Dotless IP addresses and URL Obfuscation

We use `nslookup' to determine the IP adress of the domain:

HOLYBITCH# nslookup buha.info
Server:  router
Address:  10.0.0.100

Name:    buha.info
Address:  212.227.76.118

The easiest way to get a dotless ip address is to convert each octet to hex, to concat all hex numbers and to turn the whole number into decimal again.

  212  227   76  118
    |    |    |    |  Hex
   D4   E3   4C   76

=> http://0xD4E34C76/

=> http://3571666038/

At this point we are able to add multiples of 2 ^ 32 (4294967296) without changing the destination of the address.

=> http://7866633334/

=> http://12161600630/

and so on..

Naturally we always can convert the decimal number into a hexadecimal number:

> 12161600630 -> 2D4E34C76

=> http://0x2D4E34C76/

Another method to get a dotless ip address is following:

> 212.227.76.118

 212  256 + 227 = $1
  $1  256 + 76 = $2
  $2  256 + 118 = dotless ip address

      212  256 + 227 = 54499
    54499  256 +  76 = 13951820
 13951820  256 + 118 = 3571666038

=> http://3571666038/

Further URL obfuscation tricks:

It'a also possible to convert each octet of a "dotted decimal number" ip address to a different number system..

> 212.227.76.118

  212  227   76  118
   |    |     |    |  Hex
   D4   E3   4C   76
   |    |     |    |  Octal
  324  343  114  166

=> http://0xD4.0xE3.0x4C.0x76/

=> http://0324.0343.0114.0166/

Add leading zeros:

=> http://0x0000D4.0xE3.0x00004C.0x076/

=> http://00000000324.000343.000114.0166/

We can combine the different octets too:

=> http://0324.0xE3.0x4C.118/

=> http://212.00000343.0x4C.0166/

Each char or number in an IP adress or domain respectively absolute path of an URL (see the RFC 2396: URI scheme) could be encoded with a percent sign and a hexadecimal number.

   b   u   h   a   .   i   n   f   o
  %62 %75 %68 %61 %2E %69 %6E %66 %6F

buha.info -> http://%62%75%68%61%2E%69%6E%66%6F

   b   o   a   r   d
  %62 %6F %61 %72 %64

buha.info/board/ ->
http://%62%75%68%61%2E%69%6E%66%6F/%62%6F%61%72%64

Or we encode numbers of an IP address with hex characters:

   2   1   2   .   2   2   7   .   7   6   .   1   1   8
  %32 %31 %32 %2E %32 %32 %37 %2E %37 %36 %2E %31 %31 %38

212.227.76.118 -> http://%32%31%32%2E%32%32%37%2E%37%36%2E%31%31%38

Or mix decimal/hexadecimal/octal numbers with hex encoded characters:

=> %32%31%32%2E00000343%2E0x4C%2E0166

=> http://%30%33%32%34.0xE3.0%784C.118/

There are still several other tricks to obfuscate URLs.. maybe I'll point them out in another post.

I do not really understand the necessity of supporting dotless adresses and all kind of their variants because a normal user will never need them and they could be easily misused to obfuscate URLs.

Pretty old but still readable: How to Obscure Any URL