Collected research

Canadian Beacon

#HackerKast 14 Bonus Round: Canadian Beacon - JavaScript Beacon and Performance APIs

Demonstrates JavaScript port scanning of a visitor's internal network from an ordinary web page, using the Beacon and performance timing APIs against hidden iframes in place of the old iframe onload trick. A hostile page can enumerate live hosts and open ports on RFC1918 addresses behind the browser.

Record

Document

#HackerKast 14 Bonus Round: Canadian Beacon - JavaScript Beacon and Performance APIs

Published by

WhiteHat Security

Topic

Other

In the archive

• Collected in the 2014 research round

Tags

• timing-attack
• side-channel
• javascript
• iframe
• info-leak
• prior-art-extension

This page is the archive's own catalogue record. The research is the work of WhiteHat Security, first published at the original source. Preserved copies are kept so the citation survives its host; this one was last captured on 9 August 2026.