I have read that using the single number equivalent (called the "binary equivalent" by the author) of the IP address instead of the actual IP address or the domain name can be used "to bypass basic ACLs".
I wonder if such an "esoteric" practice is really used and, if yes, in which scenarios?
My understanding is that the filtering may occur at two layers:
- At the application layer. Here proxies will check the domain name against a blacklist. To bypass this using an IP seems by far a more practical method,
- At the network layer. Here firewalls will check the destination IP against a black list: as per my understanding no matter how one entered an IP address, whether he used DNS, IP, binary, or whatever, he will still get blocked.
The only theoretical scenario I can imagine is a dumb sysadmin using a badly configured proxy instead of a firewall to fake an IP-based filtering.
Is there any more real scenario? Unless my theoretical situation actually reflects real-life security issues?
The so-called "binary equivalent" stuff:
For those who don't know what I'm referring too, I think it's quite little known that a host (let's take
www.google.com for example sake) can be reached through three means:
- The most obvious: its domain name:
- A more techie way: its IP address:
- A definitively more techie way: using the decimal representation of the IP address:
It is the latter which interests me here. To calculate it, you need to start from the the host's IP address:
$ host www.google.com www.google.com has address 220.127.116.11
The book I read advised to convert each of the IP address components into binary numbers, concatenate them to get a single large binary number, and convert it back to decimal. Everyone has its own taste, personally I prefer to simply cyclically multiply by 256 and add each components as in the example below:
$ bc ((( 216 * 256) + 58) * 256 + 210) * 256 + 228 3627733732
This produces a number, you can use it to access Google's server using an opaque URL like http://3627733732 or ensure that the right IP address is contacted by pinging it for instance:
$ ping 3627733732 PING 3627733732 (18.104.22.168) 56(84) bytes of data. 64 bytes from 22.214.171.124: icmp_seq=1 ttl=53 time=26.5 ms
This is quite a cool thing, cyber sorcerer, amaze your friends with this w0nderful 1337 trickz, great! But apart from that, I wonder if there is any real-life use for this?