• Home
• Contacts
• Slides

Mozilla port banning

Using a specially crafted HTML page, an attacker can trick a browser displaying this HTML page into accessing SMTP, NNTP, POP3, IRC, or other servers, possibly behind a firewall.

Cert issued a
Vulnerability Note VU#476267
for a "Cross-Protocol" scripting attack, known as the HTML
Form Protocol Attack which allowed sending arbitrary data to most TCP ports.
A simple exploit of this hole allows an attacker to send forged unsigned mail through
a mail server behind your firewall: A really nasty hole.

I found the list of ports blocked by Mozilla here: http://www.mozilla.org/projects/netlib/PortBanning.html

• A browser as web hacking platform
• How to create Firefox extensions
• Useful Firefox Security Extensions

Did you enjoy this post? Why not leave a comment below and continue the conversation, or subscribe to my feed and get articles like this delivered automatically to your feed reader.

© 2003-2009 lonerunners.net