News for hackers. Stuff that matters.

A comment on D-Link Home Routers Open to Remote Takeover Will Remain Unpatched. Parent comment

Re:D-Link Home Routers Open to Remote Takeover Will Remain U... by chopin on Tuesday October 08, 2019 @04:33PM (#21196910)
CORS prevents the JS from seeing the result but it doesn't prevent the sending of the request.

This is one of the reasons my internal network is not 192.168.1.1/24 and the router is not 192.168.1.1.

[ Parent | on HN ]
Re:D-Link Home Routers Open to Remote Takeover Will Remain U... by spartas on Tuesday October 08, 2019 @04:53PM (#21197137)
> This is one of the reasons my internal network is not 192.168.1.1/24 and the router is not 192.168.1.1.

Do you also disable WebRTC on all clients on your network? An attacker (or script) may be foiled by your non-standard gateway network, but your work in obfuscating the router is wasted if they can get at your client IP address.

[ Parent | on HN ]
Re:D-Link Home Routers Open to Remote Takeover Will Remain U... by kbenson on Tuesday October 08, 2019 @04:56PM (#21197173)
Doesn't CORS generally send an OPTION request first to see if the target site even allows the requests, thus preventing this? That's what I've seen when trying to work around browser CORS limitations.
[ Parent | on HN ]
Re:D-Link Home Routers Open to Remote Takeover Will Remain U... by rnicholus on Tuesday October 08, 2019 @05:14PM (#21197348)
only for ajax requests that are not "simple", that is requests that cannot be sent w/out JavaScript. The sending of this OPTIONS request is referred to as a pre-flight. A more through description at https://developer.mozilla.org/en-US/docs/Web/HTTP/CORS
[ Parent | on HN ]
Re:D-Link Home Routers Open to Remote Takeover Will Remain U... by foxylion on Tuesday October 08, 2019 @05:15PM (#21197350)
You can also just do a normal form post request into an invisible iframe that is generated by the attacker's javascript.
[ Parent | on HN ]