Exposing Intranets with reliable Browser-based Port scanning
Summary: PortSwigger researcher Gareth Heyes published a technique on 9 November 2018 for port scanning from the internet zone into the intranet zone using JavaScript iframe onload events, which he describes as more reliable than the earlier timing-based scanners from Jeremiah Grossman and Berend Jan Wever. The method exploits browser differences: Chrome fires an onload event even for a refused connection and changes the URL to chrome-error://chromewebdata/, Firefox fires onload only for valid web servers, and Edge behaves opposite to Chrome, with the Firefox version using a pool of 1000 iframes and able to detect services such as Redis servers.
What's compelling: A browser rendering user-supplied content in a restricted environment can be turned into a scanner that maps internal hosts and web servers, and the Firefox variant can even identify non-web services like Redis - so the browser your users already run is the foothold.
Read the original at PortSwigger Research ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026