Collected research

Internal Port Scanning via Crystal Reports

Internal Port Scanning via Crystal Reports « Joshua "Jabra" Abraham

Joshua Abraham · Joshua "Jabra" Abraham · 2 December 2010

SAP BusinessObjects Crystal Reports exposes the backend host and port through user-controlled viewrpt.cwr parameters, defaulting to port 6400. Because open and closed ports return distinguishable errors - FWM 01005 for a reachable socket, FWM 01003 for none - the apstoken parameter becomes a server-side port scanner that maps internal networks without any client interaction.

Record

Document

Internal Port Scanning via Crystal Reports « Joshua "Jabra" Abraham

Researcher

Joshua Abraham

Published by

Joshua "Jabra" Abraham

Date

2 December 2010

Topic

Other

In the archive

• Collected in the 2010 research round

Tags

• ssrf
• info-leak
• large-scale-scan
• detection
• case-study
• vendor-advisory
• owasp-a09-2021
• owasp-a10-2021

This page is the archive's own catalogue record. The research is the work of Joshua Abraham, first published at the original source. Preserved copies are kept so the citation survives its host; this one was last captured on 17 August 2026.