Hacker News Reader

Comment by ThePhysicist | Hacker News Reader

VcXsrv binds to localhost by default, so unless you already have malware on your system the added risk is quite small I'd say.

View on HN

What about javascript code on a harmfull website that does requests to localhost?

It used to be possible to easily scan what sites are running locally, even if js code was from a public website. [0]

[0] https://defuse.ca/in-browser-port-scanning.htm

A JS based exploit that hijacks the X Window System Core Protocol running on your localhost to inject key presses into your X server or steal screenshots? I mean it's possible, but it seems quite far-fetched except maybe if someone specifically targets you.

The main impediment is that http request won't look anything like the x window requests, so the x server would likely reject it.

There are actually several (published and non-published) ways to exploit that type of configuration, here is one example:

https://samy.pl/slipstream/

If you're talking about the general concept of using js to spoof another protocol: that exploit involves middleboxes sniffing TCP connections at the packet level, rather than at connection/stream level. It certainly won't work for connections with a TCP server.

If you're talking about using that exploit to allow access to the victim's machine from the internet: that won't work because listening interface for the x11 server is localhost, not the LAN interface.

Reply on news.ycombinator.com