Collected research

JavaScript Portscanning and bypassing HTTP Auth

JavaScript/HTML Portscanning and HTTP Auth

Stefan Esser · blog.php-security.org

Stefan Esser's follow-up to the JavaScript-free HTML portscanning of late 2006: request a URL the server must reject before authentication runs, such as http://192.168.1.1/% or an over-long path, and the HTTP auth prompt that betrayed earlier scanners never appears. Tested against Apache, IIS and home routers; IE7 refuses the % form but the long-URL form works everywhere.

Record

Document

JavaScript/HTML Portscanning and HTTP Auth

Researcher

Stefan Esser

Published by

blog.php-security.org

Topic

HTTP

In the archive

• Collected in the 2006 research round

Tags

• timing-attack
• side-channel
• javascript
• http
• url-parsing
• detection
• owasp-a09-2021

This page is the archive's own catalogue record. The research is the work of Stefan Esser, first published at the original source. Preserved copies are kept so the citation survives its host; this one was last captured on 9 August 2026.