Port scanning in ActionScript 3.0 without DNS rebinding

Không cần DNS Rebinding vẫn có thể scan port bằng ActionScript 3.0:

In AS3 Adobe introduced a new socket-related event called SecurityErrorEvent. This event is always thrown when a Flash Player tries to connect to a socket that it is not allowed to connect to.

The Problem with the SecurityErrorEvent is that it's thrown immediately when a Flash Player tries to connect to a closed TCP port. If a service is listening on that port the Flash Player writes the string "" and waits for response from the service. Nearly no TCP-service will respond to this request.

We can assume the following: When trying to connect to a socket that the SWF is not allowed to and it doesn't get a SecurityErrorEvent within 2 seconds the port is most likely open.

A new Flash player instance is used for every probed port because the Flash Player sends only one policy-file request per player per host per port.