I can see your local web servers • Hacker News Board

Re: I can see your local web servers

#41

Post by ryacko » Tue, May 28, 2019, 9:45 AM UTC

Firejail allows for the creation of sandboxed interfaces, which include the ability to block local network access.

Re: I can see your local web servers

#42

Post by systemtest » Tue, May 28, 2019, 9:46 AM UTC

I used to scan the company network for Selenium servers and remotely open "inappropriate" pages. Always nice to see a coworker wonder why a browser window with images of Pooh opened up.

Re: I can see your local web servers

#43

Post by chrisan » Tue, May 28, 2019, 9:46 AM UTC

jsty wrote: post #29

"If you see any results like 192.168.0.4:3000 is available!, you should tell your colleague to secure whatever she has running on that port" Someone's going to access this page at $BIGCORP with an overly trigger-happy IDS and get a fun morning meeting with IT to un-quarantine their machine.

edit: I am a dolt. Thank you :)

I got this address as well, do you have anything running on .4?

It's just weird because I have .1 router, .2 AP, .3 pi-hole

then .10 is when I start my static IPs

and .100 is where my dhcp starts

nmap says that host is down as well

Re: I can see your local web servers

#44

Post by crishoj » Tue, May 28, 2019, 9:46 AM UTC

Makes you wonder what other apps are accepting local HTTP connections (e.g. vendor bloatware [1]).

[1] https://support.lenovo.com/th/th/product_security/len_4326

Re: I can see your local web servers

#45

Post by gbuk2013 » Tue, May 28, 2019, 9:47 AM UTC

Judging by "ReferenceError: webkitRTCPeerConnection is not defined" message in my browser it probably uses WebRTC to get your local IP subnet. I installed an add-on to block WebRTC after I watched a presentation on this tool [1][2] and I recommend you also do this, unless you actively use WebRTC (and don't want the hassle of toggling a switch).

Unfortunately the protocol is vulnerable by design. :(

[1] https://portswigger.net/daily-swig/new-tool-enables-dns-rebi...

[2] https://www.blackhat.com/asia-19/arsenal/schedule/#redtunnel...

Re: I can see your local web servers

#46

Post by DarkWiiPlayer » Tue, May 28, 2019, 9:48 AM UTC

gnomewascool wrote: post #30

If you use uMatrix, you can easily block the localhost and local network "sniffing" with the following rule[0]: * 127 * block ### block access to IPv4 localhost 127.x.x.x * localhost * block * [::1] * block ### block access to IPv6 localhost * 192.168 * block ### block access to LAN 192.168.x.x In principle, you can use this without any other blocking, i.e. with the rule: * * * allow and hence without disabling javas…

you'd need at least

    localhost localhost * allow

to be able to open sites on localhost directly.

Re: I can see your local web servers

#47

Post by ypkuby » Tue, May 28, 2019, 9:50 AM UTC

shakna wrote: post #23

sepbot wrote: post #22

Earlier quoted context omitted.

The requests should fail unless the servers you are running allow CORS as per the headers.

There's half a dozen that are.

Do you have any locked down policy on them though? I assume this would only work if you gave blanket access.

I noticed in my tests it found one on port 3000 with blanket access, but didn't see one on port 9999 with restricted access( policy => allow from *.mydomains )

Re: I can see your local web servers

#48

Post by fredley » Tue, May 28, 2019, 9:53 AM UTC

systemtest wrote: post #42

I used to scan the company network for Selenium servers and remotely open "inappropriate" pages. Always nice to see a coworker wonder why a browser window with images of Pooh opened up.

I hope you're not in China!

Re: I can see your local web servers

#49

Post by coob » Tue, May 28, 2019, 9:53 AM UTC

chrisan wrote: post #43

jsty wrote: post #29

"If you see any results like 192.168.0.4:3000 is available!, you should tell your colleague to secure whatever she has running on that port" Someone's going to access this page at $BIGCORP with an overly trigger-happy IDS and get a fun morning meeting with IT to un-quarantine their machine.

edit: I am a dolt. Thank you :) I got this address as well, do you have anything running on .4? It's just weird because I have .1 router, .2 AP, .3 pi-hole then .10 is when I start my static IPs and .100 is where my dhcp starts nmap says that host is down as well

That just the example in the description, not the scan results.

Re: I can see your local web servers

#50

Post by jsty » Tue, May 28, 2019, 9:54 AM UTC

chrisan wrote: post #43

jsty wrote: post #29

"If you see any results like 192.168.0.4:3000 is available!, you should tell your colleague to secure whatever she has running on that port" Someone's going to access this page at $BIGCORP with an overly trigger-happy IDS and get a fun morning meeting with IT to un-quarantine their machine.

edit: I am a dolt. Thank you :) I got this address as well, do you have anything running on .4? It's just weird because I have .1 router, .2 AP, .3 pi-hole then .10 is when I start my static IPs and .100 is where my dhcp starts nmap says that host is down as well

I think that's just the hardcoded example in the text, considering it's still there when I viewed with no scripts enabled (and I'm on a network that doesn't have anything assigned in 192.168.0.0/16).