I came across this article that have some disturbing facts about using websockets from javascript in the browser for port scanning your machine.

The author discovered this after reading another article about why Ebay is port scanning localhost via websockets.

So this made him wondering how far he could go, and he starts with this question:

This got me thinking. I know that popular JavaScript frameworks use websockets in development to automatically reload pages when content changes. Could a malicious website eaves-drop on that traffic, and find out when developers are saving their code?

The reality was slightly worse than I had thought.

And then finds this disturbing facts:

But what happens when the developer makes a typo? The webpack dev server helpfully tries to send a bunch of debugging and stack information to the developer’s screen, by way of its websocket connection.

Now things are getting juicy. We’ve got code snippets, paths to files, locations, all sorts of bits of useful info.

It gets even better if eventually the Dev accidentally typos on a line containing useful data:

Now we’ve got a copy of this developer’s AWS Dev credentials. Quick, fire up the bitcoin miners!

What are your thoughts on this? Did you ever imagine that this could get so far?

I really need to do a POC of attacking Phoenix WebSockets, because more I read about them, more concerned I get with using them.