I use NoScript, you can't see shit.
You can't see shit neither
yes, he can, he will see the modern equivalent of "This site is best viewed in Internet Explorer". Which in 2019 becomes "Please enable Javascript to view this page"
I can see your local web servers
11–20 of 198 posts
Re: I can see your local web servers
#12I started a local webserver listening on localhost:80 just to see what happens, but this thing seems to not detect it. It shows me "Scanning localhost ... localhost complete."
Edit: My guess is that this thing can only detect servers that send a CORS header that permits cross domain access.
It could probably do way better detection if it did not do xhr requests but added script/css/whatever elements to its own page pointing to localhost and detects if those error out.
Re: I can see your local web servers
#13I started a local webserver listening on localhost:80 just to see what happens, but this thing seems to not detect it. It shows me "Scanning localhost ... localhost complete." Edit: My guess is that this thing can only detect servers that send a CORS header that permits cross domain access. It could probably do way better detection if it did not do xhr requests but added script/css/whatever elements to its own page p…
It's not that it doesn't detect it, but it's not open to external networks, which I guess is a good thing.
Re: I can see your local web servers
#14I started a local webserver listening on localhost:80 just to see what happens, but this thing seems to not detect it. It shows me "Scanning localhost ... localhost complete." Edit: My guess is that this thing can only detect servers that send a CORS header that permits cross domain access. It could probably do way better detection if it did not do xhr requests but added script/css/whatever elements to its own page p…
It's not that it doesn't detect it, but it's not open to external networks, which I guess is a good thing.
What do you mean?
Re: I can see your local web servers
#15I use NoScript, you can't see shit.
This is not helpful, because only an extremely small proportion of Web users run NoScript, and nor should they have to.
Re: I can see your local web servers
#16Can anyone share what measures we can take as web developers to secure local development environment?
Re: I can see your local web servers
#17Earlier quoted context omitted.
It's not that it doesn't detect it, but it's not open to external networks, which I guess is a good thing.
What do you mean?
Probably that your browser is blocking access to the local domain, from the context of an external domain. I'm just guessing here, of course.
Re: I can see your local web servers
#18I started a local webserver listening on localhost:80 just to see what happens, but this thing seems to not detect it. It shows me "Scanning localhost ... localhost complete." Edit: My guess is that this thing can only detect servers that send a CORS header that permits cross domain access. It could probably do way better detection if it did not do xhr requests but added script/css/whatever elements to its own page p…
CORS is a security mechanism for browsers to prevent leaking user information (e.g. cookies) when doing cross domain requests from a browser. CORS does not prevent accessing the server at all. You can always curl a CORS protected server but you won't be able to make a requests including the user's cookies from a disallowed domain.
Re: I can see your local web servers
#19I use NoScript, you can't see shit.
Here's a port scanning technique that doesn't use javascript:
https://blog.jeremiahgrossman.com/2006/11/browser-port-scann...
Re: I can see your local web servers
#20[deleted]