What are the vulnerablities for revealing IP addresses in code

Question

One of my developers left the IP inside his code :

The code is as follows :

[WebMethod]
public string UploadFile(byte[] f, string fileName)
{
    try
    {
        MemoryStream ms = new MemoryStream(f);
        FileStream fs = new FileStream("http://103.16.141.197/ProBuildIndia/Operator/Sample/" + fileName, FileMode.Create);
        ms.WriteTo(fs);
        ms.Close();
        fs.Close();
        fs.Dispose();
        return "OK";
    }
    catch (Exception ex)
    {
        return ex.Message.ToString();
    }
}

If you note in his code he revealed the 103.16.141.197.

The known vulnerabilities I can think of are:

• The attacker can run a nmap scan and detect which OS and ports were open

• If directory listing was not properly implemented then it would be a issue of browsing directory

• If the application was publicly accessible there were possibilities to copy the application design

The above were the known vulnerabilities that I could think of for revealing IP, but what are other vulnerabilities?

Answer 1

I think the vulnerabilities are the same for all Internet-accessible servers, the only increase in risk is that the code exposes some specific information about how to interface with it, and because it is "in code" the programmer might not think to protect it as well as they otherwise might for a server that is explicitly advertised.

Answer 2

As stated by @Lie Ryan in the comments, IP would not be much of an issue, and can be treated as public information. For all you know, I could just run a ping from windows CMD to find your IP.

I would however like to bring to your attention, a few vulnerabilities you opened up by not cleaning up the code before posting it on this site.

1. Simply going to the IP provided here revealed your running IIS.

This kind of information could be used to understand the server side environment, and thus launch an even more specific and effective attack. I can also assume your using asp.net. More info = more strength for an attacker.

2. Going to the IP/address/to/site/ has revealed what organisation this belongs to

An attacked now knows how beneficial an attack can be. The attacks can be far more contextual to your business and location.

3. Full address reveals even more about file structure, naming conventions etc

Given that the entire address is revealed. One can get insights to the architecture, file hierarchy etc for your application.

I know this is not what you asked for, and technically off-topic, I couldn't stop my self from posting this.

I hence strongly recommend you reword the question, heighten security at your server side and be very caution while posting source code on public domain.

Edit

I just browsed through your question again, and realized you mentioned similar vulnerabilities. Baffles me as to why, the info was still revealed.