This is a valid ipv4 address

by lcedp • 13 years ago

196 95 13 years ago

184.172.10.74

jloughry2• 13 years ago

The submission is a little misleading; it's traditional on HN to link to an article discussing the principle, rather than simply a demonstration. However, the OP highlights an interesting point. There are other, analogous, unexpected behaviours like this one, such as numeric constants with leading zeros being interpreted as octal, that arise from the ubiquity of the C standard library. You see them in Java all over the place.

Edited to Add:

Don't think good penetration testers (and malware writers, alas) don't already know about this trick. But, as http://xkcd.com/1053/ pointed out, it's always great to teach new people old things.

kalleboo• 13 years ago

Don't think good penetration testers (and malware writers, alas) don't already know about this trick.

This was also a popular trick among kids at my high school to work around the web content filter and get on social networks

serf• 13 years ago

yeah, some years back there was also some C code in an issue of 2600 (or maybe a bash script? I cant remember) that obfuscated URLs in this manner. The article that the script was attached to actually used school URL filtering as the example case use.

sp332• 13 years ago

Yeah I've made a similar post here before and got a few upvotes. https://news.ycombinator.com/item?id=5763739 It's worth noting that the address isn't converted by the browser, but by the network stack.

nwh4• 13 years ago

The decoded URL for this submission is http://184.172.10.74/ — the server for Hacker News.

Here's some other encodings you can use for the same address, they're all valid and recognised by most browsers and other software:

http://3098282570/

http://7393249866/

http://0xb8.0xac.0x0a.0x4a/

http://0270.0254.0012.0112/

The source for this comment is an XSS filtering bypass tool by RSnake — http://ha.ckers.org/xsscalc.html

ColinDabritz2• 13 years ago

I recognize the other formats, but what format is "http://7393249866/"? It opens about:blank in chrome. How is it distinguished from the format above it?

agwa• 13 years ago

7393249866 mod 2^32 is 3098282570. I'm not convinced you can do that - although it works in Firefox, telnet and ping don't like it.

Edit: I highly doubt that this is standard behavior. I suspect that implementations that permit this are storing the number in a 32 bit integer and not checking to see that it was truncated.

tyilo2• 13 years ago

http://7393249866/ doesn't seem to work in chrome as it doesn't believe it's a link. Entering it directly in the URL-bar doesn't work either. All of the others is shown as `184.172.10.74` on mouse-over.

lcedp• 13 years ago

I didn't use bypass tool you've mentioned.

This small ruby script

    #!/usr/bin/ruby
    a, b, c, d = $*[0].split('.').map(&:to_i)
    i = a * 256**3 + b * 256**2 + c * 256 + d
    puts "dec: http://#{i}"
    puts "hex: http://0x#{i.to_s(16)}"
    puts "oct: http://0#{i.to_s(8)}"

..yields the following:

    % ip2dword 184.172.10.74
    dec: http://3098282570
    hex: http://0xb8ac0a4a
    oct: http://027053005112

nwh4• 13 years ago

My apologies, I've removed that line.

Dylan16807• 13 years ago

You can also mix and match octal, decimal, and hex on the different octets.

bdarnell• 13 years ago

More weird formats (which at least work in chrome/mac, and the mac implementation of getaddrinfo()):

http://184.11274826/ http://184.172.2634/

The rule here is that the last (but apparently only the last) numeric component may encode multiple bytes.

phaker• 13 years ago

I use this one all the time:

127.0.0.1 == 127.1

10.0.0.1 == 10.1

192.168.0.1 == 192.168.1

bskap• 13 years ago

Looks like Internet Explorer recognizes them all as the same address (when I hover over the link, it shows the link target in dotted decimal). Chrome does the same thing for 1, 3, and 4 but doesn't like the number > INT_MAX. Firefox thinks they're all different.

bloometal• 13 years ago

Went to RSnake's website and encoded the address of Facebook to post on my wall. Facebook does not let me post it. After 3 or 4 tries, it blocked my account.

Does anyone know why Facebook does that?

icedchai• 13 years ago

Probably because this "trick" is often used by spammers to obfuscate URLs.

somejan• 13 years ago

Funny. http://7393249866/ resolves to http://255.255.255.255/ in Opera (on linux), it appears to do saturating math for the overflow.

Vektorweg• 13 years ago

It works fine in my Opera 12.16 for Linux (amd64).

p4bl0• 13 years ago

Hexa addresses can be in one single number too:

http://0xb8ac0a4a/

thaumasiotes• 13 years ago

What? It's bothered me for years that IP addresses aren't just bitfields. Why would you use a format other than this?

throwawaykf2• 13 years ago

More encodings:

http://[0:0:0:0:0:ffff:b8ac:a4a]

http://asdf:qwerty@3098282570/

http://asdf:qwerty@[0:0:0:0:0:ffff:b8ac:a4a]:80

(Might get a security/phishing warning on the last two links in some browsers.)

icoder2• 13 years ago

No warnings in Chrome

throwawaykf2• 13 years ago

And another way of doing the first one:

http://[0::0:ffff:b8ac:a4a]/

TallboyOne• 13 years ago

I don't follow.

alayne• 13 years ago

It's just the decimal form of a base 256 number with four digits.

delinka• 13 years ago

Or perhaps it's the decimal form of a base 16 number with eight digits.

sebcioz• 13 years ago

How can I encode any ip address?

tzury• 13 years ago

Google for "ip to long"...

tyilo2• 13 years ago

The normal way of displaying the ip address for HN is `184.172.10.74`. You then just have to take each 4 parts and multiply it with a power of 256:

    184 * 256^3 + 172 * 256^2 + 10 * 256^1 + 74 * 256^0 == 3098282570

madmo• 13 years ago

In python: struct.unpack(">I", struct.pack("BBBB", 184, 172, 10, 74))

swatkat• 13 years ago

Dot to decimal/hex/octal format conversion, and vice versa. You can use online tools like these:

http://www.kloth.net/services/iplocate.php

rachelbythebay2• 13 years ago

The last time this came up on HN, I decided to dig into ping and glibc's resolver stuff to find out exactly why this worked.

http://rachelbythebay.com/w/2012/10/13/ping/

300bps4• 13 years ago

That article is focused on ping and glibc but the reason why this works is fundamental to IPv4 itself.

All IPv4 address are 32 bit addresses. That's why each number of an IPv4 address that people are familiar with are called octets. They represent 8 bits of the 32 bit address. So if you have 127.0.0.1, then the first octet is 127, the second is 0 and so on.

Any representation of this 32 bit number (including the most familiar A.B.C.D format) is a kind of short-hand for representing that 32 bit number.

I tried finding a link to a particular site that was phenomenal for learning the entire TCP/IP stack but I haven't seen that site since at least 1998.

But basically, if you want to spend time learning about IPv4 right before IPv6 becomes the dominant standard, then look into how hosts use the combination of IP address and subnet mask to determine if something is on the local network, how hosts use ARP to translate a 32 bit IP address into a MAC address and all the other low level protocols.

rachelbythebay2• 13 years ago

No, it works because the tool allows it by virtue of how it's implemented. Find a different ping or inet_aton implementation and it won't necessarily work.

VLM2• 13 years ago

"if you want to spend time learning about IPv4 right before IPv6 becomes the dominant standard"

Not as much is changing as you think, at least for basic concepts and intro level stuff. Simpler in some ways.

To kick over a real bee hive, as I guy who's used ipv6 for I donno a decade or so now, the main issues are NAT6 love it (noobs) or hate it (folks who know what they're doing), believe it or not its easier to make a statefull firewall than to do NAT, some folks have bizarre ideas about ipv6 netmasks and what other people should be permitted to have, the concept of RFC1918 in ipv6 is more complicated, router advertisements RA love them or filter them, you probably need DHCPv6 or maybe not, and some firewall nuts filter DNS traffic into packets too small to hold AAAA records (but large enough to hold A records) Other than that ipv6 is just obese ipv4, the concepts of subnet and mask aren't changing, you've still got ARP just different address family in the protocol...

(edited to add my favorite topic, hand editing text zone files is probably not the most scalable way to implement reverse (or forward!) DNS for ipv6 from pure PITA perspective. Then again doing things by hand instead of automating is a PITA for ipv4 not just ipv6.)

chris_wot• 13 years ago

That's an awesome article! I love reading Rachel's blog. It's almost always interesting.

dreen2• 13 years ago

Guys check out this website at http://0x7f000001 hahaha what an idiot made this, that page is shit!

dreen2• 13 years ago

seriously downvoters? how do you walk with that stick in?

asveikau• 13 years ago

Maybe the downvoters don't get the joke and they think you're insulting their website. :-)

jloughry2• 13 years ago

You made a good point here: I recognised 127.0.0.1 in the value instantly, showing that you can sometimes read this representation by eye, e.g.:

    0x0a000001 = 10.0.0.1
    0xc0a80001 = 192.168.0.1

simcop2387• 13 years ago

That's why i usually like to go with, http://0x7f123456/ same effect but less recognition.

greenyoda• 13 years ago

Interestingly, in Firefox, this works when I type it into the address bar (goes to localhost, as expected), but not when I click on the link.

nmeofthestate• 13 years ago

Someone better fix the title - should be "Hacker News".

cturhan• 13 years ago

is it browser interprets this to IP adress?

lelf• 13 years ago

https://en.wikipedia.org/wiki/IPv4#Address_representations

jcburnham• 13 years ago

In Urbit, 3098282570 is ~lanben-dibnup.

~tomsyt-balsen/try=> `@p`3.098.282.570

~lanben-dibnup

seanalltogether• 13 years ago

It took me awhile to understand what was so significant about the submission. In chrome when I roll over the link i just see 184.172.10.74.

zymhan• 13 years ago

Interesting, when I roll over it in Firefox I see the large number.

sebcat• 13 years ago

This is why it's a good idea to use getaddrinfo and getnameinfo for IP address validation and normalization. While we're at it, use sockaddr's to represent addresses. in6_addr doesn't hold the IPv6 address scope/zone ID.

BigEndian101• 13 years ago

(FIRST_OCTET << 24) + (SECOND_OCTET << 16) + (THIRD_OCTET << 8) + FOURTH_OCTET

andoriyu• 13 years ago

Seriously? IPv4 in long form is top news?

jpswade• 13 years ago

http://php.net/manual/en/function.ip2long.php

http://codepad.org/5ncM6IMS

logn• 13 years ago

Also, this tool is useful, a bi-directional IP-long converter:

http://www.elfqrin.com/LongIP.php

swinglock• 13 years ago

An IPv4 address is a 32 bit number. The 4 octet representation is just meant for humans, it doesn't even look like that in an IPv4 packet header.

scaramanga• 13 years ago

sage

INIT_6• 13 years ago

I first discovered these 10digit decimal formatted IPv4 address about a year ago when testing/analyzing android apps. Created a quick python scripts to convert back and forth.

https://github.com/initiate6/IP_addresses

rmrfrmrf• 13 years ago

The fact that this is 'news' or a 'trick' to some people says a lot about the current state of HN. IP addresses have integer representations by design! Are the commenters here really so removed from actually doing work that they've never seen a database that stores IP addresses as integers? (Hint: ALL of the good ones do). That's to say nothing of the fact that there are clearly many people here who don't understand what binary is.

At least it's good to know that the radical, ridiculous, Reddity mentality that's been plaguing HN as of late is coming from a clearly different group of people than those who used to comment. Looks like it's time to move on to greener pastures.

jmduke• 13 years ago

I haven't been on Hacker News long enough to speak definitively about the current state of HN (a bit less than two years, but I spent the first one lurking), but I would be more concerned about comments that complain about 'HN changing' (as someone who was on Reddit to hear complaints about all the Diggers... then all the 4chaners.. then all the high schoolers..) than content considered 'elementary' to smarter programmers than I.

I notice that you haven't submitted any links. Is there any particular reason why? If you're not pleased with the content on the site, why don't you submit better content?

(For what it's worth: this content is news for me. I never spent much time thinking about IP addresses before clicking the link and getting confused for a solid minute. I understand what binary is, though, I promise!)

escapologybb• 13 years ago

holds up hand

This totally confused me for a minute until I started reading the comments, what on earth does that say about my intellect?!

frets madly

wilg• 13 years ago

Almost all the other comments in this thread are people spreading knowledge about technology. Sure, maybe you already knew it. Maybe things were better "back in the day". People having a genuine interest in stuff like this just really doesn't seem worth bemoaning. Isn't it better to be happy that someone is learning something you're familiar with rather than being upset that they didn't already know it?

Perseids• 13 years ago

Even though I know that IP addresses are just 32 bit of data I find it very interesting that browser support these representations out of the box. There is no reason to and from a security point of view it is even detrimental.

memracom• 13 years ago

An IPv4 address is a 32 bit string of bits. That 32 bit value can be represented in many different ways, but none of those ways are IPv4 addresses. The actual address is that string of 32 bits, and that is what is used in the TCP stack inside your OS or your router.

Leask• 13 years ago

Using this python script to make the int-ip-address:

#!/usr/bin/env python

import socket

import struct

def ip2long(ip):

    packedIP = socket.inet_aton(ip)

    return struct.unpack("!L", packedIP)[0]

print ip2long('192.241.224.102') # your website ip address

# or download it on github: https://gist.github.com/Leask/7075483

d0mine• 13 years ago

Or more straightforward in Python 3.3+:

    import ipaddress

    print(int(ipaddress.ip_address('192.241.224.102')))

16s• 13 years ago

An IPv4 address is a 32 bit integer. It's a number that can be represented in various ways. Been that way for decades now.

X-Cubed• 13 years ago

Interestingly, Chrome shows the dotted address format in the status bar when you hover over the link.

chromano• 13 years ago

How come no one mentioned http://0xdeadbeef ?

geoffpado• 13 years ago

The inverse of this actually bit me when I was porting my company's app from iOS to Windows 8. We have a custom URI scheme to open stories in our app that looks like foo://<int>. On iOS, we just take the bit after the scheme and use it directly. Windows, however, was giving it to us as a dotted-decimal string, so we had to convert back from that to the integer representation before using it. That was the day I learned that these different kinds of representations could be used and to not assume anything about URIs.

lucb1e• 13 years ago

I set a vhost for this years ago, instructing whomever was cool enough to use this URL to e-mail me. Nothing received yet :(

This is a valid ipv4 address

Related Stories