4 ms·
Is there a way to block this at the browser level? Ex: block access to localhost for all domains (except from localhost itself)?
by xur17 6y ago
Is there a way to block this at the browser level? Ex: block access to localhost for all domains (except from localhost itself)?
- edoceo 6y agoWhitelist sites that you allow WS features.
- bilekas 6y agoI wonder though if it was just a websocket that could do this, surely some client side JS can just itterate the same when loaded.
- chippy 6y agoCould you expand upon how to do this? And what does WS mean?
- bilekas 6y agoWS is WebSockets, its a protocol so you could disable it at that level.
- bilekas 6y agoWas thinking the same, maybe creating a service account for the browsers, I believe they do need some level of elevation but then using the firewall rules disabling everything expect http/s ports.. Websockets and others might be an issue, might need to be updated on an adhoc basis though and shouldnt be the reposonsibilty of the users. This is kinda gross practice overall.
- inetknght 6y agoUse uMatrix and set a global block.
- anarcat 6y agospecifically, websockets are blocked by the "XHR" component on the popup panel, which also blocks XmlRPC and the Fetch API. as a rule, you could block all XHR requests everywhere with: * * xhr block What I actually do is block everything but first-party requests, apart from CSS and images: * * * block * * cookie block * * css allow * * frame block * * image allow * 1st-party * allow * 1st-party css allow * 1st-party frame allow * 1st-party image allow i actually allow xhr on third-party requests once i enabled third-party requests, which makes it possible to "enable" a bunch of site with two clicks (popup panel then click on "all").
- gruez 6y agoUblock allows you to block websocket requests. eg. *$websocket will block all websocket connections. You probably want to operate on a whitelist on a site by site basis. Blocking localhost or 127.0.0.1 isn't reliable because sites can use dns rebinding attacks to bypass your filters.
- Cactus2018 6y agoThanks for this. Adding the string to uBlock Origin's "My Filters" tab worked perfect. *$websocket Tested with https://websocketstest.com/ https://websocketstest.com/
- thanksforfish 6y agoThis helps, but can't you also do this sort of scanning without websockets?
- billme 6y agoHow? This appears to bypass NATs Network Address Translation) & Firewalls.
- parliament32 6y agoThat helps one of the vectors, but you can scan with pure JS too: https://portswigger.net/research/exposing-intranets-with-reliable-browser-based-port-scanning https://portswigger.net/research/exposing-intranets-with-rel...
- jhhh 6y agoUblock origin says it supports ABP filter rules which allow for whitelisting sites which seems like it should allow something approximating: ~site.com$websocket *,~site.com$websocket However this seems like it's invalid syntax because switching your example to this opens all websocket use back up tested via https://websocketstest.com/ https://websocketstest.com/
- gorhill 6y agoThat is not valid ABP filter syntax. This is what you want: *$websocket,domain=~site1.com For more than a single site: *$websocket,domain=~site1.com|site2.com|... I would personally suggest people to just enable advanced user mode and create rules such as: * 127.0.0.1 * blocked To block all request attempts to 127.0.0.1.
- ekimekim 6y agoI do this by running my browser in its own network namespace, with NAT to the outside world. A couple more firewall rules explicitly add forwarding for specific localhost ports.