PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Exposing Intranets with reliable Browser-based Port scanning

portswigger.net | research | #browser-security | #portswigger | #javascript | #chrome | #recon | #port-scanning | #intranet
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

Gareth Heyes builds a reliable browser-based port scanner, distinguishing open ports via Chrome's chrome-error:// behavior and counting iframe onload events.
Published
Collected

Related coverage

research · portswigger.net
What's in a tag name? JavaScript, apparently
This research provides technical context that security teams can use for monitoring and validation.
research · portswigger.net
Hackability inspector
Gareth Heyes presents the Hackability inspector, a browser tool that enumerates JavaScript objects and flags security-relevant properties like cross-domain leaks and Java bridges.
research · portswigger.net
DOM based AngularJS sandbox escapes
Gareth Heyes develops a DOM-based AngularJS sandbox escape in the previously unexploitable orderBy filter, tracing the framework's sandbox history and exploit development.
research · portswigger.net
Evading CSP with DOM-based dangling markup
Gareth Heyes evades restrictive CSP and XSS Auditor with DOM-based dangling markup, using base target and form elements to leak page contents via window.name.
research · portswigger.net
Unearthing Z͌̈́̾a͊̈́l͊̿g̏̉͆o̾̚̚S̝̬ͅc̬r̯̼͇ͅi̼͖̜̭͔p̲̘̘̹͖t̠͖̟̹͓͇ͅ with visual fuzzing
Gareth Heyes uses visual fuzzing with headless Chrome and puppeteer to hunt Unicode combining characters that form render-defect Zalgo JavaScript, valid on Edge.
research · portswigger.net
Abusing Chrome's XSS auditor to steal tokens
Gareth Heyes abuses Chrome's XSS Auditor block mode as a side-channel oracle, brute-forcing values such as user IDs embedded in inline scripts and stealing tokens. Includes working PoC code.
Back