What is port scanning?
In computer networking, a “port” is an abstract concept used to identify the network access point for a specific process or service running on a computer. Each port has a unique number, ranging from 0 to 65535, which tells the computer which application to send received data to.
You can think of a computer as a large building, and ports are the room numbers on the doors. Common “room numbers” include: port 80 for HTTP web services, port 443 for HTTPS secure web pages, and port 25 for the SMTP email service. When a data packet arrives at the computer, the system uses the port number to accurately “deliver” it to the corresponding service or application.
What is Port Scanning?
Port scanning involves sending specific data packets to various ports on a target machine and then determining which ports are open or closed based on the responses received. It's like someone going around a building and knocking on every door to see which rooms are occupied and which are empty based on whether someone answers.
Port scanning itself is a neutral technology—network administrators use it to check for system security vulnerabilities, penetration testers use it to assess system defenses, and attackers may use it to find entry points for an intrusion.
How Do Websites Perform Port Scanning in a Browser?
You might find it strange: how can an ordinary webpage scan the ports on your computer? This is achieved by exploiting some of the browser's working mechanisms.
Time-Based Scanning Method
The earliest browser port scanning techniques relied on “timing attacks.” When a webpage sends a request to a certain port via XMLHttpRequest or fetch:
If the port is closed, the browser immediately receives a “connection refused” response, and the request fails quickly
If the port is open, the browser will wait for a response from the server, a process that takes longer
By measuring the response time of the request, the website can infer which ports are open. However, this method is heavily affected by network fluctuations and has limited accuracy.
Iframe-Based Scanning Method
Later, researchers discovered a more reliable technique, primarily targeting the Chrome browser. When Chrome attempts to connect to a closed port, the browser changes the page address to chrome-error://chromewebdata/. By exploiting this feature:
The website creates a hidden iframe and loads the target address (e.g., http://127.0.0.1:8080)
If the port is closed, the iframe's onload event will be triggered twice (because the URL has changed)
If the port is open, the onload event will only be triggered once
By counting the number of times the onload event is triggered, the website can accurately determine if the port is open.
WebSocket-Based Scanning Method
Some tools also use WebSocket connections to probe port status—a successful connection means the port is open, while a failed connection means it is closed.
Why Do Websites Scan Your Ports?
1. Anti-Fraud and Bot Detection
Many large websites (including some government service sites and e-commerce platforms) use port scanning to detect whether a user is a real person. For example, some anti-bot systems will try to connect to 127.0.0.1:8888—the default proxy port for security testing tools like Burp Suite. If this port is found to be open, the system will suspect the visitor might be a security researcher or an automated script, thus triggering additional verification.
2. User Fingerprinting and Tracking
Research shows that browser-based port scan results are unique enough to be used as a means of tracking users. By detecting locally open ports, a website can infer which software the user is running—for example, an open port 80 or 443 might mean the user is running a web server, while an open port 25 could indicate a mail server is running. The combination of software installed by different users varies greatly, creating a unique “software fingerprint.”
More concerning is that studies have shown that even a one-second scan can generate a highly unique port fingerprint. When port scan results are combined with other fingerprinting techniques (such as Canvas fingerprinting, WebGL fingerprinting, etc.), the tracking capability is further enhanced.
3. Probing Internal Network Devices
Most browsers, by default, allow public websites to send requests to private IP addresses (like 127.0.0.1 or 192.168.x.x). This means a malicious website can not only scan the local ports on your computer but also scan the ports of devices on your internal network, such as your router, smart TV, or network camera, to find vulnerable devices to attack.
How to Prevent Browser Port Scanning?
1. Use Browser Extensions
uBlock Origin: In the “Privacy” section of the settings, check the “Block external intrusions into the internal network” option to enable it
NoScript: Provides an option to block LAN access
Some specialized protection plugins can also prevent websites from scanning local ports
2. Use Browsers with Built-in Protection
Some browsers already have built-in port scanning protection. For example, certain browsers actively block known malicious scanning scripts and restrict public websites from accessing local resources. Browsers like Chrome are also gradually implementing the “Private Network Access” specification, which requires websites to obtain user permission before accessing local resources.
3. Use an Anti-Detect Browser
For users with higher privacy needs, anti-detect browsers offer a more comprehensive protection solution. These tools can simulate different port statuses, preventing websites from obtaining real port scan results, thus effectively protecting your device fingerprint privacy.
Summary
Port scanning is a technology that can be used for legitimate security audits but can also be abused for privacy invasion. Understanding its working principles and potential risks is the first step in protecting your online security. As an old saying in the security field goes: “You have to know which of your ‘doors’ are open to know which ones to close.”
You can think of a computer as a large building, and ports are the room numbers on the doors. Common “room numbers” include: port 80 for HTTP web services, port 443 for HTTPS secure web pages, and port 25 for the SMTP email service. When a data packet arrives at the computer, the system uses the port number to accurately “deliver” it to the corresponding service or application.
What is Port Scanning?
Port scanning involves sending specific data packets to various ports on a target machine and then determining which ports are open or closed based on the responses received. It's like someone going around a building and knocking on every door to see which rooms are occupied and which are empty based on whether someone answers.
Port scanning itself is a neutral technology—network administrators use it to check for system security vulnerabilities, penetration testers use it to assess system defenses, and attackers may use it to find entry points for an intrusion.
How Do Websites Perform Port Scanning in a Browser?
You might find it strange: how can an ordinary webpage scan the ports on your computer? This is achieved by exploiting some of the browser's working mechanisms.
Time-Based Scanning Method
The earliest browser port scanning techniques relied on “timing attacks.” When a webpage sends a request to a certain port via XMLHttpRequest or fetch:
If the port is closed, the browser immediately receives a “connection refused” response, and the request fails quickly
If the port is open, the browser will wait for a response from the server, a process that takes longer
By measuring the response time of the request, the website can infer which ports are open. However, this method is heavily affected by network fluctuations and has limited accuracy.
Iframe-Based Scanning Method
Later, researchers discovered a more reliable technique, primarily targeting the Chrome browser. When Chrome attempts to connect to a closed port, the browser changes the page address to chrome-error://chromewebdata/. By exploiting this feature:
The website creates a hidden iframe and loads the target address (e.g., http://127.0.0.1:8080)
If the port is closed, the iframe's onload event will be triggered twice (because the URL has changed)
If the port is open, the onload event will only be triggered once
By counting the number of times the onload event is triggered, the website can accurately determine if the port is open.
WebSocket-Based Scanning Method
Some tools also use WebSocket connections to probe port status—a successful connection means the port is open, while a failed connection means it is closed.
Why Do Websites Scan Your Ports?
1. Anti-Fraud and Bot Detection
Many large websites (including some government service sites and e-commerce platforms) use port scanning to detect whether a user is a real person. For example, some anti-bot systems will try to connect to 127.0.0.1:8888—the default proxy port for security testing tools like Burp Suite. If this port is found to be open, the system will suspect the visitor might be a security researcher or an automated script, thus triggering additional verification.
2. User Fingerprinting and Tracking
Research shows that browser-based port scan results are unique enough to be used as a means of tracking users. By detecting locally open ports, a website can infer which software the user is running—for example, an open port 80 or 443 might mean the user is running a web server, while an open port 25 could indicate a mail server is running. The combination of software installed by different users varies greatly, creating a unique “software fingerprint.”
More concerning is that studies have shown that even a one-second scan can generate a highly unique port fingerprint. When port scan results are combined with other fingerprinting techniques (such as Canvas fingerprinting, WebGL fingerprinting, etc.), the tracking capability is further enhanced.
3. Probing Internal Network Devices
Most browsers, by default, allow public websites to send requests to private IP addresses (like 127.0.0.1 or 192.168.x.x). This means a malicious website can not only scan the local ports on your computer but also scan the ports of devices on your internal network, such as your router, smart TV, or network camera, to find vulnerable devices to attack.
How to Prevent Browser Port Scanning?
1. Use Browser Extensions
uBlock Origin: In the “Privacy” section of the settings, check the “Block external intrusions into the internal network” option to enable it
NoScript: Provides an option to block LAN access
Some specialized protection plugins can also prevent websites from scanning local ports
2. Use Browsers with Built-in Protection
Some browsers already have built-in port scanning protection. For example, certain browsers actively block known malicious scanning scripts and restrict public websites from accessing local resources. Browsers like Chrome are also gradually implementing the “Private Network Access” specification, which requires websites to obtain user permission before accessing local resources.
3. Use an Anti-Detect Browser
For users with higher privacy needs, anti-detect browsers offer a more comprehensive protection solution. These tools can simulate different port statuses, preventing websites from obtaining real port scan results, thus effectively protecting your device fingerprint privacy.
Summary
Port scanning is a technology that can be used for legitimate security audits but can also be abused for privacy invasion. Understanding its working principles and potential risks is the first step in protecting your online security. As an old saying in the security field goes: “You have to know which of your ‘doors’ are open to know which ones to close.”