Follow

You thought you know IPv4 addresses? Let me tell you something:

YOU PROBABLY DON'T!

RT @0xInfection@twitter.com

I learnt today that IP addresses can be shortened by dropping the zeroes.
Examples:
http://1.0.0.1 β†’ http://1.1
http://192.168.0.1 β†’ http://192.168.1
This bypasses WAF filters for SSRF, open-redirect, etc where any IP as input gets blacklisted.

πŸ¦πŸ”—: twitter.com/0xInfection/status

And to be clear, I didn't. πŸ˜„πŸ™ƒ

@markush boost without testing myself. Please validate if you can my tootlings.

@Bobo_PK @markush easy to validate:

$ ping 127.1

Also, BTW; did you know that #localhost IP is actually a /8 subnet, i.e. 127.0.0.1/8.

So you can e.g. ping 127.127 and will still get localhost.

@kity @jamey @Bobo_PK @markush *this* number thing is a thing you need to explain to me… πŸ€”

@rugk @kity @Bobo_PK @markush haha, yes... that is the decimal version of the IPv4 address if it's treated as a 32-bit number. That particular one is 127 * 224 + 1, or 127.0.0.1. 😁

@rugk @kity @Bobo_PK @markush um, apparently turning on markdown formatting for my toots makes math hard. if it wasn't clear, that's 2 to the 24th, not 224...

@markush @Bobo_PK
wouldn't be 1.0.1.1 == 1.1.0.1
aka 1.1.1 == 1.1.1
looks odd

@otherpaco @markush @Bobo_PK My thoughts exactly, they would get ambiguous. There might be some weird precedence rules and restrictions that make it possible though. I haven't looked at the relevant RFCs.

@murks @otherpaco @markush @Bobo_PK the zeroes will always be filled from behind. So 1.1.1 will always be 1.1.0.1.
Or 9.9.9 will be 9.9.0.9

@markush If I shorten 1.0.1.1 to 1.1.1, how does the sytem know that I'm not actually meaning 1.1.0.1?

@markush This is not really dropping of zeros, it's more an application of alternative forms of writing them. The form we all know is octet.octet.octet.octet, but octet.octet.16bits, octet.24bits and 32bits have also been in use (see <tools.ietf.org/html/draft-main>). Try `ping 5.9.37744` ...

Sign in to participate in the conversation
chaos.social

chaos.social - because anarchy is much more fun with friends.
chaos.social is a small Mastodon instance for and by the Chaos community surrounding the Chaos Computer Club. We provide a small community space - Be excellent to each other, and have a look at what that means around here.
Follow @ordnung for low-traffic instance-related updates.
The primary instance languages are German and English.