3 ms·
Are there any tools to run an untrusted client side web application isolated from the internet?
by johtso 5y ago
Are there any tools to run an untrusted client side web application isolated from the internet?
- gruez 5y agoturn off wifi/unplug network cable?
- AndrewOMartin 5y agoand never plug back in again ;)
- nicolaslem 5y agoA private browser window should take care of this problem.
- memco 5y agoProbably should also run it in a sandboxed tab and delete all site related data after use. It is possible for sites to detect network connection and sync data when a connection is re-established. EDIT: you could also just run the local server in offline mode and shut it down before you re-connect.
- boring_twenties 5y agouseradd -m luser iptables -I OUTPUT 1 -m owner --uid-owner luser -j REJECT Now log in as luser and run your browser.
- r1ch 5y agoThis would still allow data exfiltration via DNS. It really needs to be done at the browser level.
- boring_twenties 5y agoThis rule blocks all IP traffic including DNS requests.
- r1ch 5y agoIt only blocks IPv4 traffic, so on an IPv6 enabled host it can easily be bypassed without even involving DNS. But assuming an IPv4-only host, on a system using nscd, DNS lookup is performed over a Unix socket: Chain OUTPUT (policy ACCEPT 0 packets, 0 bytes) pkts bytes target prot opt in out source destination 23 1445 DROP all -- * * 0.0.0.0/0 0.0.0.0/0 owner UID match 1007 # setuidgid outtest ping -n 1 -4 google.com PING google.com (142.250.102.100) 56(124) bytes of data.
- boring_twenties 5y agoThat's interesting. I've never used nscd, but the rule seems to work against both dnsmasq and systemd-resolved which just listen on loopback port 53. As for IPv6 you can obviously just apply a similar rule using ip6tables (or the newer nftables, which I don't know how to use.)