Other nomination

XMLHTTPReqest "Ping" Sweeping in Firefox 3.5+

Firefox 3.5's CORS cross-domain XMLHttpRequest hides whether a target page exists, but the attacker can still issue the initial request. Live hosts answer immediately while absent ones hang for 20-75 seconds, and that timing gap enumerates internal address space behind the victim's firewall. Basic and digest auth popups are suppressed, which suits intranet sweeping.

In the archive

• Nominated for the 2009 Top 10 Web Hacking Techniques

Related sources

• Research demonstration

Tags

• cors
• timing-attack
• side-channel
• info-leak
• javascript
• same-origin-policy
• owasp-a01-2021

This page is the archive's own catalogue record. The research is the work of its author, first published at the original source. Preserved copies are kept so the citation survives its host.