4 ms·
Lots of chat in the comments about how this is all websockets' fault, but don't forget you can portscan localhost with pure JS as well. https://portswigger.net
by parliament32 6y ago
Lots of chat in the comments about how this is all websockets' fault, but don't forget you can portscan localhost with pure JS as well.
https://portswigger.net/research/exposing-intranets-with-reliable-browser-based-port-scanning https://portswigger.net/research/exposing-intranets-with-rel...
- carapace 6y agoAch! That's diabolical.
- gsnedders 6y agoTiming attacks make it very hard to prevent port/host probing generally, sadly, with the sheer number of things that are observably loaded cross-origin (iframes in that example, but also images, scripts, stylesheets…). (In the private/loopback IP ranges we should really just make those requests always fail, but I addressed that in another comment as to why that's not trivial.)
- parliament32 6y agoPrivate and loopback space should really be outside the sandbox, or at least in a permission. I'm happy with mycorp.net accessing 10/8 space, but not ebay.