{"id":37112,"date":"2019-10-31T22:15:49","date_gmt":"2019-10-31T19:15:49","guid":{"rendered":"https:\/\/prohoster.info\/blog\/http-zagolovok-alt-svc-mozhet-primenyatsya-dlya-skanirovaniya-portov-vnutrennej-seti\/"},"modified":"2019-10-31T22:15:49","modified_gmt":"2019-10-31T19:15:49","slug":"http-zagolovok-alt-svc-mozhet-primenyatsya-dlya-skanirovaniya-portov-vnutrennej-seti","status":"publish","type":"post","link":"https:\/\/prohoster.info\/en\/blog\/news\/http-zagolovok-alt-svc-mozhet-primenyatsya-dlya-skanirovaniya-portov-vnutrennej-seti","title":{"rendered":"The Alt-Svc HTTP header can be used for scanning ports in an internal network.","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Researchers from Boston University developed<\/a><\/noindex> attack method
\n(CVE-2019-11728), has been added<\/a><\/noindex> to conduct scanning of IP addresses and open network ports in a user's internal network, shielded from the external network by a firewall, or on the current system (localhost). An attack can be carried out by opening a specially crafted page in the browser. The proposed technique is based on the use of the HTTP header Alt-Svc<\/a><\/noindex> (HTTP Alternate Services, RFC-7838<\/a><\/noindex>). The issue manifests in Firefox, Chrome, and browsers based on their engines, including Tor Browser and Brave.<\/p>\n

The Alt-Svc header allows the server to specify an alternative way to connect to the site and instructs the browser to redirect the request to a new host, for example, for load balancing. It is also possible to specify a network port for tunneling, such as specifying 'Alt-Svc: http\/1.1=\"other.example.com:443\"; ma=200' instructs the client to connect to the host other.example.org using network port 443 and the HTTP\/1.1 protocol to retrieve the requested page. The 'ma' parameter sets the maximum duration for the redirect. In addition to HTTP\/1.1, supported protocols include HTTP\/2-over-TLS (h2), HTTP\/2-over plain text (h2c), SPDY (spdy), and QUIC (quic), which uses UDP.<\/p>\n

\"The<\/center><\/p>\n

To scan addresses, the attacker's site can sequentially test addresses and network ports of interest in the internal network, using the delay between successive requests as an indicator.
\nIf the redirected resource is unavailable, the browser instantly receives a RST packet in response and marks the alternative service as unavailable while clearing the time-to-live set in the request.
\nIf the network port is open, it takes longer to complete the connection (a connection attempt will be made with the corresponding packet exchange), and the browser will not respond instantly. <\/p>\n

To obtain information about the check, the attacker can immediately redirect the user to a second page that refers, in the Alt-Svc header, to an active host of the attacker. If the client's browser sends a request to this page, it can be concluded that the first Alt-Svc request redirection has been canceled and the checked host and port are unavailable. If there is no request, then the data from the first redirection has not yet expired, and the connection was established. <\/p>\n

The specified method also allows checking network ports that are blacklisted by the browser, such as mail server ports. The attack is set up using an iframe substitution in the victim's traffic and employing the HTTP\/2 protocol in Alt-Svc for Firefox and QUIC for scanning UDP ports in Chrome. The attack cannot be applied in the context of the internal network and localhost in Tor Browser, but it is suitable for organizing covert scanning of external hosts through the Tor exit node. The issue of port scanning already has been closed<\/a><\/noindex> exists in Firefox 68.<\/p>\n

The Alt-Svc header can also be applied:<\/p>\n