Say your local IP address is
That is, it will send every exploit in its database at the device in order to try and compromise it.
Say that the BOB 2000 router has a vulnerability in that its URL
/config/remoteConfigSettings does not implement any sort of authentication checks. As this page is only accessible from your local network, it is not normally vulnerable to internet based attacks.
However, after someone on your network has visited the malicious site, this could try every attack in its database to try and exploit the router at
192.168.1.254, including sending a POST request from the browser with the message body:
As this page is vulnerable, the request causes the WAN side of the router to be available for remote administration and disables the password authentication. The malicious website can report that a device was found to the attacker along with the internet IP for the attacker to log into later either manually, or more likely to add to an IP list for automated exploitation now that remote access is granted. The remote exploitation could include anything from altering DNS settings to an attacker controlled server for a future MITM attack, to malicious firmware updates to the router itself.
As well as checking for known vulnerabilities, the malicious script could also try regular router requests but authenticating with default or commonly used credentials.
Regarding @Ajedi32's comment about the Same Origin Policy - the scanner does not need the router to be in the same origin in order to fingerprint it. It uses a combination of IFrames and image tags to determine whether something and what was loaded and then matches these against known default IPs. From the author's site:
The scanner accesses a IFrame to perform a generic scan of the network
for known default router IP’s, once a connection has been made it then
passes the IP address and performs a lookup of routers/devices based
on that address. The reason I have decided to do this is because I
wanted the scanner to grab as many devices as possible because it will
be impossible to finger print everything.
Once a IP address has been found it passes this to the finger printing
function which uses a image object to make a connection to the device
to see if the finger printing graphic is there.
Via DNS Rebinding
Another possibility not discussed in the linked article is a DNS Rebinding attack. Say the IFrame trick detects something is running on
192.168.1.254 once the victim has visited
evil.example.com. The attacker's detection script then runs a server-side script to rebind the DNS of
192.168.1.254. As the DNS entry has a very short TTL, the browser requeries the name lookup and gets the router address. As the router has default credentials setup, the malicious page can send AJAX requests to read and alter any content on the router's configuration page. This "bypasses" the same origin policy as the router now has the same origin as the malicious site (
This attack would count on the browser timely rechecking DNS. Most browsers have their own DNS cache outside of the Operating System's, and may cache for longer than TTL dictates, hindering this type of attack.