5 ms·

It's still possible to trick the browser of a user on the inside to HTTP POST a form invisibly to 192.168.1.1, by javascript hosted on an external web page.

• shubb 13y ago
  I tried to figure out how to do this a while ago. Doesn't anti cross site scripting built into most modern browsers stop this? The flash and java security models certainly do. I think you can do this by serving the user a hidden form that e.g. sends a firmware to the device, and a real form that they are likely to submit. The hidden form is the one that actually gets submitted. But I thought anything via XHR wouldn't work. Which is needed for a brute force attack say. What did you find?
  • shooper 13y ago
    What about embbedding iframes?
    • shubb 13y ago
      That would look to be correct, see here for example: http://hackers2devnull.blogspot.co.uk/2013/07/exploiting-post-method-xss-silently.html http://hackers2devnull.blogspot.co.uk/2013/07/exploiting-pos... In which case, I woner why more sites (or evil ads via an ad network) don't attack our home routers?
      • chc 13y ago
        Probably because it isn't really necessary — it's easier just to own the user's PC the old-fashioned way.
• Nick_C 13y ago
  One thing I do is put my router and network on a different Class C than the default, for example 192.168.56.0 .
  • pwg 13y ago
    One thing I've always wondered is why anyone would stick with anything in the 192.168 range when the 10.0.0.0 class A is also available for local allocations, and significantly easier to remember?
    • Nick_C 13y ago
      Well, in my case it was because I was a little uncertain of what the various classes meant. This was my pre-university days before I studied networks formally. My first router could only do the 192.168 range so I got in the habit of it. Later with subsequent routers, all my devices were already set up on a specific class C network, so it was easier to change the router than go through all the devices and change them.