Re: [Full-disclosure] JavaScript get Internal Address (thanks to DanBUK)

["pdp (architect)" <pdp.gnucitizen@xxxxxxxxxxxxxx>]

hi martin. this script shows your internal IP address, which is
192.168.1.3. Attackers can use that to find how your internal network
looks like. In your case 192.168.1.0 is you home lan and 192.168.1.1
is probably your router.

cheers,
pdp

On 8/12/06, Martin Dipo Zimmermann <mdz@xxxxxxxxxxx> wrote:
> It appears that your scripts only result is 192.168.1.3 (tested on 5
> sites). Dont think its quite ready to fly yet. But very interesting idea.
>
> BR
>
> Martin
>
> pdp (architect) skrev:
> > http://www.gnucitizen.org/projects/javascript-address-info
> > http://f-box.org/~dan/jstest.html
> >
> > The following technique was brought to me by DanBUK
> > (http://f-box.org/~dan/). Dan managed to find the internal IP address
> > of the visiting client by establishing a socket between local host and
> > the remote web server. Upon success the socket populates its structure
> > with all kinds of useful information among some of which are the
> > internal IP address and the hostname.
> >
> > http://www.gnucitizen.org/projects/javascript-address-info/addressinfo.js
> >
> > This technique requires Java, however I think that It should be
> > possible to achieve similar result by invoking special ActionScript
> > methods from Flash.
> >
> > POC can be found on the url above.
> >


--
pdp (architect)
http://www.gnucitizen.org

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/