Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

I can see your local web servers

http.jameshfisher.com

Post reply on HN
Print view View original

31–40 of 198 posts

Re: I can see your local web servers

#32

Post by tinus_hn »

gnomewascool wrote: post #26
dwb wrote: post #15

Earlier quoted context omitted.

This is not helpful, because only an extremely small proportion of Web users run NoScript, and nor should they have to.

> This is not helpful, because only an extremely small proportion of Web users run NoScript, and nor should they have to. Most (non-technical) Web users also don't run their own web servers, so they aren't affected. Among technical users, the proportion with NoScript is probably not as small.

Most users have a modem or router that comes with a web interface, like just about everything in the internet of things.

Re: I can see your local web servers

#33

Post by vbsteven »

larkeith wrote: post #27
vbsteven wrote: post #11

Earlier quoted context omitted.

yes, he can, he will see the modern equivalent of "This site is best viewed in Internet Explorer". Which in 2019 becomes "Please enable Javascript to view this page"

Honestly, such notices are shockingly unusual - most of the time (at least for the sites I encounter) they don't bother with , you just get a broken and/or blank page. I mostly use the web for reading blogs and articles, so the loss of dynamic sites isn't troublesome, but it's certainly not for most users. (Edit: Some numerical context I have enabled Javascript for 194 sites over the last five years, whereas I encoun…

I also browse with noscript all the time and I get them quite often. Mostly on product landing pages and Show HN demos.

Re: I can see your local web servers

#34

Post by brasetvik »

The page doesn't do a great job at explaining the mechanism (which from a quick glance seems to involve WebRTC).

This is a better resource on this topic, which involves DNS rebinding: https://medium.com/@brannondorsey/attacking-private-networks...

DNS-rebinding also gets around the cross origin request issue, which some comments here mention.

Re: I can see your local web servers

#36

Post by black_puppydog »

gnomewascool wrote: post #30

If you use uMatrix, you can easily block the localhost and local network "sniffing" with the following rule[0]: * 127 * block ### block access to IPv4 localhost 127.x.x.x * localhost * block * [::1] * block ### block access to IPv6 localhost * 192.168 * block ### block access to LAN 192.168.x.x In principle, you can use this without any other blocking, i.e. with the rule: * * * allow and hence without disabling javas…

that's awesome, using it!

but to be fair, the point seemed to be more that if you run something that's "only" exposed locally... don't. securing each and every machine with uMatrix doesn't seem the answer to this.

Re: I can see your local web servers

#37

Post by deadbunny »

gnomewascool wrote: post #26
dwb wrote: post #15

Earlier quoted context omitted.

This is not helpful, because only an extremely small proportion of Web users run NoScript, and nor should they have to.

> This is not helpful, because only an extremely small proportion of Web users run NoScript, and nor should they have to. Most (non-technical) Web users also don't run their own web servers, so they aren't affected. Among technical users, the proportion with NoScript is probably not as small.

Their routers do, along with an ever growing number of IoT devices people happily hook up to their WiFi without a second thought.

Given the long and gory history of companies releasing insecure by default devices methods like this are a legitimate entry point into a network.

Re: I can see your local web servers

#38

Post by shakna »

jand wrote: post #31

Funny enough, the site is reporting port 3000 to be running a web server. It is not - according do nmap and my knowledge. Any ideas on this?

If you're on Linux, BSD and macOS, you can run:

    sudo lsof -i | grep 3000
To try and see if a process has claimed the port.

On Windows:

    netstat -ab
I've forgotten so much Windows I don't know how to filter the result, but it'll give you a list of ports and processes.

Re: I can see your local web servers

#39

Post by megous »

Other approach is to create a useful extension like:

  https://addons.mozilla.org/en-US/firefox/addon/yt-adblock/reviews/
disguise that you're inserting an iframe linking to your web server into every single page user opens, by naming variables and your tracking domain incorrectly and by waiting for an hour after installation (this may also help avoid automatic tests mozilla is doing) and then just sit back and wait and log all the referers and ip addresses. It's a bit stealthier too, but needs users to visit their local web servers. But you'll also get the full URL.

Nobody will report you or care about the report and users are banned from fixing the extension code locally even if they're able to review it themselves. Bad reviews with some actual text fade away quickly, so if someone warns your other users, it will be pushed out to page 2 after a while by other useful one word or just empty reviews and it will work out.

Re: I can see your local web servers

#40

Post by rahuldottech »

mehrdadn wrote: post #35

Here's a question I've had for a while: WHY in the world do web browsers not block access to localhost? What exactly is the extremely compelling use case that has prevented them from blocking this?

Some browsers apparently do, which is why this demo isn't working for some HN users.
Post reply on HN