News for hackers. Stuff that matters.

A comment on 65k Open TCP Ports. Parent comment

Re:65k Open TCP Ports by evmar on Thursday October 20, 2011 @01:46AM (#3133616)
At first you might think "why should Chrome protect people who forget to firewall their intranet?" but the real problem browsers are defending against is some page doing a million <img src='http://10.0.0.1:139>; against an internal service that doesn't handle it well. (Or worse, a POST.)

(PS: HN shows extra characters than what I typed in that HTML. Might be an XSS vulnerability in there.)

[ Parent | on HN ]
Re:65k Open TCP Ports by jdukes on Thursday October 20, 2011 @03:23AM (#3133832)
This actually also has to do with cross protocol attacks. http://i8jesus.com/?p=75
[ Parent | on HN ]
Re:65k Open TCP Ports by maximusprime on Thursday October 20, 2011 @03:57AM (#3133920)
There was an attack last year on freenode which worked like this... javascript did an automatic POST to irc.freenode.net:6667 with form data that included IRC commands to spam channels etc.

Unfortunately at the time their ircd didn't care about the 'POST / HTTP headers', and lovingly accepted the spam.

[ Parent | on HN ]