Skip to content

Samsung schedules Galaxy event 5 days before Apple's

Technology
63 19 62
  • Florida Schools Deploying Armed Drones to Battle School Shooters

    Technology technology
    1
    1
    0 Stimmen
    1 Beiträge
    3 Aufrufe
    Niemand hat geantwortet
  • 12ft.io down?

    Technology technology
    22
    42 Stimmen
    22 Beiträge
    407 Aufrufe
    I
    How do you do that? (ELI5, please)
  • 43 Stimmen
    3 Beiträge
    53 Aufrufe
    I
    Next up: Dos Exploit found in all electric devices in the world! A hacker with physical access can cut the wires.
  • Microsoft axe another 9000 in continued AI push

    Technology technology
    24
    185 Stimmen
    24 Beiträge
    374 Aufrufe
    J
    Yeah my friend is dating a Google recruiter and he overhears some absurd offers. Like, a reasonable person could retire on a few years at that salary. I have a hypothesis that rich people are bad at money
  • Blocking real-world ads: is the future here?

    Technology technology
    33
    1
    198 Stimmen
    33 Beiträge
    723 Aufrufe
    S
    Also a work of fiction
  • Electric Bikes

    Technology technology
    1
    2
    0 Stimmen
    1 Beiträge
    22 Aufrufe
    Niemand hat geantwortet
  • Tesla customers in France sue over brand becoming 'extreme right'

    Technology technology
    32
    1
    506 Stimmen
    32 Beiträge
    432 Aufrufe
    P
    sorry I meant it in a joking way, I should have worded that better
  • 1 Stimmen
    8 Beiträge
    83 Aufrufe
    L
    I think the principle could be applied to scan outside of the machine. It is making requests to 127.0.0.1:{port} - effectively using your computer as a "server" in a sort of reverse-SSRF attack. There's no reason it can't make requests to 10.10.10.1:{port} as well. Of course you'd need to guess the netmask of the network address range first, but this isn't that hard. In fact, if you consider that at least as far as the desktop site goes, most people will be browsing the web behind a standard consumer router left on defaults where it will be the first device in the DHCP range (e.g. 192.168.0.1 or 10.10.10.1), which tends to have a web UI on the LAN interface (port 8080, 80 or 443), then you'd only realistically need to scan a few addresses to determine the network address range. If you want to keep noise even lower, using just 192.168.0.1:80 and 192.168.1.1:80 I'd wager would cover 99% of consumer routers. From there you could assume that it's a /24 netmask and scan IPs to your heart's content. You could do top 10 most common ports type scans and go in-depth on anything you get a result on. I haven't tested this, but I don't see why it wouldn't work, when I was testing 13ft.io - a self-hosted 12ft.io paywall remover, an SSRF flaw like this absolutely let you perform any network request to any LAN address in range.