Other nomination

Exposing Intranets with reliable Browser-based Port scanning

Gareth Heyes · PortSwigger Research · 9 November 2018

A browser-based port scanner that is reliable rather than timing-based: a hidden iframe loads a target host and port, then the same URL is clicked again with a hash appended and onload events are counted. A refused port makes Chrome rewrite the URL to chrome-error, giving a second onload, so any web page can enumerate intranet services; Firefox and Edge variants are given.

Record

Researcher

Gareth Heyes

Published by

PortSwigger Research

Date

9 November 2018

In the archive

• Nominated for the 2018 Top 10 Web Hacking Techniques

Related sources

• Research demonstration

Tags

• info-leak
• iframe
• side-channel
• sop-bypass
• javascript
• tooling
• owasp-a01-2021

This page is the archive's own catalogue record. The research is the work of Gareth Heyes, first published at the original source. Preserved copies are kept so the citation survives its host.