Cenzic 232 Patent
Paid Advertising
web application security lab

XML Intranet Port Scanning

I saw this post from SIFT yesterday and I thought it was definitely worth posting. It’s regarding using XML parsers to do intranet port scanning. Pretty cool stuff! However, unlike the JavaScript port scanning it is not as indescriminant - relying on the server accepting XML inputs.

This is a different take on the same exploit though - using internal devices against themselves. I guess the mitigating factor here is that production machines, and machines of any value should be isolated so they cannot be accessed without special permission (login authentication or otherwise). It’s not 100% foolproof, as lots of applications need to talk with one another concurrently. Still, interesting stuff coming from SIFT.

Comments are closed.