How would any route resolver know which octet(s) are missing?
I learnt today that IP addresses can be shortened by dropping the zeroes.
Examples:
http://1.0.0.1 → http://1.1
http://192.168.0.1 → http://192.168.1
This bypasses WAF filters for SSRF, open-redirect, etc where any IP as input gets blacklisted.
#infosec #bugbounty #bugbountytippic.twitter.com/2zcrLCmq0R
-
-
-
Alright lets take up an IP as 1.1.1, just for example. Now your question is how does it know whether to get routed to 1.1.0.1 or 1.1.1.0?
- Još 6 drugih odgovora
Novi razgovor -
-
-
Even better: http://0xC0A80001 or http://3232235521 => 192.168.0.1. Works with ping and others too. sipcalc is your friend.
-
You can also utilize overflow ;) 192.168.257 => 192.168.1.1, or 192.168.516 => 192.168.2.4
- Još 1 odgovor
Novi razgovor -
-
-
What are the rules for where to put the zeros? Why does 192.168.1 expand to 192.168.0.1 and not 192.168.1.0, or 192.0.168.1, or 0.192.168.1?
-
Here is your answer ^_^https://twitter.com/0xInfection/status/1148406976449138688 …
Kraj razgovora
Novi razgovor -
-
-
Using magic numbers is fun as well: https://stuff-things.net/2014/09/25/magic-ip-address-shortcuts/ … // 127.0.0.1 (127<<24) + (0<<16) + (0<<8) + 1 => 2130706433
-
For us PowerShell nerds: (127 -shl 24) + 1 => 2130706433
- Još 1 odgovor
Novi razgovor -
-
-
Hvala. Twitter će to iskoristiti za poboljšanje vaše vremenske crte. PoništiPoništi
-
-
-
Hey dude, I recommend you look into
@WebSecAcademy's SSRF challenges, many waf bypass tricks and tips. Great fun.Hvala. Twitter će to iskoristiti za poboljšanje vaše vremenske crte. PoništiPoništi
-
Čini se da učitavanje traje već neko vrijeme.
Twitter je možda preopterećen ili ima kratkotrajnih poteškoća u radu. Pokušajte ponovno ili potražite dodatne informacije u odjeljku Status Twittera.