Other nomination

Bypass port blocking in Firefox, Opera and Konqueror.

mark

FTP clients follow the IP address a server returns in its PASV reply, so a malicious FTP server can redirect a browser's data connection to any host and port. This defeats Firefox port banning, extending JavaScript port scanning to every TCP port, and the same-origin handling permits banner grabbing off-origin; services returning no banner are fingerprinted by how long they hold an idle connection open.

Record

Researcher

mark

In the archive

• Nominated for the 2007 Top 10 Web Hacking Techniques

Related sources

• Companion code package

Tags

• ftp
• javascript
• sop-bypass
• filter-bypass
• timing-attack
• info-leak
• owasp-a01-2021
• owasp-a05-2021

This page is the archive's own catalogue record. The research is the work of mark, first published at the original source. Preserved copies are kept so the citation survives its host.