Other nomination

Port Scanning with HTML5 and JS-Recon

lava

Cross-Origin Requests and WebSockets both expose readyState, and how long a given readyState lasts varies with whether the target port is open, closed or filtered. Timing readyState 1 for CORS and readyState 0 for WebSockets therefore distinguishes port states from JavaScript, extending to network sweeps and internal IP discovery. Released as the JS-Recon tool.

Record

Researcher

lava

In the archive

• Nominated for the 2010 Top 10 Web Hacking Techniques

Tags

• cors
• websocket
• timing-attack
• side-channel
• tooling
• javascript
• owasp-a01-2021

This page is the archive's own catalogue record. The research is the work of lava, first published at the original source. Preserved copies are kept so the citation survives its host.