4 ms·
Most of the time it is just a banal shenanigans of strtoint conversions and how exactly the dotted decimal parser was written. > for complicated parsing Somew
by justsomehnguy 4y ago
Most of the time it is just a banal shenanigans of strtoint conversions and how exactly the dotted decimal parser was written.
> for complicated parsing
Somewhat
> numerous exploits.
Nah. It's mostly localized to a string to hostname processing, ie it never occurs in the network stack and happens on the user'side of things and permissions (think CLI and interpreted languges)
- billyhoffman 4y agonot exploits of the OS, but I've used this to exploit web applications quite a bit. Tricks like these get your past a lot of input filters or validation logic. This allows me to trick these apps into making HTTP requests to internal or private IPs/hosts. As an example, think of a cloud based web performance monitoring system. I trick it into making HTTP requests to 169.254.169.254, and I get access to data from their AWS metadata service...
- justsomehnguy 4y agoYep. Skipped this part (not at "he desktop RN) but honestly this is more in 'check what you accept' and input data validation|sanitation. Still a valid target for an exploit but you really need a bunch of things ('web performance monitoring system') to happen before you can have a meaningful usage (if at all) from these exploits.