Later archive addition

WebRTC IP Address Leaks

A live demonstration that any web page can use WebRTC to issue STUN requests from JavaScript and read back the visitor's local, public and IPv6 addresses without permission. The requests never appear in developer tools and cannot be blocked by extensions such as AdBlock or Ghostery, so the page deanonymises users behind NAT, VPNs and proxies.

In the archive

• Added to the 2015 archive after the original list was published

Related sources

• Source

Tags

• webrtc
• info-leak
• javascript
• filter-bypass
• browser-extension
• tooling
• owasp-a05-2021

This page is the archive's own catalogue record. The research is the work of its author, first published at the original source. Preserved copies are kept so the citation survives its host.