2 ms·
Can you expand on this, please? How does it make it easier to XSS?
by jnbiche 11y ago
Can you expand on this, please? How does it make it easier to XSS?
- pjc50 11y agoPreviously you'd have to guess that the router was on 192.168.x.1. http://www.gironsec.com/blog/2015/01/owning_modems_and_routers_silently/ http://www.gironsec.com/blog/2015/01/owning_modems_and_route...
- chadrs 11y agoWell, I'm not sure about XSS, but imagine you know someone's home IP is: 192.168.1.10 Based on this, you can probably guess the router is 192.168.1.1 and maybe even have a clue about the vendor based on the IP assigning patterns. Then you can direct them to a page with an submitting POST <form> that makes modifications to their router settings. This is more like CSRF than XSS though.
- malka 11y agofunny, of all the routers I used (all were provided by my ISP), their IP were 192.168.1.254
- deleted 11y ago[deleted]
- milankragujevic 11y agoIt doesn't. All major browsers block connections to 192.168.XX.XX (and any other externally unroutable IP) from external (http on the Web, not localhost) web pages.
- pjc50 11y agoJust tested img and iframe and they work quite happily from the web to the local network.