0

I don’t understand exactly the difference between websites using exploit kits on visiting users vs. a website server probing a network for vulnerabilities and then exploiting them.

The scenario is where a Windows user visits a malicious website, and he has a home network with vulnerable devices of different OS on each: Windows, Mac, Linux, Android, iPhone.

From what I understand, a script can run on the website executing an exploit kit. Can it only exploit browser vulnerabilities of that Windows device? Another attack vector the website could use, since it’s server knows the IP address of the visitor, is to probe the ports of his network for vulnerabilities. Given enough time, it will find vulnerabilities in services from all the devices. It can then use exploit kits on any device on the network.

Am I understanding these two different attacks correctly?

2
  • This assumes that the server has direct access to the network from the Internet. Do you mean to make that assumption?
    – schroeder
    Mar 18, 2023 at 23:31
  • @schroeder, I’m not sure exactly what direct access would mean in this case. The website server knows the IP address of the network because the user who visited the website is on the same network and therefore the IP is given. There is a router firewall in place. Mar 18, 2023 at 23:44

1 Answer 1

0

Exploit kits, just as all website code, is downloaded to the browser and executed there. If there is a vulnerability in the browser, an exploit kit can attack the specific vulnerabilities that it is designed to find and exploit. The attack is essentially run locally on the browser.

Your "network probe" scenario is completely different. You are imagining that the server learns the IP of the network. With this IP, it sends probes completely independently of the device and browser that visited the site. If it finds a vulnerable service from that probe, then exploits can be delivered to those vulnerable services.

However, since most networks have some kind of firewall, the firewall would have to allow the probes and the attack traffic. These are remote attacks on public-facing services.

So these are completely different attacks with different approaches and requirements.

7
  • I want to make sure I understand this. Exploit kits are executed in the browser of the person visiting the malicious website, and they can only exploit vulnerabilities in the browser, nothing else. If the website knows the IP of the network (because the user’s device has that IP), network probing can scan for vulnerabilities of public facing services on all devices. The only thing I don’t understand now is how does a router firewall decide when to allow/block network probing and exploit attack traffic? And what this means is, essentially a visit to one website can put other devices at risk? Mar 19, 2023 at 1:49
  • I think you need more of an understanding of networking and how firewalls and how NAT works. But this is beyond what you have actually asked. A network, like a home network, has one public IP. That IP is assigned to the router. So, the external scanner scans the router's firewall. If the firewall is configured to allow incoming connections, then what's been exposed through that configuration could get scanned. Look up "NAT firewalls".
    – schroeder
    Mar 19, 2023 at 11:48
  • Thanks for pointing me in the right direction, I will research more. If you could give a quick answer to this, I would appreciate it. My understanding about firewalls, is that they reject incoming traffic that hasn’t been initiated from the router, except for certain ports that are configured to be open to the internet. But my worry is, say if there’s a stalker who’s plan is to gain a foothold in the home network, to at least hack one device and leave a backdoor for instance. Mar 19, 2023 at 18:48
  • His plan might be something like: Spoof phone number of friend with a link that looks harmless. Once link is visited, then execute exploit kit. If exploit kit execution leads to nothing because browser is patched, probe network of the IP address that visited the link. If any vulnerabilities are found, use appropriate exploit kit for that OS. Then send malware to device, etc. Mar 19, 2023 at 18:48
  • Now, is it even possible to probe the network? It seems to me, it will only happen as long as the server of the website is being visited by the user, because there is a port connection established. But once the user leaves the website, the server cannot probe the network anymore or send exploit traffic because the router has closed the connection. Is this correct? Or is this something I need to worry about? Mar 19, 2023 at 18:49

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .