Do you have any more information on the local network scanning?
back
2 comments
Not sure if this is what grandparent is referring to, but DNS rebinding[0] is what springs to mind.
It's simultaneously kind of smart and also really stupid. Basically, you give a valid 3rd-party domain multiple IPs, one of them normal and one of them resolving to a local IP. Then you cut off the normal one and the browser just allows you to make calls to whatever local interface you want.
There was a good defcon video about this a while back[1]. It's a much bigger problem than most people realize. This is why it's good practice to have at least some security around devices even if they're only connected to your LAN.
[0]: https://www.twistlock.com/2018/02/28/dear-developers-beware-...
Here is an example. Start at https://mycloud.com/setup.
Load the web inspector, find and read scanner.js. The Javascript isn't minimized and there are some comments.