Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Date: Thu, 20 Apr 2023 11:51:37 +0000
From: Jeremy Stanley <>
Subject: Re: Checking existence of firewalled URLs via
 javascript's script.onload

On 2023-04-20 10:58:42 +0300 (+0300), Georgi Guninski wrote:
> I can't imagine how can you check for open port/URL without
> javascript, can you give reference or explanation? You can make
> request, but without javascript you can't read the result.

If the attacker controls the destination, they can simply record
whether the connection is successfully established at the remote
end. While this may not tell them much about what specific hosts the
victim has access to reach, it can easily leak general egress
filtering information.
Jeremy Stanley

Download attachment "signature.asc" of type "application/pgp-signature" (964 bytes)

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.