4 ms·
Related: https://www.oligo.security/blog/0-0-0-0-day-exploiting-localhost-apis-from-the-browser https://www.oligo.security/blog/0-0-0-0-day-exploiting-local...
by aa_is_op 2y ago
Related: https://www.oligo.security/blog/0-0-0-0-day-exploiting-localhost-apis-from-the-browser https://www.oligo.security/blog/0-0-0-0-day-exploiting-local...
- dytir 2y agoHN discussion: https://news.ycombinator.com/item?id=41184219 https://news.ycombinator.com/item?id=41184219 But nothing new: https://research.nccgroup.com/2023/04/27/state-of-dns-rebinding-in-2023/ https://research.nccgroup.com/2023/04/27/state-of-dns-rebind... https://github.com/nccgroup/singularity/wiki/Protection-Bypasses https://github.com/nccgroup/singularity/wiki/Protection-Bypa...
- fch42 2y agothanks for those refs!
- ikekkdcjkfke 2y agoI believe uBlockOrigin browser extension has a filter to restrict local access
- ndriscoll 2y ago> Digitally “fingerprinting” the users of a website is a known technique that has many purposes. The most common legitimate use is to identify returning users Incidentally, this is not a legitimate use-case. It's insane to me that companies act like blatant violations of the CFAA are okay. You are not authorized to start scanning a user's private network and making requests to internal services because they loaded a web page. The engineers, managers, and product people involved in doing that kind of thing should be prosecuted for it.