Port Scanning with WebSockets

Viewed 1612

Recently a post was featured in Hacker News about websites abusing WebSockets to find open ports on the client's machine.

The post does not go into any details, so I decided give it a try.

I opened a web server on port 8080 and tried running this script in Chrome's console:

function test(port) {
  try {
    var start = performance.now();
    var socket = new WebSocket('ws://localhost:' + port);

    socket.onerror = function (event) {
      console.log('error', performance.now() - start, event);
    }

    socket.addEventListener('close', function(event) {
      console.log('close', performance.now() - start, event);
    })

    socket.addEventListener('open', function (event) {
      console.log('open', performance.now() - start, event);
      socket.send('Hello Server!');
    });

    socket.addEventListener('message', function (event) {
        console.log('message ', performance.now() - start, event);
    });
  } catch(ex) {
      console.log(ex) 
  }
}

Indeed Chrome logs different a error message (ERR_CONNECTION_REFUSED) when I try to connect to a port that is not open:

test(8081)
VM1886:3 WebSocket connection to 'ws://127.0.0.1:8081/' failed: Error in connection establishment: net::ERR_CONNECTION_REFUSED

And when I try to connect to a port that is open but is not listening to WebSockets (Unexpected response code: 200):

test(8080)
WebSocket connection to 'ws://127.0.0.1:8080/' failed: Error during WebSocket handshake: Unexpected response code: 200

But I can't find any way to access and read these errors in JavaScript.

Control flow does not reach the catch clause catch(ex) { console.log(ex) } and the event objects that Chrome passes to socket.onerror do not seem to be any different whether the port is open or not.

Timing attacks also don't seem to be helping at least in Chrome. Delta time between onerror and new Socket() creation seems to increase after calling test(...) a few times.

So is there actually a way for a web page to determine if a port is open on my computer?

2 Answers
Related