- shakna 7y ago
  If you're on Linux, BSD and macOS, you can run: sudo lsof -i | grep 3000 To try and see if a process has claimed the port. On Windows: netstat -ab I've forgotten so much Windows I don't know how to filter the result, but it'll give you a list of ports and processes.
  - unpixer 7y ago
    Some BSD systems won't have lsof out of the box, in which case fstat/netstat will give you the results you want.
- IanCal 7y ago
  If like me you saw the bright red text "If you see any results like localhost:3000 is available!" as meaning :3000 was actually available, it's just an example. The yellow box above seems to be where the results would actually be.
  - jand 7y ago
    I must admit, it was exactly this. I read the text without using my brain properly. Please accept my sincere apologies.
    - IanCal 7y ago
      I did exactly the same thing and spent too long running various things to find out what on Earth was using the port! Only reason I had a good guess at what it may have been.
brasetvik 7y ago
The page doesn't do a great job at explaining the mechanism (which from a quick glance seems to involve WebRTC). This is a better resource on this topic, which involves DNS rebinding: https://medium.com/@brannondorsey/attacking-private-networks-from-the-internet-with-dns-rebinding-ea7098a2d325 https://medium.com/@brannondorsey/attacking-private-networks... DNS-rebinding also gets around the cross origin request issue, which some comments here mention.
mehrdadn 7y ago
Here's a question I've had for a while: WHY in the world do web browsers not block access to localhost? What exactly is the extremely compelling use case that has prevented them from blocking this?
- rahuldottech 7y ago
  Some browsers apparently do, which is why this demo isn't working for some HN users.
- kmlx 7y ago
  quick development? some of us use localhost to quickly test/develop.
- jarofgreen 7y ago
  Or it could be like what happens if you access a site with a broken SSL cert - you get a big red warning page and your only allowed to continue after clicking some tiny technical option.
- mjlee 7y ago
  There are a fair number of applications that expose a UI with a local web server. I use the Ubiquiti Controller, but it's also quite common in the world of Plex, etc. It's also a path used for local OIDC, such as with the gcloud CLI.
  - mehrdadn 7y ago
    > expose a UI with a local web server I'm not talking about UIs hosted on local web servers being able to send requests to themselves, I'm talking about UIs hosted on REMOTE web servers being able to send requests to local ones. It seems far worse than a random cross-origin request to me and for the life of me I can't imagine uses cases.
    - penagwin 7y ago
      While I think it would be a shame to completely disable the ability for remote sites to access localhost (I'm sure it can be useful somehow), it would make far more sense to be opt-in for those cases. Maybe browsers should assume a CORS deny all unless otherwise specified?
megous 7y ago
Other approach is to create a useful extension like: https://addons.mozilla.org/en-US/firefox/addon/yt-adblock/reviews/ disguise that you're inserting an iframe linking to your web server into every single page user opens, by naming variables and your tracking domain incorrectly and by waiting for an hour after installation (this may also help avoid automatic tests mozilla is doing) and then just sit back and wait and log all the referers and ip addresses. It's a bit stealthier too, but needs users to visit their local web servers. But you'll also get the full URL. Nobody will report you or care about the report and users are banned from fixing the extension code locally even if they're able to review it themselves. Bad reviews with some actual text fade away quickly, so if someone warns your other users, it will be pushed out to page 2 after a while by other useful one word or just empty reviews and it will work out.
- MrGilbert 7y ago
  From my experience as a dev (who has already submitted extensions to moz), this will be sorted out. However, it might take up to 4 - 6 weeks, until an actual human being reviews the changes. But it gets reviewed.
  - megous 7y ago
    Last updated "5 months ago (Dec 16, 2018)". One would hope that reporting an extension would help reviewing it sooner especially if it's 26th top rated one and all that's needed is to verify the claims in the report.
- kapep 7y ago
  Is there any way to get the source code of extensions from the Mozilla web site? I think some years ago you could look at the code in your browser from a link in the version history but I don't see any links at all now.
  - farukuzun 7y ago
    I'm using this extension for it: https://addons.mozilla.org/en-US/firefox/addon/crxviewer/ https://addons.mozilla.org/en-US/firefox/addon/crxviewer/
ryacko 7y ago
Firejail allows for the creation of sandboxed interfaces, which include the ability to block local network access.
systemtest 7y ago
I used to scan the company network for Selenium servers and remotely open "inappropriate" pages. Always nice to see a coworker wonder why a browser window with images of Pooh opened up.
- fredley 7y ago
  I hope you're not in China!
crishoj 7y ago
Makes you wonder what other apps are accepting local HTTP connections (e.g. vendor bloatware [1]). [1] https://support.lenovo.com/th/th/product_security/len_4326 https://support.lenovo.com/th/th/product_security/len_4326
gbuk2013 7y ago
Judging by "ReferenceError: webkitRTCPeerConnection is not defined" message in my browser it probably uses WebRTC to get your local IP subnet. I installed an add-on to block WebRTC after I watched a presentation on this tool [1][2] and I recommend you also do this, unless you actively use WebRTC (and don't want the hassle of toggling a switch). Unfortunately the protocol is vulnerable by design. :( [1] https://portswigger.net/daily-swig/new-tool-enables-dns-rebinding-tunnel-attacks-without-reconnaissance https://portswigger.net/daily-swig/new-tool-enables-dns-rebi... [2] https://www.blackhat.com/asia-19/arsenal/schedule/#redtunnel-explore-internal-networks-via-dns-rebinding-tunnel-14332 https://www.blackhat.com/asia-19/arsenal/schedule/#redtunnel...
- phiresky 7y ago
  The only thing blocking WebRTC gets you is that it hides which subnet you are on, right? As in, an attacker can still just enumerate all of the common ones (10.0.0.0/24, 192.168.0.1/24, and like 5 others) and get the same results as with WebRTC enabled. So blocking it really just slightly increases the obscurity, but not really the security.
  - gbuk2013 7y ago
    Sure, but it helps and it is cheap. I also don't use a common subnet and enjoy uMatrix. Obscurity is a viable strategy as part of a layered defence. ;)
    - phiresky 7y ago
      True. My main problem is that blocking WebRTC blocks some very interesting methods to "re-decentralize" the web, which are only viable if most people don't have it disabled.
      - chatmasta 7y ago
        This is a classic conflict that I’ve observed a lot. Similarly, widespread SSL pinning and app sandboxing makes it difficult to reverse engineer opaque outgoing traffic. It might be more secure, but you also cannot easily inspect what data a sandboxed, cert-pinning service is sending to the outside world. I think it’s probably something like “security, privacy, anonymity... pick two.”
tryhackme 7y ago
I covered how he is doing this here: https://tryhackme.com/room/xss#6 https://tryhackme.com/room/xss#6 (Look at all the tasks first)
joseluisq 7y ago
I had supposed to see my servers exposed but... https://imgur.com/a/hjBaYbG https://imgur.com/a/hjBaYbG
XCSme 7y ago
O only get: "Scanning localhost ... unreachable.", and there are at least 3 web servers active on the network.
- dillutedfixer 7y ago
  Do you have WebRTC disabled? I disable it in Firefox and it breaks this test.
  - XCSme 7y ago
    No, default Chrome settings.
jeltz 7y ago
His demo did not work so his message does not really get across. Maybe there ware ways to exploit it but if so he failed. I got a CORS rejection.
- freehunter 7y ago
  The demo may not have worked for you, but it does work and works for many other people. Just because your particular browser is secured does not mean the author failed.
kj4ips 7y ago
Some time ago, I made something using a similar technique to redirect to router configuration pages. Used WebRTC to get local IPv4, then spawned a worker and timed it, if it came back fast, I assumed it was there, and redirected the user, otherwise I tried a different common "router" address. I was unaware of dns rebinding at the time.
jasonkester 7y ago
I only ever run my local dev server on port 80, and use a hosts file to assign custom (fake) domain names to each of the sites I want to run. I mentioned as much here a few years ago when I first came across this idea of assigning (and remembering) random unique port numbers to every one of your apps in development, and was surprised to hear that it's such a common practice. It seems sub-optimal for a lot of reasons, beyond the obvious one noted in the article. The big one for me is that none of my apps need to know anything about how to handle port numbers URLs. They know their own domain name via a config setting that can be flipped on the live server. It's the same pattern (with no colons or numbers to worry about) so there are no edge cases to test.
- ryanjshaw 7y ago
  Unless I'm missing something, this only works if you are running one site at a time, or you have a single web server bound to port 80 that supports virtual hosts. You also need application and/or configuration support to get this working properly. And even then, if you run any software with an embedded web server you are usually out of luck unless you want to fiddle with a reverse proxy configuration. For these reasons I, at least, simply run applications on different ports. The problem isn't the port, it's the web browser allowing cross domain requests to local networks by default (another reply here suggested it is WebRTC specifically that is flawed).
  - markstos 7y ago
    For a professional web developer, setting up an Nginx reverse proxy for a few apps should be reasonably efficient. Chances are that most are all of them are written in the same language and configuration can be copy/pasted between them. Or a subdomain pattern can be mapped into a directory pattern, so there is really only one configuration-- Just add a new directory and a matching subdomain starts working, assuming the right wildcard DNS entry is pointed to your localhost.
  - jasonkester 7y ago
    IIS handles all this out of the box for me. I just bind the host name to the site in question. It sounds like maybe this isn’t something that other web servers do, which is surprising. The whole point of the operation is to seamlessly run 30 odd websites on one dev machine without needing to fiddle with port numbers or anything else.
shurcooL 7y ago
> It is not sufficient security to only bind to 127.0.0.1 (the “loopback interface”) What would be a better, more secure thing to do when you have multiple web servers on one machine behind a SSL-terminating reverse proxy?
- cosarara 7y ago
  The thing to do is not run a web browser on that machine. Run the servers in a VM.
  - notatoad 7y ago
    But this seems to be able to see servers accessible to the local machine, so if my Dev server in a VM is accessible from my browser, it's accessible to any webpage in my browser?
    - cosarara 7y ago
      The reverse proxy is accessible from your browser and is properly configured to not accept random requests from any webpage (See: CORS). The others are not directly accessible, but only through the reverse proxy server. Does that make sense?
      - notatoad 7y ago
        not really, no. i still don't see what the reverse proxy or the VM are bringing to the table here. If i'm understanding the necessary CORS config here, it's to simply not send any access-control-allow-origin header, which does not require a VM or reverse proxy, most HTTP services do that by default. simply being accessed through a reverse proxy instead of directly doesn't add any additional security
        cosarara 7y ago
        Actually, you are right.
bg0 7y ago
So does this mean that if I'm running a local dev machine with un-bundled source code on my company computer: Any person that joins the wifi network and goes to a website that sniff's this out will have access to my computers local server?
- Cakez0r 7y ago
  Depends what server software you're running and how it's configured. The specific configuration element you want to look for is usually called the "bind address". If it's set to something other than "127.0.0.1" then it will probably accept external connections. If you know the port number your server is running on, you can also open up command prompt / terminal and check with "netstat -an". Look at the local address column and make sure your web server is listening on 127.0.0.1.
  - bg0 7y ago
    Appreciate the insight. Looks like I see: tcp4 // 0 // 0 // * . 8080 // * . * // LISTEN Local address being (*.8080)
markstos 7y ago
In the source code, he is attempting to serve images from http://localhost:4000/ http://localhost:4000/ It looks like a mistake because the image URLs are unlikely to exist on YOUR localhost at port 4000 when you load the page.
bill_joy_fanboy 7y ago
I'm interested in this because I don't fully understand the consequences here. I'd like to gain a deeper understanding through some concrete examples. With the PHP CLI, I can run: php -S localhost:8000 With Python3, I can run: python -m http.server 8000 --bind localhost The demo fails for me in both cases, even though a request to localhost:8000 is sent. (EDIT: The server log in the terminal window does show that the request arrived at the local server). My question is: What is the risk of running one of these servers and then visiting some random web page?
- maratd 7y ago
  > My question is: What is the risk of running one of these servers and then visiting some random web page? It depends on what you're exposing on those ports. If it's something sensitive, stop. Any web page can run javascript and as such, any web page has access to every port and service that your machine has access to ... because at that point, the web page is a program running on your machine with full network access. However, this entire "vulnerability" makes no sense to me. Even if I'm running something on my machine or local network, I am not going to rely on the firewall as a security mechanism. That is profoundly stupid and is well known to be profoundly stupid. So all those servers, including the ones I am creating and running, will have their own security mechanisms. So you can ping my server? So what?
  - echeese 7y ago
    If it's got CORS enabled you can do a hell of a lot more than ping your server.
    - maratd 7y ago
      Wait, what? I think you means the opposite. If it's got CORS enabled, then you can't do anything unless the request is originating from the relevant domain. Anyway, do not rely on firewalls (and CORS is a firewall) as the sole security measure. Do not create unauthenticated endpoints unless you want everybody to use them.
rlue 7y ago
Can anyone explain what kinds of attacks are possible here? A malicious script on this website can identify that a service is running on a particular endpoint (IP + port), and depending on the server's CORS policy, the script may be able to submit HTTP requests to that service... am I getting it right? I can see how that might be dangerous if the service responds to simple GET requests with sensitive information, or has a well-documented REST API and no authentication. Is this the scope of the vulnerability, or is there more to it? I tried this with a few different services running on my machine (a one-liner WEBrick server in Ruby, Syncthing, a plain-text accounting program calling beancount, etc. etc.) and the script didn't detect any. I take it that means that these services all don't allow CORS?
- ericcholis 7y ago
  This comes to mind recently https://securityaffairs.co/wordpress/84803/hacking/dell-supportassist-flaw.html https://securityaffairs.co/wordpress/84803/hacking/dell-supp...
bronco21016 7y ago
Does this not work on mobile? I’m not seeing any of my web services show up on my server when opening this page in iOS Safari. EDIT: In fact the status of local network scan doesn’t come up at all.
j0ev_5 7y ago
I wrote some code a while back to find and detect other devices on your network, although it no longer seems to work on safari: http://joevennix.com/lan-js/examples/dashboard.html http://joevennix.com/lan-js/examples/dashboard.html The fingerprinting db it used can be found in the repo: https://github.com/joevennix/lan-js/blob/master/src/db.js https://github.com/joevennix/lan-js/blob/master/src/db.js
deleted 7y ago
[deleted]
rootusrootus 7y ago
This just reminds me why I use Vagrant and only run a local webserver while I'm actually doing development work on it.
deleted 7y ago
[deleted]
gambler 7y ago
When will software engineers finally understand that issues like these aren't problems with some random service you run on your computer, but with the (lack of) security model behind modern web browsing?
- kyle-rb 7y ago
  Modern web browsing provides for this with same-origin policy. Same-origin policy can be negated by the server if it sets an overly lax CORS directive. So this is something that's secure by default, but can be broken if the "random service you run on your computer" decides to break it. I don't think that's an issue with the browser's security model.
  - gambler 7y ago
    Same-origin policy is not a security model. It's a ridiculous quarter century old hack. If you pause to think about it, domain names are a horrible way to delineate security boundaries on the web.
    - kyle-rb 7y ago
      I disagree about domain names, but I don't think that's even relevant to this discussion. Do you have some kind of security model in mind that would work better than same-origin policy in this case? I.e. cross-origin requests are still allowed to happen somehow, but users are still protected against random services intentionally disabling your security measures?
      - gambler 7y ago
        It is bloody obvious that when people spin something up on their local machines the do not intend to make those pages available to every website they visit. This by itself suggests that there should be a dedicated security context for such applications and that the restriction on information exchange should be based on that context. Not on some random thing the application does (like authentication, CSRF or sending CORS headers). Scenarios like that should be the foundation of a sensible security model, not an afterthought achieved by applying layers and layers of security ducktape in every single instance.
jasonhansel 7y ago
I wonder if you could use the websocket API to scan for other (non-http) open ports.
nothrabannosir 7y ago
Anyone using uBlock origin can add these custom rules to protect localhost: * localhost * block localhost localhost * allow This should block any non-localhost from accessing localhost. (note: only protects you superficially, based on DNS. what we'd want is protection based on IP. otherwise you're still exposed to anyone setting their own DNS to 127.0.0.1. but it's something...)
ludwigvan 7y ago
Also if you are a front end developer and are on an insecure WiFi (coworking space or public WiFi) make sure you only bind to localhost. Otherwise other people on the network can see your frontend code which you are probably compiling with sourcemaps, which will give the attacker almost the complete source code of your SPA.)
- miguelmota 7y ago
  But frontend applications expose mangled javascript which can be reverse engineered anyway
  - ludwigvan 7y ago
    It can be done, but it is usually uglified. No need to give the plain source to outsiders.
brlewis 7y ago
Here's the tl;dr app.use(cors()); defaults to Access-Control-Allow-Origin: * If you know how CORS works, you already know that even if the resource is on localhost, it's open to any web page, including not on localhost. You won't find anything enlightening here. If you don't know how CORS works but you're using the Express middleware for it anyway, read the documentation: https://expressjs.com/en/resources/middleware/cors.html#configuration-options https://expressjs.com/en/resources/middleware/cors.html#conf...
terrik 7y ago
Would this have implications for people who use Cryptomator, which uses loopback connections to a local WebDAV drive in order to encrypt/decrypt files?
Glyptodon 7y ago
On my machine the requests seem to go out but the browser blocks the responses... Which seems weird, I've have expected the opposite (the browser blocking outgoing).
amenod 7y ago
I was surprised to notice that this page correctly found my local network IP address, and was thus able to query correct network range. I have disabled WebRTC [0] now in Firefox (media.peerconnection.enabled is now false), but the page still tries the same range. Is there any other way they can get my local network IP? [0] https://stackoverflow.com/a/26850789 https://stackoverflow.com/a/26850789
yeuking 7y ago
I have use that extension quite long time but i remove it immediately after see this news!
deleted 7y ago
[deleted]
nitwhiz 7y ago
And why?

652 points by jamesfisher 7y ago

jsgyx 7y ago

I use NoScript, you can't see shit.

julienreszka 7y ago
You can't see shit neither
- vbsteven 7y ago
  yes, he can, he will see the modern equivalent of "This site is best viewed in Internet Explorer". Which in 2019 becomes "Please enable Javascript to view this page"
  - larkeith 7y ago
    Honestly, such notices are shockingly unusual - most of the time (at least for the sites I encounter) they don't bother with <noscript>, you just get a broken and/or blank page. I mostly use the web for reading blogs and articles, so the loss of dynamic sites isn't troublesome, but it's certainly not for most users. (Edit: Some numerical context I have enabled Javascript for 194 sites over the last five years, whereas I encounter several new sites daily.)
    - vbsteven 7y ago
      I also browse with noscript all the time and I get them quite often. Mostly on product landing pages and Show HN demos.
      - larkeith 7y ago
        Hmm, I wonder if it's confirmation bias on my end, or just a difference in what pages we each view.
        npsimons 7y ago
        > Hmm, I wonder if it's confirmation bias on my end, or just a difference in what pages we each view. Yes. Joking aside, I will add that I've been a NoScript/FlashBlock user for quite some time (more than a decade? I honestly can't remember), and while I run into some things that are frustrating (just had to disable NoScript for a tab to order plane tickets), it is refreshingly uncommon. Yes, you can browse with default deny to JS and Flash.
- alfiedotwtf 7y ago
  That was actually funny
- icebraining 7y ago
  Actually, they can: even if you enable JS, NoScript's ABE will prevent this attack: https://en.wikipedia.org/wiki/NoScript#Application_Boundaries_Enforcer_.28ABE.29 https://en.wikipedia.org/wiki/NoScript#Application_Boundarie...
  - mrob 7y ago
    Not anymore. It's not included in modern versions (after the changes in Add-Ons for Firefox's Quantum update).
dwb 7y ago
This is not helpful, because only an extremely small proportion of Web users run NoScript, and nor should they have to.
- gnomewascool 7y ago
  > This is not helpful, because only an extremely small proportion of Web users run NoScript, and nor should they have to. Most (non-technical) Web users also don't run their own web servers, so they aren't affected. Among technical users, the proportion with NoScript is probably not as small.
  - tinus_hn 7y ago
    Most users have a modem or router that comes with a web interface, like just about everything in the internet of things.
  - deadbunny 7y ago
    Their routers do, along with an ever growing number of IoT devices people happily hook up to their WiFi without a second thought. Given the long and gory history of companies releasing insecure by default devices methods like this are a legitimate entry point into a network.
- jsgyx 7y ago
  That's like saying that people shouldn't have to run ad blockers, that instead ad networks should behave. Sit and wait.
Thorrez 7y ago
Here's a port scanning technique that doesn't use javascript: https://blog.jeremiahgrossman.com/2006/11/browser-port-scanning-without.html https://blog.jeremiahgrossman.com/2006/11/browser-port-scann...

shakna 7y ago

I can see the list of XHR requests made, and I have half a dozen local web servers running, and there are a bunch of other web servers running on my network. I have a bad habit of spinning up a server on an ESP32 whenever I want to remote control something physical. ... Strangely, despite the XHR's hitting ports and IPs I know are running unsecured web servers, the site sees nothing. Lots of "unreachable". Firefox 67.0, Arch Linux (5.0.10).

sepbot 7y ago
The requests should fail unless the servers you are running allow CORS as per the headers.
- shakna 7y ago
  There's half a dozen that are.
  - ypkuby 7y ago
    Do you have any locked down policy on them though? I assume this would only work if you gave blanket access. I noticed in my tests it found one on port 3000 with blanket access, but didn't see one on port 9999 with restricted access( policy => allow from *.mydomains )
    - shakna 7y ago
      Yes. I'm terrible and have them set to allow all domains, and all methods.
      - dillonmckay 7y ago
        Maybe your browsers are up-to-date?

ivolimmen 7y ago

I only run on local on ports: 8080, 9090, 9191, 8081, 8082 and 8083. So scanning only on 3000 is a bit narrow...

TimWolla 7y ago
It does not only scan 3000. From the source code: const portsToTry = [ 80, 81, 88, 3000, 3001, 3030, 3031, 3333, 4000, 4001, 4040, 4041, 4444, 5000, 5001, 5050, 5051, 5555, 6000, 6001, 6060, 6061, 6666, 7000, 7001, 7070, 7071, 7777, 8000, 8001, 8080, 8081, 8888, 9000, 9001, 9090, 9091, 9999, ];
boffinism 7y ago
On my machine it seems to be scanning for lots of ports between :80 and :9999. I think it's using 3000 as an example in the text only.
y0ghur7_xxx 7y ago
It's not scanning only port 3000: const portsToTry = [ 80, 81, 88, 3000, 3001, 3030, 3031, 3333, 4000, 4001, 4040, 4041, 4444, 5000, 5001, 5050, 5051, 5555, 6000, 6001, 6060, 6061, 6666, 7000, 7001, 7070, 7071, 7777, 8000, 8001, 8080, 8081, 8888, 9000, 9001, 9090, 9091, 9999, ]; view-source:http://http.jameshfisher.com/2019/05/26/i-can-see-your-local-web-servers/ http://http.jameshfisher.com/2019/05/26/i-can-see-your-local... :125

majke 7y ago

My favorite is retrieving http://wpad/wpad.dat http://wpad/wpad.dat with ajax. https://bugs.chromium.org/p/chromium/issues/detail?id=123166 https://bugs.chromium.org/p/chromium/issues/detail?id=123166

deleted 7y ago

[deleted]

founderling 7y ago

I started a local webserver listening on localhost:80 just to see what happens, but this thing seems to not detect it. It shows me "Scanning localhost ... localhost complete." Edit: My guess is that this thing can only detect servers that send a CORS header that permits cross domain access. It could probably do way better detection if it did not do xhr requests but added script/css/whatever elements to its own page pointing to localhost and detects if those error out.

ratsimihah 7y ago
It's not that it doesn't detect it, but it's not open to external networks, which I guess is a good thing.
- founderling 7y ago
  What do you mean?
  - timvisee 7y ago
    Probably that your browser is blocking access to the local domain, from the context of an external domain. I'm just guessing here, of course.
jensneuse 7y ago
CORS is a security mechanism for browsers to prevent leaking user information (e.g. cookies) when doing cross domain requests from a browser. CORS does not prevent accessing the server at all. You can always curl a CORS protected server but you won't be able to make a requests including the user's cookies from a disallowed domain.
- jeltz 7y ago
  Well yeah, but CROS prevents his demo from working. And you cannot curl something remotely when it only binds to 127.0.0.1.
- 7y ago

suyash 7y ago

Can anyone share what measures we can take as web developers to secure local development environment?

falsedan 7y ago
don't set up CORS in dev
deno 7y ago
Custom DNS server with DNS rebind protection. E.g. if you’re running OpenWRT you’re fine[1]. Also just don’t test on localhost. You can use a proper domain (or claim one in .test TLD[1] if you’re fine with selfsigned certs) and point it to localhost. If you’re going to use any redirect flow like OAuth/OpenID you’re going to need this for testing eventually anyway. [1] https://openwrt.org/docs/guide-user/base-system/dhcp https://openwrt.org/docs/guide-user/base-system/dhcp [2] https://en.wikipedia.org/wiki/.test https://en.wikipedia.org/wiki/.test
- asdkhadsj 7y ago
  What do you recommend if you're running a local server? Eg, I've developed programs before with the assumption that the user will be running it either for their local machine, or perhaps for their local network. Think self hosted Wiki/etc. I was never sure (and thusly have yet to properly implement it) what would be secure, but also a good UX. A normal auth + self signed https would be simplest I imagine, but I'm not clear if browsers widely accept that. I recall Sandstorm having issues with this area, and required a domain to fully run properly. Which seems.. complex for a minimal install requirement. Thoughts?
  - deno 7y ago
    I actually wanted to do something similar one time and I figured there’s one way to do it: 1) Get a domain name for the project, e.g. mycoolwiki.tld 2) In the installer/setup provision for the user a random subdomain, e.g. d2c8116f19d0.mycoolwiki.tld 3) Use Let’s Encrypt DNS method to provision cert 4) Redirect d2c8116f19d0.mycoolwiki.tld to LAN IP It’s not ideal because you need some external infrastructure and it assumes no DNS rebind protection. However, if your webapp has a client and server, that is communicates via API only, you can actually do a lot better: 4) Setup local server to accept CORS requests from d2c8116f19d0.mycoolwiki.net only 5) Host client at d2c8116f19d0.mycoolwiki.tld Additionally, 6) Make the client a PWA with offline support and/or 6) Offer browser extension to use local copy of the client when user visits ∗.mycoolwiki.tld Though for my use case I actually wanted to have ∗.mycoolwiki.tld/ipfs/<hash> be backed by IPFS and offer generic extension that both verifies that the IPFS gateway is playing nice and (if configured) redirect to local gateway. Also offering Electron client instead of browser would work as well and saves you getting the cert.

deleted 7y ago

[deleted]

lostjohnny 7y ago

Nope, you can't Cross-Origin Request Blocked: The Same Origin Policy disallows reading the remote resource at http://localhost/. (Reason: CORS header ‘Access-Control-Allow-Origin’ missing) Anyway TypeError: /(192\.168\.[0-9]+\.)[0-9]+/.exec(...) is null i-can-see-your-local-web-servers:169:41

chronial 7y ago
The Cross-Origin check be circumvented via DNS Rebinding: When you request mypage.com, my DNS returns the ip of my webserver. On all subsequent requests, it will return 127.0.0.1. Now localhost is on the same origin as my page.
- lostjohnny 7y ago
  It doesn't matter, you should be in control of a DNS the user relies on and you should have your server send Access-Control-Allow-Origin: mypage.com or Access-Control-Allow-Origin: * which is not a default anywhere AFAIK and is domain based, not IP based And your server should be enabled to respond to mypage.com host header
  - chronial 7y ago
    I don't quite understand your comment. Do you mean "shouldn't" whenever you wrote "should"?
    - m12k 7y ago
      I think they write 'should' when they mean 'need to if you want the aforementioned to be a practical attack vector'
    - lostjohnny 7y ago
      yeah, I meant need, sorry
  - chronial 7y ago
    Based on m12k's suggested interpretation of your comment: > you should be in control of a DNS the user relies on You always are when a users visits your domain – you control the DNS of your domain. > Access-Control-Allow-Origin: * You don't need access-control headers, because you stay on the same domain. > Your server should be enabled to respond to mypage.com host header Most servers listening on localhost ignore the host header.

jsty 7y ago

"If you see any results like 192.168.0.4:3000 is available!, you should tell your colleague to secure whatever she has running on that port" Someone's going to access this page at $BIGCORP with an overly trigger-happy IDS and get a fun morning meeting with IT to un-quarantine their machine.

chrisan 7y ago
edit: I am a dolt. Thank you :) I got this address as well, do you have anything running on .4? It's just weird because I have .1 router, .2 AP, .3 pi-hole then .10 is when I start my static IPs and .100 is where my dhcp starts nmap says that host is down as well
- coob 7y ago
  That just the example in the description, not the scan results.
- jsty 7y ago
  I think that's just the hardcoded example in the text, considering it's still there when I viewed with no scripts enabled (and I'm on a network that doesn't have anything assigned in 192.168.0.0/16).
- hanslet 7y ago
  The page is using JavaScript with the JS WebRTC interface RTCPeerConnection[0]. Maybe that can help. [0] https://developer.mozilla.org/en-US/docs/Web/API/RTCPeerConnection https://developer.mozilla.org/en-US/docs/Web/API/RTCPeerConn...
nostalgk 7y ago
Yup, excited for the meeting. Haven't seen those guys in a while. Was expecting to learn some security techniques, instead got essentially port scanned :)
- jschwartzi 7y ago
  Whereas I'm learning that my network is fairly secure against this type of port scanning.

gnomewascool 7y ago

If you use uMatrix, you can easily block the localhost and local network "sniffing" with the following rule[0]: * 127 * block ### block access to IPv4 localhost 127.x.x.x * localhost * block * [::1] * block ### block access to IPv6 localhost * 192.168 * block ### block access to LAN 192.168.x.x In principle, you can use this without any other blocking, i.e. with the rule: * * * allow and hence without disabling javascript on any sites. [0] https://github.com/ghacksuserjs/ghacks-user.js/wiki/4.2.3-uMatrix https://github.com/ghacksuserjs/ghacks-user.js/wiki/4.2.3-uM... Edit: as pointed out by DarkWiiPlayer below, if you want to be able to access the localhost websites from the same browser, you need: localhost localhost * allow and similarly for the LAN. In full: 127 127 * allow localhost localhost * allow [::1] [::1] * allow 192.168 192.168 * allow

black_puppydog 7y ago
that's awesome, using it! but to be fair, the point seemed to be more that if you run something that's "only" exposed locally... don't. securing each and every machine with uMatrix doesn't seem the answer to this.
DarkWiiPlayer 7y ago
you'd need at least localhost localhost * allow to be able to open sites on localhost directly.
OJFord 7y ago
Presumably also: * 10 * block ### block access to LAN 10.x.x.x
captn3m0 7y ago
uMatrix blocked all of it for me by default.
- gnomewascool 7y ago
  Yes, but by default uMatrix might be overly strict for many people. For instance, by default it blocks all third-party javascript.

jand 7y ago

Funny enough, the site is reporting port 3000 to be running a web server. It is not - according do nmap and my knowledge. Any ideas on this?

shakna 7y ago
If you're on Linux, BSD and macOS, you can run: sudo lsof -i | grep 3000 To try and see if a process has claimed the port. On Windows: netstat -ab I've forgotten so much Windows I don't know how to filter the result, but it'll give you a list of ports and processes.
- unpixer 7y ago
  Some BSD systems won't have lsof out of the box, in which case fstat/netstat will give you the results you want.
IanCal 7y ago
If like me you saw the bright red text "If you see any results like localhost:3000 is available!" as meaning :3000 was actually available, it's just an example. The yellow box above seems to be where the results would actually be.
- jand 7y ago
  I must admit, it was exactly this. I read the text without using my brain properly. Please accept my sincere apologies.
  - IanCal 7y ago
    I did exactly the same thing and spent too long running various things to find out what on Earth was using the port! Only reason I had a good guess at what it may have been.

brasetvik 7y ago

The page doesn't do a great job at explaining the mechanism (which from a quick glance seems to involve WebRTC). This is a better resource on this topic, which involves DNS rebinding: https://medium.com/@brannondorsey/attacking-private-networks-from-the-internet-with-dns-rebinding-ea7098a2d325 https://medium.com/@brannondorsey/attacking-private-networks... DNS-rebinding also gets around the cross origin request issue, which some comments here mention.

mehrdadn 7y ago

Here's a question I've had for a while: WHY in the world do web browsers not block access to localhost? What exactly is the extremely compelling use case that has prevented them from blocking this?

rahuldottech 7y ago
Some browsers apparently do, which is why this demo isn't working for some HN users.
kmlx 7y ago
quick development? some of us use localhost to quickly test/develop.
jarofgreen 7y ago
Or it could be like what happens if you access a site with a broken SSL cert - you get a big red warning page and your only allowed to continue after clicking some tiny technical option.
mjlee 7y ago
There are a fair number of applications that expose a UI with a local web server. I use the Ubiquiti Controller, but it's also quite common in the world of Plex, etc. It's also a path used for local OIDC, such as with the gcloud CLI.
- mehrdadn 7y ago
  > expose a UI with a local web server I'm not talking about UIs hosted on local web servers being able to send requests to themselves, I'm talking about UIs hosted on REMOTE web servers being able to send requests to local ones. It seems far worse than a random cross-origin request to me and for the life of me I can't imagine uses cases.
  - penagwin 7y ago
    While I think it would be a shame to completely disable the ability for remote sites to access localhost (I'm sure it can be useful somehow), it would make far more sense to be opt-in for those cases. Maybe browsers should assume a CORS deny all unless otherwise specified?

megous 7y ago

Other approach is to create a useful extension like: https://addons.mozilla.org/en-US/firefox/addon/yt-adblock/reviews/ disguise that you're inserting an iframe linking to your web server into every single page user opens, by naming variables and your tracking domain incorrectly and by waiting for an hour after installation (this may also help avoid automatic tests mozilla is doing) and then just sit back and wait and log all the referers and ip addresses. It's a bit stealthier too, but needs users to visit their local web servers. But you'll also get the full URL. Nobody will report you or care about the report and users are banned from fixing the extension code locally even if they're able to review it themselves. Bad reviews with some actual text fade away quickly, so if someone warns your other users, it will be pushed out to page 2 after a while by other useful one word or just empty reviews and it will work out.

MrGilbert 7y ago
From my experience as a dev (who has already submitted extensions to moz), this will be sorted out. However, it might take up to 4 - 6 weeks, until an actual human being reviews the changes. But it gets reviewed.
- megous 7y ago
  Last updated "5 months ago (Dec 16, 2018)". One would hope that reporting an extension would help reviewing it sooner especially if it's 26th top rated one and all that's needed is to verify the claims in the report.
kapep 7y ago
Is there any way to get the source code of extensions from the Mozilla web site? I think some years ago you could look at the code in your browser from a link in the version history but I don't see any links at all now.
- farukuzun 7y ago
  I'm using this extension for it: https://addons.mozilla.org/en-US/firefox/addon/crxviewer/ https://addons.mozilla.org/en-US/firefox/addon/crxviewer/

ryacko 7y ago

Firejail allows for the creation of sandboxed interfaces, which include the ability to block local network access.

systemtest 7y ago

I used to scan the company network for Selenium servers and remotely open "inappropriate" pages. Always nice to see a coworker wonder why a browser window with images of Pooh opened up.

fredley 7y ago
I hope you're not in China!

crishoj 7y ago

Makes you wonder what other apps are accepting local HTTP connections (e.g. vendor bloatware [1]). [1] https://support.lenovo.com/th/th/product_security/len_4326 https://support.lenovo.com/th/th/product_security/len_4326

gbuk2013 7y ago

Judging by "ReferenceError: webkitRTCPeerConnection is not defined" message in my browser it probably uses WebRTC to get your local IP subnet. I installed an add-on to block WebRTC after I watched a presentation on this tool [1][2] and I recommend you also do this, unless you actively use WebRTC (and don't want the hassle of toggling a switch). Unfortunately the protocol is vulnerable by design. :( [1] https://portswigger.net/daily-swig/new-tool-enables-dns-rebinding-tunnel-attacks-without-reconnaissance https://portswigger.net/daily-swig/new-tool-enables-dns-rebi... [2] https://www.blackhat.com/asia-19/arsenal/schedule/#redtunnel-explore-internal-networks-via-dns-rebinding-tunnel-14332 https://www.blackhat.com/asia-19/arsenal/schedule/#redtunnel...

phiresky 7y ago
The only thing blocking WebRTC gets you is that it hides which subnet you are on, right? As in, an attacker can still just enumerate all of the common ones (10.0.0.0/24, 192.168.0.1/24, and like 5 others) and get the same results as with WebRTC enabled. So blocking it really just slightly increases the obscurity, but not really the security.
- gbuk2013 7y ago
  Sure, but it helps and it is cheap. I also don't use a common subnet and enjoy uMatrix. Obscurity is a viable strategy as part of a layered defence. ;)
  - phiresky 7y ago
    True. My main problem is that blocking WebRTC blocks some very interesting methods to "re-decentralize" the web, which are only viable if most people don't have it disabled.
    - chatmasta 7y ago
      This is a classic conflict that I’ve observed a lot. Similarly, widespread SSL pinning and app sandboxing makes it difficult to reverse engineer opaque outgoing traffic. It might be more secure, but you also cannot easily inspect what data a sandboxed, cert-pinning service is sending to the outside world. I think it’s probably something like “security, privacy, anonymity... pick two.”

tryhackme 7y ago

I covered how he is doing this here: https://tryhackme.com/room/xss#6 https://tryhackme.com/room/xss#6 (Look at all the tasks first)

joseluisq 7y ago

I had supposed to see my servers exposed but... https://imgur.com/a/hjBaYbG https://imgur.com/a/hjBaYbG

XCSme 7y ago

O only get: "Scanning localhost ... unreachable.", and there are at least 3 web servers active on the network.

dillutedfixer 7y ago
Do you have WebRTC disabled? I disable it in Firefox and it breaks this test.
- XCSme 7y ago
  No, default Chrome settings.

jeltz 7y ago

His demo did not work so his message does not really get across. Maybe there ware ways to exploit it but if so he failed. I got a CORS rejection.

freehunter 7y ago
The demo may not have worked for you, but it does work and works for many other people. Just because your particular browser is secured does not mean the author failed.

kj4ips 7y ago

Some time ago, I made something using a similar technique to redirect to router configuration pages. Used WebRTC to get local IPv4, then spawned a worker and timed it, if it came back fast, I assumed it was there, and redirected the user, otherwise I tried a different common "router" address. I was unaware of dns rebinding at the time.

jasonkester 7y ago

I only ever run my local dev server on port 80, and use a hosts file to assign custom (fake) domain names to each of the sites I want to run. I mentioned as much here a few years ago when I first came across this idea of assigning (and remembering) random unique port numbers to every one of your apps in development, and was surprised to hear that it's such a common practice. It seems sub-optimal for a lot of reasons, beyond the obvious one noted in the article. The big one for me is that none of my apps need to know anything about how to handle port numbers URLs. They know their own domain name via a config setting that can be flipped on the live server. It's the same pattern (with no colons or numbers to worry about) so there are no edge cases to test.

ryanjshaw 7y ago
Unless I'm missing something, this only works if you are running one site at a time, or you have a single web server bound to port 80 that supports virtual hosts. You also need application and/or configuration support to get this working properly. And even then, if you run any software with an embedded web server you are usually out of luck unless you want to fiddle with a reverse proxy configuration. For these reasons I, at least, simply run applications on different ports. The problem isn't the port, it's the web browser allowing cross domain requests to local networks by default (another reply here suggested it is WebRTC specifically that is flawed).
- markstos 7y ago
  For a professional web developer, setting up an Nginx reverse proxy for a few apps should be reasonably efficient. Chances are that most are all of them are written in the same language and configuration can be copy/pasted between them. Or a subdomain pattern can be mapped into a directory pattern, so there is really only one configuration-- Just add a new directory and a matching subdomain starts working, assuming the right wildcard DNS entry is pointed to your localhost.
- jasonkester 7y ago
  IIS handles all this out of the box for me. I just bind the host name to the site in question. It sounds like maybe this isn’t something that other web servers do, which is surprising. The whole point of the operation is to seamlessly run 30 odd websites on one dev machine without needing to fiddle with port numbers or anything else.

shurcooL 7y ago

> It is not sufficient security to only bind to 127.0.0.1 (the “loopback interface”) What would be a better, more secure thing to do when you have multiple web servers on one machine behind a SSL-terminating reverse proxy?

cosarara 7y ago
The thing to do is not run a web browser on that machine. Run the servers in a VM.
- notatoad 7y ago
  But this seems to be able to see servers accessible to the local machine, so if my Dev server in a VM is accessible from my browser, it's accessible to any webpage in my browser?
  - cosarara 7y ago
    The reverse proxy is accessible from your browser and is properly configured to not accept random requests from any webpage (See: CORS). The others are not directly accessible, but only through the reverse proxy server. Does that make sense?
    - notatoad 7y ago
      not really, no. i still don't see what the reverse proxy or the VM are bringing to the table here. If i'm understanding the necessary CORS config here, it's to simply not send any access-control-allow-origin header, which does not require a VM or reverse proxy, most HTTP services do that by default. simply being accessed through a reverse proxy instead of directly doesn't add any additional security
      - cosarara 7y ago
        Actually, you are right.

bg0 7y ago

So does this mean that if I'm running a local dev machine with un-bundled source code on my company computer: Any person that joins the wifi network and goes to a website that sniff's this out will have access to my computers local server?

Cakez0r 7y ago
Depends what server software you're running and how it's configured. The specific configuration element you want to look for is usually called the "bind address". If it's set to something other than "127.0.0.1" then it will probably accept external connections. If you know the port number your server is running on, you can also open up command prompt / terminal and check with "netstat -an". Look at the local address column and make sure your web server is listening on 127.0.0.1.
- bg0 7y ago
  Appreciate the insight. Looks like I see: tcp4 // 0 // 0 // * . 8080 // * . * // LISTEN Local address being (*.8080)

markstos 7y ago

In the source code, he is attempting to serve images from http://localhost:4000/ http://localhost:4000/ It looks like a mistake because the image URLs are unlikely to exist on YOUR localhost at port 4000 when you load the page.

bill_joy_fanboy 7y ago

I'm interested in this because I don't fully understand the consequences here. I'd like to gain a deeper understanding through some concrete examples. With the PHP CLI, I can run: php -S localhost:8000 With Python3, I can run: python -m http.server 8000 --bind localhost The demo fails for me in both cases, even though a request to localhost:8000 is sent. (EDIT: The server log in the terminal window does show that the request arrived at the local server). My question is: What is the risk of running one of these servers and then visiting some random web page?

maratd 7y ago
> My question is: What is the risk of running one of these servers and then visiting some random web page? It depends on what you're exposing on those ports. If it's something sensitive, stop. Any web page can run javascript and as such, any web page has access to every port and service that your machine has access to ... because at that point, the web page is a program running on your machine with full network access. However, this entire "vulnerability" makes no sense to me. Even if I'm running something on my machine or local network, I am not going to rely on the firewall as a security mechanism. That is profoundly stupid and is well known to be profoundly stupid. So all those servers, including the ones I am creating and running, will have their own security mechanisms. So you can ping my server? So what?
- echeese 7y ago
  If it's got CORS enabled you can do a hell of a lot more than ping your server.
  - maratd 7y ago
    Wait, what? I think you means the opposite. If it's got CORS enabled, then you can't do anything unless the request is originating from the relevant domain. Anyway, do not rely on firewalls (and CORS is a firewall) as the sole security measure. Do not create unauthenticated endpoints unless you want everybody to use them.

rlue 7y ago

Can anyone explain what kinds of attacks are possible here? A malicious script on this website can identify that a service is running on a particular endpoint (IP + port), and depending on the server's CORS policy, the script may be able to submit HTTP requests to that service... am I getting it right? I can see how that might be dangerous if the service responds to simple GET requests with sensitive information, or has a well-documented REST API and no authentication. Is this the scope of the vulnerability, or is there more to it? I tried this with a few different services running on my machine (a one-liner WEBrick server in Ruby, Syncthing, a plain-text accounting program calling beancount, etc. etc.) and the script didn't detect any. I take it that means that these services all don't allow CORS?

ericcholis 7y ago
This comes to mind recently https://securityaffairs.co/wordpress/84803/hacking/dell-supportassist-flaw.html https://securityaffairs.co/wordpress/84803/hacking/dell-supp...

bronco21016 7y ago

Does this not work on mobile? I’m not seeing any of my web services show up on my server when opening this page in iOS Safari. EDIT: In fact the status of local network scan doesn’t come up at all.

j0ev_5 7y ago

I wrote some code a while back to find and detect other devices on your network, although it no longer seems to work on safari: http://joevennix.com/lan-js/examples/dashboard.html http://joevennix.com/lan-js/examples/dashboard.html The fingerprinting db it used can be found in the repo: https://github.com/joevennix/lan-js/blob/master/src/db.js https://github.com/joevennix/lan-js/blob/master/src/db.js

deleted 7y ago

[deleted]

rootusrootus 7y ago

This just reminds me why I use Vagrant and only run a local webserver while I'm actually doing development work on it.

deleted 7y ago

[deleted]

gambler 7y ago

When will software engineers finally understand that issues like these aren't problems with some random service you run on your computer, but with the (lack of) security model behind modern web browsing?

kyle-rb 7y ago
Modern web browsing provides for this with same-origin policy. Same-origin policy can be negated by the server if it sets an overly lax CORS directive. So this is something that's secure by default, but can be broken if the "random service you run on your computer" decides to break it. I don't think that's an issue with the browser's security model.
- gambler 7y ago
  Same-origin policy is not a security model. It's a ridiculous quarter century old hack. If you pause to think about it, domain names are a horrible way to delineate security boundaries on the web.
  - kyle-rb 7y ago
    I disagree about domain names, but I don't think that's even relevant to this discussion. Do you have some kind of security model in mind that would work better than same-origin policy in this case? I.e. cross-origin requests are still allowed to happen somehow, but users are still protected against random services intentionally disabling your security measures?
    - gambler 7y ago
      It is bloody obvious that when people spin something up on their local machines the do not intend to make those pages available to every website they visit. This by itself suggests that there should be a dedicated security context for such applications and that the restriction on information exchange should be based on that context. Not on some random thing the application does (like authentication, CSRF or sending CORS headers). Scenarios like that should be the foundation of a sensible security model, not an afterthought achieved by applying layers and layers of security ducktape in every single instance.

jasonhansel 7y ago

I wonder if you could use the websocket API to scan for other (non-http) open ports.

nothrabannosir 7y ago

Anyone using uBlock origin can add these custom rules to protect localhost: * localhost * block localhost localhost * allow This should block any non-localhost from accessing localhost. (note: only protects you superficially, based on DNS. what we'd want is protection based on IP. otherwise you're still exposed to anyone setting their own DNS to 127.0.0.1. but it's something...)

ludwigvan 7y ago

Also if you are a front end developer and are on an insecure WiFi (coworking space or public WiFi) make sure you only bind to localhost. Otherwise other people on the network can see your frontend code which you are probably compiling with sourcemaps, which will give the attacker almost the complete source code of your SPA.)

miguelmota 7y ago
But frontend applications expose mangled javascript which can be reverse engineered anyway
- ludwigvan 7y ago
  It can be done, but it is usually uglified. No need to give the plain source to outsiders.

brlewis 7y ago

Here's the tl;dr app.use(cors()); defaults to Access-Control-Allow-Origin: * If you know how CORS works, you already know that even if the resource is on localhost, it's open to any web page, including not on localhost. You won't find anything enlightening here. If you don't know how CORS works but you're using the Express middleware for it anyway, read the documentation: https://expressjs.com/en/resources/middleware/cors.html#configuration-options https://expressjs.com/en/resources/middleware/cors.html#conf...

terrik 7y ago

Would this have implications for people who use Cryptomator, which uses loopback connections to a local WebDAV drive in order to encrypt/decrypt files?

Glyptodon 7y ago

On my machine the requests seem to go out but the browser blocks the responses... Which seems weird, I've have expected the opposite (the browser blocking outgoing).

amenod 7y ago

I was surprised to notice that this page correctly found my local network IP address, and was thus able to query correct network range. I have disabled WebRTC [0] now in Firefox (media.peerconnection.enabled is now false), but the page still tries the same range. Is there any other way they can get my local network IP? [0] https://stackoverflow.com/a/26850789 https://stackoverflow.com/a/26850789

yeuking 7y ago

I have use that extension quite long time but i remove it immediately after see this news!

deleted 7y ago

[deleted]

nitwhiz 7y ago

And why?