4 ms·
> leaking the internal IP isn't bad at all -- especially since there is no way to correlate them with the customer. You seem to be making many assumptions here
by forgotmypw 8y ago
> leaking the internal IP isn't bad at all -- especially since there is no way to correlate them with the customer.
You seem to be making many assumptions here, which some may not agree with.
- freedomben 8y agoAgreed. While the secrecy of IPs should never be relied on as a security mechanism, keeping them secret can force the attacker to use a scan, which can trigger IDS and tip their hand. If the attack is going through a proxy host (a vulnerable app server proxying an attack at the database for example), an unknown DB IP address could make the attack infeasible.
- hackmiester 8y agoI was just about to bring this up. Do none of the customers use public addresses internally? My employer does. And, as far as I know, everyone who runs IPv6 does.