3 ms·
The submission is a little misleading; it's traditional on HN to link to an article discussing the principle, rather than simply a demonstration. However, the O
by jloughry 13y ago
The submission is a little misleading; it's traditional on HN to link to an article discussing the principle, rather than simply a demonstration. However, the OP highlights an interesting point. There are other, analogous, unexpected behaviours like this one, such as numeric constants with leading zeros being interpreted as octal, that arise from the ubiquity of the C standard library. You see them in Java all over the place.
Edited to Add:
Don't think good penetration testers (and malware writers, alas) don't already know about this trick. But, as http://xkcd.com/1053/ http://xkcd.com/1053/ pointed out, it's always great to teach new people old things.
- kalleboo 13y ago> Don't think good penetration testers (and malware writers, alas) don't already know about this trick. This was also a popular trick among kids at my high school to work around the web content filter and get on social networks
- serf 13y agoyeah, some years back there was also some C code in an issue of 2600 (or maybe a bash script? I cant remember) that obfuscated URLs in this manner. The article that the script was attached to actually used school URL filtering as the example case use.
- sp332 13y agoYeah I've made a similar post here before and got a few upvotes. https://news.ycombinator.com/item?id=5763739 https://news.ycombinator.com/item?id=5763739 It's worth noting that the address isn't converted by the browser, but by the network stack.
- deleted 13y ago[deleted]