Home > Resources > Whitepapers > Attacking the internal network from the public Internet using a browser as a proxy

Attacking the internal network from the public Internet using a browser as a proxy

March 19, 2019

At Forcepoint we continually seek to improve the protection our products provide. To this end, we often investigate unusual or potentially novel attack techniques. One such recent topic of research has been attacks against localhost and the internal network, launched from the public Internet. Though not a new attack, it is not widely known outside of the security research community that a malicious JavaScript can attack the internal network. Of the limited documentation that exists on this topic, most resources describe it in terms of inter-protocol exploitation [1] [2], whereas our focus is on intra-protocol exploitation.

Spotlight

Aprimo

Aprimo provides technology solutions for content, operations, and performance that enable enterprises to optimize their brand experiences and the resources they use to deliver them. Our platform gives enterprises the advantage by streamlining and governing all the behind-the-scenes activities – from ideation to distribution – involved in delivering exceptional brand experiences.

OTHER WHITEPAPERS

Best Practices for Row Level Security in Tableau with Entitlements Tables

whitePaper | January 18, 2023

Row Level Security (RLS) in Tableau refers to restricting the rows of data a certain user can see in a given workbook or data source at the time they view the data. It contrasts with permissions within Tableau Server (or Tableau Online), which are used to control access to content and feature functionality.

Systemic Cybersecurity Risk and role of the Global Community: Managing the Unmanageable

whitePaper | November 29, 2022

In February 2022, a cyberattack on commercial satellite services in Ukraine caused electricitygenerating wind farms to shut down across Central Europe. In July 2021, supermarkets in Sweden were forced to close their doors after a cyberattack on an IT services provider based in Florida, USA.

Cyber Security After the Pandemic

whitePaper | April 29, 2021

The cyber security industry has faced two major sets of challenges over the last twelve months. The attacks and exploits affecting Solar Winds, Accellion, Microsoft and their customers have focused attention on supply chain risk, but the impact of the coronavirus pandemic has been felt more broadly across cyber security domains and disciplines.

Warring State - China's cybersecurity strategy

whitePaper | December 1, 2019

Cyberspace and information technology have enabled the economic, political, and cultural inte - gration of the United States and China. However, interdependence creates costs as well as benefits. Increased interconnection has also contributed to major obstacles in the bilateral relationship, generating mutual distrust of incentives, actions, and norms in cyberspace. Information technology raises new challenges for states by allowing actors to exploit networks, conduct cyber espionage, or compromise national security with greater ease.

The State of Zero Trust Security 2022

whitePaper | September 27, 2022

The philosophy of Zero Trust security—“never trust; always verify”—has certainly struck a chord. It took decades for organizations to move past the basic castle andmoat security mindset, and to accept that in a cloud world, there is no perimeter to defend, and intruders are always on our networks.

Attacking the internal network from the public Internet using a browser as a proxy