Other nomination

Canadian Beacon

Demonstrates JavaScript port scanning of a visitor's internal network from an ordinary web page, using the Beacon and performance timing APIs against hidden iframes in place of the old iframe onload trick. A hostile page can enumerate live hosts and open ports on RFC1918 addresses behind the browser.

Record

Published by

WhiteHat Security

In the archive

• Nominated for the 2014 Top 10 Web Hacking Techniques

Tags

• timing-attack
• side-channel
• javascript
• iframe
• info-leak
• prior-art-extension

This page is the archive's own catalogue record. The research is the work of WhiteHat Security, first published at the original source. Preserved copies are kept so the citation survives its host.