3 ms·
I don't see how. WebRTC may leak your local IP, but that doesn't mean someone outside your local network can interact with it (without compromising a machine on
by doktrin 12y ago
I don't see how. WebRTC may leak your local IP, but that doesn't mean someone outside your local network can interact with it (without compromising a machine on said network).
- tonyarkles 12y agoIf your router is vulnerable to XSS or something like it, an attacker can probably guess its IP pretty easily (x.x.x.1). Edit: I realized I didn't take this to its full conclusion. Guess the router's IP, exploit XSS to open ports on the router to your machine (JS knows your local IP already), carry on escalating from there.
- peteretep 12y agoGiven that ten IP values will cover 99% of routers, could as easily cycle through them all...
- doktrin 12y agoThat's a great point. You're 100% correct. Can you recommend any good reading on offensive security?
- bestham 12y agoYou could have a look at Samy Kamkars talk "How I met your girlfriend" at Blackhat 2010: https://www.youtube.com/watch?v=O5xRRF5GfQs&ab_channel=killab66661 https://www.youtube.com/watch?v=O5xRRF5GfQs&ab_channel=killa...
- deleted 12y ago[deleted]
- h43z 12y agoYou don't even need xss for this. You can simply bruteforce the password and try to get some fingerprint of the router and enable remote management. I did this some years back. Back then I also needed to find out the routers IP. Did this via iframes and the js onload event.