private.txt?

Current License: CC BY-SA 4.0

15 events

when toggle format	what		by	license	comment
Jun 16, 2020 at 9:49	history	edited	CommunityBot		Commonmark migration
Nov 23, 2019 at 11:27	history	edited	Conor Mancone	CC BY-SA 4.0	edited body
Nov 23, 2019 at 2:45	history	edited	Conor Mancone	CC BY-SA 4.0	added 312 characters in body
Nov 22, 2019 at 16:13	history	edited	Conor Mancone	CC BY-SA 4.0	added 633 characters in body
Nov 22, 2019 at 16:08	comment	added	Conor Mancone		@mti2935 Yes, excellent point - apologies for my misunderstanding. Indeed, router security sucks. This article is from 2015 and describes an attack witnessed in the wild that targets CSRF vulnerabilities in 40 different router models from a number of large manufacturers: computerworld.com/article/2925580/…
Nov 22, 2019 at 15:59	comment	added	mti2935		Right, I completely agree. I made the point of using an `<img>` tag, because `<img>` tags are often easier for an attacker to embed in a web page, than javascript. For example, eBay allow users to create listings in HTML format, with `<img>` tags that reference images at other domains, but I don't think they allow users to include javascript in the HTML. It's incredible that there are routers that are so vulnerable to something that can be exploited so easily.
Nov 22, 2019 at 15:36	comment	added	Conor Mancone		@mti2935 oh yes, absolutely. However, that would be no different than if the attacker had javascript that made an AJAX request, which the SOP also will not stop. Whether it is an AJAX request via javascript or an `img` tag, the SOP never does anything to stop the request - it will just stop the attacker from reading the response (well, technically other things, not the SOP, stop the attacker from reading the response in `img` tags). So whether you use javascript or an `img` tag, the end result is the same - writes but no reads.
Nov 22, 2019 at 15:27	comment	added	mti2935		Right, I realize that the attacker would have no way of reading the response. But, to the point that you made in your answer - the response is really not important to the attacker in this scenario. The attacker would be able to compromise the router simply making the GET request to the URL (by way of the `img` tag), no response needed. And, same-origin policy will do nothing to prevent this.
Nov 22, 2019 at 15:16	comment	added	Conor Mancone		@mti2935 it would make the request just the same, but the response wouldn't be accessible to javascript on the page. In general javascript has no way of fetching the actual image behind an `img` tag. It's also quite possible that since the response won't be an actual image, the browser will throw it away anyway. You could attempt to read it using the FileReader API or a canvas tag, but then you start running into CORS issues again.
Nov 22, 2019 at 15:10	comment	added	mti2935		Excellent answer by Conor, as usual. I wonder what (if anything) would stop the router attack described in this answer, if the URL was used in an `img` tag , like so: `<img src=http://admin:[email protected]/enable_remote_admin_access>`, being that same-origin policy does not apply to `img` tags.
Nov 22, 2019 at 13:28	history	edited	Conor Mancone	CC BY-SA 4.0	added 574 characters in body
Nov 22, 2019 at 9:05	comment	added	EdC		Great answer, Might also want to mention DNS rebinding which allows an attacker to put local addresses in the same origin so remove the protection of SOP en.m.wikipedia.org/wiki/DNS_rebinding
Nov 22, 2019 at 3:20	history	edited	Conor Mancone	CC BY-SA 4.0	added 893 characters in body
Nov 21, 2019 at 22:01	history	edited	Steve Sether	CC BY-SA 4.0	I think on a Q/A site we should always try to define any non-common acronyms before using the acronym.
Nov 21, 2019 at 21:22	history	answered	Conor Mancone	CC BY-SA 4.0