Several people were researching HTML portscanning during the last days. Basically this is nothing more than requesting stuff through the link tag, because it halts page rendering and checking how long it took. A typical timing attack that people nowadays even use to break RSA keys. The funny thing about this new JavaScript-less portscanning is however that they do not mention how they want to get an IP range to scan in. A person that disables JavaScript will most probably not have Java activated and without Java there is no public method to get the victim's local IP. Considering the HTML scanning speed it might take months to scan all possible private IP addresses. If you can scan a Class-C subnet in 2 minutes then you will need more than 91 days to scan only the private IP addresses in the 10.x.x.x subnet. Have fun with that... (and especially if the interesting sites are not reachable by IP but only by hostname. So you might find out that a server is up, but you still cannot attack it.)

Well so far the current public development. I thought it would be time to show people a few JavaScript/HTML scanning tricks I was thinking about during the last weeks. The first trick I wanted to share is the easiest way I discovered to get around the HTTP auth popups that the current scanning methods throw. I have several totally different tricks to do that. Because browsers all behave different the first question that comes to mind is: Can you use the "attacked" server to get around the HTTP auth popups.

And yes you can. The trick is to make the server reject the request before it tries to decode it or before it realises that the ressource is HTTP auth protected. The easiest way to do this, is requesting an url like http://192.168.1.1/%. The broken URL encoding will result in a HTTP 400 Bad Request error on many servers (tested against Apache, IIS and some home routers). The only culprit is Internet Explorer 7 which is unwilling to send such requests. (Similiar results were made with requests like http://192.168.1.1/%2e%2e ).

However there are more tricks to make servers refuse requests that will work even in Internet Explorer. The simplest one is to request a very long URL. Something like http://192.168.1.1/AAA...LOTS_OF_AAAA..... (which even works against Google's homemade server).

So far so good... Now you know how you can use simple HTML to not even scan, but also scan without triggering HTTP auth popus.

To be continued...