News for hackers. Stuff that matters.

A comment on Why Is This Website Port Scanning Me?. Parent comment

Re:Why Is This Website Port Scanning Me? by kevingadd on Wednesday May 20, 2020 @03:27PM (#23250725)
CORS is set by the target, so localhost CORS policy is directly in the hands of the user. intranet CORS policy is set by whoever operates that intranet service
[ Parent | on HN ]
Re:Why Is This Website Port Scanning Me? by souterrain on Wednesday May 20, 2020 @04:08PM (#23251176)
You’re right; a bit of a brain fail there for me.

Still, doesn’t mitigate attacks against non-HTTP speakers.

[ Parent | on HN ]
Re:Why Is This Website Port Scanning Me? by johncolanduoni on Wednesday May 20, 2020 @04:31PM (#23251419)
It does in the sense that you won’t be able to control the websockets payload, so the target server generally won’t respond. The problem here is that the information leak is happening prior to any data being sent over TCP, so the fact that the server will drop the connection as invalid doesn’t help.
[ Parent | on HN ]