I can see your local web servers

#1

Post by jamesfisher » Tue, May 28, 2019, 7:57 AM UTC

I can see your local web servers
http.jameshfisher.com

Re: I can see your local web servers

#2

Post by jsgyx » Tue, May 28, 2019, 8:44 AM UTC

I use NoScript, you can't see shit.

Re: I can see your local web servers

#3

Post by shakna » Tue, May 28, 2019, 8:50 AM UTC

I can see the list of XHR requests made, and I have half a dozen local web servers running, and there are a bunch of other web servers running on my network. I have a bad habit of spinning up a server on an ESP32 whenever I want to remote control something physical.

... Strangely, despite the XHR's hitting ports and IPs I know are running unsecured web servers, the site sees nothing. Lots of "unreachable".

Firefox 67.0, Arch Linux (5.0.10).

Re: I can see your local web servers

#4

Post by ivolimmen » Tue, May 28, 2019, 8:51 AM UTC

I only run on local on ports: 8080, 9090, 9191, 8081, 8082 and 8083. So scanning only on 3000 is a bit narrow...

Re: I can see your local web servers

#5

Post by TimWolla » Tue, May 28, 2019, 8:52 AM UTC

ivolimmen wrote: post #4

I only run on local on ports: 8080, 9090, 9191, 8081, 8082 and 8083. So scanning only on 3000 is a bit narrow...

It does not only scan 3000. From the source code:

      const portsToTry = [
        80, 81, 88,
        3000, 3001, 3030, 3031, 3333,
        4000, 4001, 4040, 4041, 4444,
        5000, 5001, 5050, 5051, 5555,
        6000, 6001, 6060, 6061, 6666,
        7000, 7001, 7070, 7071, 7777,
        8000, 8001, 8080, 8081, 8888,
        9000, 9001, 9090, 9091, 9999,
      ];

Re: I can see your local web servers

#6

Post by julienreszka » Tue, May 28, 2019, 8:53 AM UTC

jsgyx wrote: post #2

I use NoScript, you can't see shit.

You can't see shit neither

Re: I can see your local web servers

#7

Post by majke » Tue, May 28, 2019, 8:53 AM UTC

My favorite is retrieving http://wpad/wpad.dat with ajax.

https://bugs.chromium.org/p/chromium/issues/detail?id=123166

Re: I can see your local web servers

#8

Post by boffinism » Tue, May 28, 2019, 8:53 AM UTC

ivolimmen wrote: post #4

I only run on local on ports: 8080, 9090, 9191, 8081, 8082 and 8083. So scanning only on 3000 is a bit narrow...

On my machine it seems to be scanning for lots of ports between :80 and :9999. I think it's using 3000 as an example in the text only.

Re: I can see your local web servers

#9

Post by [deleted] » Tue, May 28, 2019, 8:54 AM UTC

[deleted]

Re: I can see your local web servers

#10

Post by y0ghur7_xxx » Tue, May 28, 2019, 8:54 AM UTC

ivolimmen wrote: post #4

I only run on local on ports: 8080, 9090, 9191, 8081, 8082 and 8083. So scanning only on 3000 is a bit narrow...

It's not scanning only port 3000:

    const portsToTry = [
      80, 81, 88,
      3000, 3001, 3030, 3031, 3333,
      4000, 4001, 4040, 4041, 4444,
      5000, 5001, 5050, 5051, 5555,
      6000, 6001, 6060, 6061, 6666,
      7000, 7001, 7070, 7071, 7777,
      8000, 8001, 8080, 8081, 8888,
      9000, 9001, 9090, 9091, 9999,
    ];

view-source:http://http.jameshfisher.com/2019/05/26/i-can-see-your-local... :125