5 ms·
The decoded URL for this submission is http://184.172.10.74/ http://184.172.10.74/ — the server for Hacker News. Here's some other encodings you can use for th
by nwh 13y ago
The decoded URL for this submission is http://184.172.10.74/ http://184.172.10.74/ — the server for Hacker News.
Here's some other encodings you can use for the same address, they're all valid and recognised by most browsers and other software:
http://3098282570/ http://3098282570/
http://7393249866/ http://7393249866/
http://0xb8.0xac.0x0a.0x4a/ http://0xb8.0xac.0x0a.0x4a/
http://0270.0254.0012.0112/ http://0270.0254.0012.0112/
The source for this comment is an XSS filtering bypass tool by RSnake — http://ha.ckers.org/xsscalc.html http://ha.ckers.org/xsscalc.html
- ColinDabritz 13y agoI recognize the other formats, but what format is "http://7393249866/" http://7393249866/"? It opens about:blank in chrome. How is it distinguished from the format above it?
- agwa 13y ago7393249866 mod 2^32 is 3098282570. I'm not convinced you can do that - although it works in Firefox, telnet and ping don't like it. Edit: I highly doubt that this is standard behavior. I suspect that implementations that permit this are storing the number in a 32 bit integer and not checking to see that it was truncated.
- nwh 13y agoping and other command line tools don't mind it for me on OSX, I don't know what the distinction between them would be though. $ ping 7393249866 PING 7393249866 (184.172.10.74): 56 data bytes 64 bytes from 184.172.10.74: icmp_seq=0 ttl=47 time=259.042 ms
- ColinDabritz 13y agoIt seems to work in Safari as well. I sort of understand the dword format, but why would this be useful, or a standard?
- tyilo 13y agohttp://7393249866/ http://7393249866/ doesn't seem to work in chrome as it doesn't believe it's a link. Entering it directly in the URL-bar doesn't work either. All of the others is shown as `184.172.10.74` on mouse-over.
- lcedp 13y agoI didn't use bypass tool you've mentioned. This small ruby script #!/usr/bin/ruby a, b, c, d = $*[0].split('.').map(&:to_i) i = a * 256**3 + b * 256**2 + c * 256 + d puts "dec: http://#{i}" puts "hex: http://0x#{i.to_s(16)}" puts "oct: http://0#{i.to_s(8)}" ..yields the following: % ip2dword 184.172.10.74 dec: http://3098282570 hex: http://0xb8ac0a4a oct: http://027053005112
- nwh 13y agoMy apologies, I've removed that line.
- Dylan16807 13y agoYou can also mix and match octal, decimal, and hex on the different octets.
- bdarnell 13y agoMore weird formats (which at least work in chrome/mac, and the mac implementation of getaddrinfo()): http://184.11274826/ http://184.11274826/ http://184.172.2634/ http://184.172.2634/ The rule here is that the last (but apparently only the last) numeric component may encode multiple bytes.
- phaker 13y agoI use this one all the time: 127.0.0.1 == 127.1 10.0.0.1 == 10.1 192.168.0.1 == 192.168.1
- nwh 13y agoI wasn't aware of that shortcut, that's very useful.
- kbenson 13y agoIt's especially useful for some IPv6 addresses.
- ordinary 13y agoIPv6 has a different representation format, where one (and only one) sequence of fields containing only 0 bytes may be replaced by a single '::', turning '2001:0:0:1:0:2' into '2001::1:0:2'. I never quite understood why they chose to reuse the colon as a separator character, because this is problematic when you want to append a port number. '2001::1:0:2:8080' could either be '2001:0:0:1:0:2 on port 8080', or '2001:0:1:0:2:8080 on the default port'. The following (ugly) syntax is used to resolve that ambiguity: [2001::1:0:2]:8080.
- peterwwillis 13y agoMore IPv6 hackery: When using a link-local address (every interface has a link-local IPv6 address), you can append a zone index to the address in the brackets as routing information of where to send the link local request. For windows it's the interface number, for Unixes it's the interface name. To test this out, first find a link-local address on your network. To find all link-local addresses on eth0, use this command to ping the all-nodes link-local multicast group: ping6 -I eth0 -c 2 ff02::1 Now append the percent sign and zone index to the address and connect to the host on a port that is probably open. lynx https://[fe80::21e:67ff:fe08:d500%eth0]:443/
- bskap 13y agoLooks like Internet Explorer recognizes them all as the same address (when I hover over the link, it shows the link target in dotted decimal). Chrome does the same thing for 1, 3, and 4 but doesn't like the number > INT_MAX. Firefox thinks they're all different.
- bloometal 13y agoWent to RSnake's website and encoded the address of Facebook to post on my wall. Facebook does not let me post it. After 3 or 4 tries, it blocked my account. Does anyone know why Facebook does that?
- icedchai 13y agoProbably because this "trick" is often used by spammers to obfuscate URLs.
- somejan 13y agoFunny. http://7393249866/ http://7393249866/ resolves to http://255.255.255.255/ http://255.255.255.255/ in Opera (on linux), it appears to do saturating math for the overflow.
- p4bl0 13y agoHexa addresses can be in one single number too: http://0xb8ac0a4a/ http://0xb8ac0a4a/
- thaumasiotes 13y agoWhat? It's bothered me for years that IP addresses aren't just bitfields. Why would you use a format other than this?
- zheng 13y ago10.0.0.1 or 0x0a000001? 4.2.2.1 or 0x04020201? Mostly readability and speed of typing, I would think.
- throwawaykf 13y agoMore encodings: http://[0:0:0:0:0:ffff:b8ac:a4a] http://[0:0:0:0:0:ffff:b8ac:a4a] http://asdf:qwerty@3098282570/ http://asdf:qwerty@3098282570/ http://asdf:qwerty@[0:0:0:0:0:ffff:b8ac:a4a]:80 http://asdf:qwerty@[0:0:0:0:0:ffff:b8ac:a4a]:80 (Might get a security/phishing warning on the last two links in some browsers.)
- icoder 13y agoNo warnings in Chrome
- throwawaykf 13y agoAnd another way of doing the first one: http://[0::0:ffff:b8ac:a4a]/ http://[0::0:ffff:b8ac:a4a]/