If a malicious website would scan my local network (via WebRTC) for devices, what could the attacker do it with it? Does it need to be in the same WIFI-Network in order to login to a service? (for example a web based interface to configure your IP home-phone)

I'm asking because I came across this website today: http://webkay.robinlinus.com/ The "Network Scan" feature lets you are scan for devices in your local network. (Worked for me in the latest Google Chrome)


Just a few examples:

  • Detect the type of router and exploit it via CSRF. Then change the DNS settings and thus have man in the middle attack. See this example where millions of DSL routers got hacked.
  • Use CSRF, XSS, DNS rebinding etc to extract information from internal web sites, i.e. internal web mail, company wiki etc.
  • Use the web interface of VoIP phones to make expensive calls or switch on the microphone and listen to whatever happens in the room.
  • Just collect various information which then help to attack specific targets (i.e. intelligence).

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.