Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

I can see your local web servers

http.jameshfisher.com

Post reply on HN
Print view View original

51–60 of 198 posts

Re: I can see your local web servers

#51

Post by OJFord »

gnomewascool wrote: post #30

If you use uMatrix, you can easily block the localhost and local network "sniffing" with the following rule[0]: * 127 * block ### block access to IPv4 localhost 127.x.x.x * localhost * block * [::1] * block ### block access to IPv6 localhost * 192.168 * block ### block access to LAN 192.168.x.x In principle, you can use this without any other blocking, i.e. with the rule: * * * allow and hence without disabling javas…

Presumably also:

    * 10      * block    ### block access to LAN 10.x.x.x

Re: I can see your local web servers

#52

Post by captn3m0 »

gnomewascool wrote: post #30

If you use uMatrix, you can easily block the localhost and local network "sniffing" with the following rule[0]: * 127 * block ### block access to IPv4 localhost 127.x.x.x * localhost * block * [::1] * block ### block access to IPv6 localhost * 192.168 * block ### block access to LAN 192.168.x.x In principle, you can use this without any other blocking, i.e. with the rule: * * * allow and hence without disabling javas…

uMatrix blocked all of it for me by default.

Re: I can see your local web servers

#53

Post by chronial »

lostjohnny wrote: post #24

Nope, you can't Cross-Origin Request Blocked: The Same Origin Policy disallows reading the remote resource at http://localhost/. (Reason: CORS header ‘Access-Control-Allow-Origin’ missing) Anyway TypeError: /(192\.168\.[0-9]+\.)[0-9]+/.exec(...) is null i-can-see-your-local-web-servers:169:41

The Cross-Origin check be circumvented via DNS Rebinding: When you request mypage.com, my DNS returns the ip of my webserver. On all subsequent requests, it will return 127.0.0.1. Now localhost is on the same origin as my page.

Re: I can see your local web servers

#54

Post by hanslet »

chrisan wrote: post #43
jsty wrote: post #29

"If you see any results like 192.168.0.4:3000 is available!, you should tell your colleague to secure whatever she has running on that port" Someone's going to access this page at $BIGCORP with an overly trigger-happy IDS and get a fun morning meeting with IT to un-quarantine their machine.

edit: I am a dolt. Thank you :) I got this address as well, do you have anything running on .4? It's just weird because I have .1 router, .2 AP, .3 pi-hole then .10 is when I start my static IPs and .100 is where my dhcp starts nmap says that host is down as well

The page is using JavaScript with the JS WebRTC interface RTCPeerConnection[0]. Maybe that can help.

[0] https://developer.mozilla.org/en-US/docs/Web/API/RTCPeerConn...

Re: I can see your local web servers

#55

Post by spyder »

gnomewascool wrote: post #30

If you use uMatrix, you can easily block the localhost and local network "sniffing" with the following rule[0]: * 127 * block ### block access to IPv4 localhost 127.x.x.x * localhost * block * [::1] * block ### block access to IPv6 localhost * 192.168 * block ### block access to LAN 192.168.x.x In principle, you can use this without any other blocking, i.e. with the rule: * * * allow and hence without disabling javas…

Also, uBlock has an option in its settings to block the webrtc leak (but not enabled by default):

"Prevent WebRTC from leaking local IP addresses"

Re: I can see your local web servers

#56

Post by gnomewascool »

captn3m0 wrote: post #52
gnomewascool wrote: post #30

If you use uMatrix, you can easily block the localhost and local network "sniffing" with the following rule[0]: * 127 * block ### block access to IPv4 localhost 127.x.x.x * localhost * block * [::1] * block ### block access to IPv6 localhost * 192.168 * block ### block access to LAN 192.168.x.x In principle, you can use this without any other blocking, i.e. with the rule: * * * allow and hence without disabling javas…

uMatrix blocked all of it for me by default.

Yes, but by default uMatrix might be overly strict for many people. For instance, by default it blocks all third-party javascript.

Re: I can see your local web servers

#57

Post by shakna »

ypkuby wrote: post #47
shakna wrote: post #23

Earlier quoted context omitted.

There's half a dozen that are.

Do you have any locked down policy on them though? I assume this would only work if you gave blanket access. I noticed in my tests it found one on port 3000 with blanket access, but didn't see one on port 9999 with restricted access( policy => allow from *.mydomains )

Yes. I'm terrible and have them set to allow all domains, and all methods.

Re: I can see your local web servers

#60

Post by kmlx »

mehrdadn wrote: post #35

Here's a question I've had for a while: WHY in the world do web browsers not block access to localhost? What exactly is the extremely compelling use case that has prevented them from blocking this?

quick development? some of us use localhost to quickly test/develop.
Post reply on HN