Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

I can see your local web servers

http.jameshfisher.com

Post reply on HN
Print view View original

21–30 of 198 posts

Re: I can see your local web servers

#21

Post by keithnz »

founderling wrote: post #12

I started a local webserver listening on localhost:80 just to see what happens, but this thing seems to not detect it. It shows me "Scanning localhost ... localhost complete." Edit: My guess is that this thing can only detect servers that send a CORS header that permits cross domain access. It could probably do way better detection if it did not do xhr requests but added script/css/whatever elements to its own page p…

I started some as well, it didn't find anything.

Re: I can see your local web servers

#22

Post by sepbot »

shakna wrote: post #3

I can see the list of XHR requests made, and I have half a dozen local web servers running, and there are a bunch of other web servers running on my network. I have a bad habit of spinning up a server on an ESP32 whenever I want to remote control something physical. ... Strangely, despite the XHR's hitting ports and IPs I know are running unsecured web servers, the site sees nothing. Lots of "unreachable". Firefox 67…

The requests should fail unless the servers you are running allow CORS as per the headers.

Re: I can see your local web servers

#23

Post by shakna »

sepbot wrote: post #22
shakna wrote: post #3

I can see the list of XHR requests made, and I have half a dozen local web servers running, and there are a bunch of other web servers running on my network. I have a bad habit of spinning up a server on an ESP32 whenever I want to remote control something physical. ... Strangely, despite the XHR's hitting ports and IPs I know are running unsecured web servers, the site sees nothing. Lots of "unreachable". Firefox 67…

The requests should fail unless the servers you are running allow CORS as per the headers.

There's half a dozen that are.

Re: I can see your local web servers

#24

Post by lostjohnny »

Nope, you can't

    Cross-Origin Request Blocked: The Same Origin Policy disallows reading the remote resource at http://localhost/. (Reason: CORS header ‘Access-Control-Allow-Origin’ missing)
Anyway

    TypeError: /(192\.168\.[0-9]+\.)[0-9]+/.exec(...) is null i-can-see-your-local-web-servers:169:41

Re: I can see your local web servers

#26

Post by gnomewascool »

dwb wrote: post #15
jsgyx wrote: post #2

I use NoScript, you can't see shit.

This is not helpful, because only an extremely small proportion of Web users run NoScript, and nor should they have to.

> This is not helpful, because only an extremely small proportion of Web users run NoScript, and nor should they have to.

Most (non-technical) Web users also don't run their own web servers, so they aren't affected. Among technical users, the proportion with NoScript is probably not as small.

Re: I can see your local web servers

#27

Post by larkeith »

vbsteven wrote: post #11
julienreszka wrote: post #6

Earlier quoted context omitted.

You can't see shit neither

yes, he can, he will see the modern equivalent of "This site is best viewed in Internet Explorer". Which in 2019 becomes "Please enable Javascript to view this page"

Honestly, such notices are shockingly unusual - most of the time (at least for the sites I encounter) they don't bother with , you just get a broken and/or blank page.

I mostly use the web for reading blogs and articles, so the loss of dynamic sites isn't troublesome, but it's certainly not for most users.

(Edit: Some numerical context I have enabled Javascript for 194 sites over the last five years, whereas I encounter several new sites daily.)

Re: I can see your local web servers

#28

Post by jsgyx »

dwb wrote: post #15
jsgyx wrote: post #2

I use NoScript, you can't see shit.

This is not helpful, because only an extremely small proportion of Web users run NoScript, and nor should they have to.

That's like saying that people shouldn't have to run ad blockers, that instead ad networks should behave. Sit and wait.

Re: I can see your local web servers

#29

Post by jsty »

"If you see any results like 192.168.0.4:3000 is available!, you should tell your colleague to secure whatever she has running on that port"

Someone's going to access this page at $BIGCORP with an overly trigger-happy IDS and get a fun morning meeting with IT to un-quarantine their machine.

Re: I can see your local web servers

#30

Post by gnomewascool »

If you use uMatrix, you can easily block the localhost and local network "sniffing" with the following rule[0]:

  * 127       * block    ### block access to IPv4 localhost 127.x.x.x
  * localhost * block
  * [::1]     * block    ### block access to IPv6 localhost
  * 192.168   * block    ### block access to LAN 192.168.x.x
In principle, you can use this without any other blocking, i.e. with the rule:

  * * * allow
and hence without disabling javascript on any sites.

[0] https://github.com/ghacksuserjs/ghacks-user.js/wiki/4.2.3-uM...

Edit: as pointed out by DarkWiiPlayer below, if you want to be able to access the localhost websites from the same browser, you need:

  localhost localhost * allow
and similarly for the LAN. In full:

  127       127       * allow
  localhost localhost * allow
  [::1]     [::1]     * allow
  192.168   192.168   * allow
Post reply on HN