3 ms·
You're a bit too quick to jump to that conclusion so firmly. There are other cases. Does you company have internal tools exposed via the intranet? If you happe
by bgirard 6y ago
You're a bit too quick to jump to that conclusion so firmly.
There are other cases. Does you company have internal tools exposed via the intranet? If you happen to know the URI scheme, from say an ex-employee, you're able to exfiltrate information if you get a current employee on VPN to open your page. This becomes a tool in a layered attack. Sure it's careless to have such anonymous endpoint on your intranet. But there's a reason why anonymous images can't be plainly read back.
- kornbattery 6y agoI'd say it's bad design to have everything important in the open just because it's behind a firewall; it's got a huge blast radius when something goes wrong. Securing your services regardless of where they are in the network should be go the go to
- MrStonedOne 6y agoI'd say accessing an internal ip counts as credentials, but i wouldn't be shocked if chrome disagreed.