←back to thread

I can see your local web servers

(http.jameshfisher.com)
652 points jamesfisher | 2 comments | 28 May 19 07:57 UTC | HN request time: 0.573s | source
Show context
founderling ◴[28 May 19 08:58 UTC] No.20028376[source]▶
I started a local webserver listening on localhost:80 just to see what happens, but this thing seems to not detect it. It shows me "Scanning localhost ... localhost complete."

Edit: My guess is that this thing can only detect servers that send a CORS header that permits cross domain access.

It could probably do way better detection if it did not do xhr requests but added script/css/whatever elements to its own page pointing to localhost and detects if those error out.

replies(5): >>20028381 #>>20028422 #>>20028443 #>>20034079 #>>20036964 #
ratsimihah ◴[28 May 19 08:59 UTC] No.20028381[source]▶
It's not that it doesn't detect it, but it's not open to external networks, which I guess is a good thing.
replies(1): >>20028388 #
1. founderling ◴[28 May 19 09:02 UTC] No.20028388[source]▶
What do you mean?
replies(1): >>20028419 #
2. timvisee ◴[28 May 19 09:09 UTC] No.20028419[source]▶
Probably that your browser is blocking access to the local domain, from the context of an external domain. I'm just guessing here, of course.