[security-alerts] FW: JavaScript get Internal Address (thanks to DanBUK)

["Kazennov, Vladimir" <Vladimir.Kazennov@xxxxxxxxxx>]

> -----Original Message-----
> From: pdp (architect) [mailto:pdp.gnucitizen@xxxxxxxxxxxxxx] 
> Sent: Saturday, August 12, 2006 12:55 PM
> To: full-disclosure@xxxxxxxxxxxxxxxxx; 
> pen-test@xxxxxxxxxxxxxxxxx; webappsec@xxxxxxxxxxxxxxxxx; 
> Daniel Bartlett; bugtraq@xxxxxxxxxxxxxxxxx
> Subject: JavaScript get Internal Address (thanks to DanBUK)
> 
> http://www.gnucitizen.org/projects/javascript-address-info
> http://f-box.org/~dan/jstest.html
> 
> The following technique was brought to me by DanBUK
> (http://f-box.org/~dan/). Dan managed to find the internal IP address
> of the visiting client by establishing a socket between local host and
> the remote web server. Upon success the socket populates its structure
> with all kinds of useful information among some of which are the
> internal IP address and the hostname.
> 
> http://www.gnucitizen.org/projects/javascript-address-info/add
> ressinfo.js
> 
> This technique requires Java, however I think that It should be
> possible to achieve similar result by invoking special ActionScript
> methods from Flash.
> 
> POC can be found on the url above.
> 
> -- 
> pdp (architect)
> http://www.gnucitizen.org
>