Collected research

Browser Port Scanning without JavaScript

Jeremiah Grossman · Jeremiah Grossman · 28 November 2006

Intranet port scanning with HTML alone. A link rel=stylesheet pointing at an internal address stalls Firefox's parser until the request resolves; a following img src to the attacker's timing script reports how long that took, separating live hosts from timeouts. Iframes fork the connections. Updates credit Ilia Alshanetsky's multipart/x-mixed-replace refinement and RSnake's follow-ups.

Record

Researcher

Jeremiah Grossman

Published by

Jeremiah Grossman

Date

28 November 2006

Topic

Browser

In the archive

• Collected in the 2006 research round
• Ranked #10 in the 2007 Top 10 Web Hacking Techniques

Tags

• timing-attack
• side-channel
• detection
• css
• iframe
• info-leak
• owasp-a09-2021

This page is the archive's own catalogue record. The research is the work of Jeremiah Grossman, first published at the original source. Preserved copies are kept so the citation survives its host; this one was last captured on 10 September 2026.