Collected research

Exposing Intranets with reliable Browser-based Port scanning

Gareth Heyes · PortSwigger Research · 9 November 2018

A browser-based port scanner that is reliable rather than timing-based: a hidden iframe loads a target host and port, then the same URL is clicked again with a hash appended and onload events are counted. A refused port makes Chrome rewrite the URL to chrome-error, giving a second onload, so any web page can enumerate intranet services; Firefox and Edge variants are given.

Record

Researcher

Gareth Heyes

Published by

PortSwigger Research

Date

9 November 2018

Topic

Browser

In the archive

• Collected in the 2018 research round

Related sources

• Browser port-scanner proof of concept

Tags

• info-leak
• iframe
• side-channel
• sop-bypass
• javascript
• tooling
• owasp-a01-2021

This page is the archive's own catalogue record. The research is the work of Gareth Heyes, first published at the original source. Preserved copies are kept so the citation survives its host; this one was last captured on 11 August 2026.