The Web Application Hacker’s Handbook Discovering and Exploiting Security Flaws

Port Scan the Local Network

Using techniques pioneered by Jeremiah Grossman and Robert Hansen,

JavaScript can be used to perform a port scan of hosts on the user’s local net-

work, to identify services that may be exploitable. If a user is behind a corpo-

rate or home firewall, an attacker will be able to reach services that cannot be

accessed from the public Internet. If the attacker scans the client computer’s

loopback interface, he may be able to bypass any personal firewall installed by

the user. 

Chapter 12 

■

Attacking Other Users

397

70779c12.qxd:WileyRed  9/14/07  3:14 PM  Page 397

---

Browser-based port scanning can use a Java applet to determine the user’s

IP address (which may be NAT-ed from the public Internet), and so infer the IP

range of the local network. The script can then initiate HTTP connections to

arbitrary hosts and ports to test connectivity. As already described, the same

origin policy prevents the script from processing the responses to these

requests. However, a similar trick as was used to detect login status can also be

used to test for network connectivity. Here, the attacker’s script attempts to

dynamically load and execute a script from each targeted host and port. If a

web server is running on that port, it will return HTML or some other content,

resulting in a JavaScript console error that the port scanning script can detect.

Otherwise, the connection attempt will time out or return no data, in which

case no error is thrown. Hence, despite the same origin restrictions, the port-

scanning script can confirm connectivity to arbitrary hosts and ports.