0

Trying to work out if I should have any security concerns with being able to do the following:

IPv4 addresses can be represented in different ways:

$ ping 0177.1
$ ping 134744072
$ ping 0x8080808
$ ping 010.0x0000008.00000010.8
$ ping 8.0x0000000000000080808

This works on both, Linux and Windows. I assume that next-generation firewalls are able to detect this and 'block'?

Original reference: https://twitter.com/x0rz/status/928584447292858368?s=03

closed as off-topic by a CVn, Tobi Nary, ISMSDEV, AJ Henderson, John Deters Nov 11 '17 at 4:02

This question appears to be off-topic. The users who voted to close gave this specific reason:

  • "This question does not appear to be about Information security within the scope defined in the help center." – a CVn, Tobi Nary, ISMSDEV, AJ Henderson, John Deters
If this question can be reworded to fit the rules in the help center, please edit the question.

  • What makes you think that this has anything to do with the IP address? It's more likely about gethostbyname() and similar APIs trying to be "helpful". Try nslookup 8.0x0000000000000080808 for one. – a CVn Nov 9 '17 at 12:10
  • 1
    here's your test: do a packet capture when you try different encodings of an IP: do the different encodings get passed along to the network? – schroeder Nov 9 '17 at 12:18
  • 3
    if you are going to copy/paste someone else, at least provide credit: twitter.com/x0rz/status/928584447292858368 – schroeder Nov 9 '17 at 13:32
2

this is a false premise.

Firewalls work by parsing the IP's provided on there own predictable way. The underlying protocols only use the Network Bitwise implementation of an IP address (e.a. it uses the 32 or 128 bit representation, for ipv4 and ipv6 respectively).

The underlying libraries that ping uses to make the connect translate the given representation to the expected representation by the system.

This means that there is no difference for the firewall between the IP representations

to illustrate this I ran the ping command with the address you supplied and captured the systemcalls. here is the results for the connect call on linux.

connect(3, {sa_family=AF_INET, sin_port=htons(1025), sin_addr=inet_addr("127.0.0.1")}, 16) = 0
connect(3, {sa_family=AF_INET, sin_port=htons(1025), sin_addr=inet_addr("8.8.8.8")}, 16) = 0
connect(3, {sa_family=AF_INET, sin_port=htons(1025), sin_addr=inet_addr("8.8.8.8")}, 16) = 0
connect(3, {sa_family=AF_INET, sin_port=htons(1025), sin_addr=inet_addr("8.8.8.8")}, 16) = 0
connect(3, {sa_family=AF_INET, sin_port=htons(1025), sin_addr=inet_addr("8.8.8.8")}, 16) = 0

As you can see only the dotted decimal notation was used for the call.

Not the answer you're looking for? Browse other questions tagged or ask your own question.