full-disclosure - URLs with hexcode-obscured IPs still work?

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date: Wed, 26 Nov 2008 23:38:52 +0100
From: niclas <lists@...enritter.de>
To: full-disclosure@...ts.grok.org.uk
Subject: URLs with hexcode-obscured IPs still work?

Today I received a phishing mail containing a link which obscures the
IP-address as a hexadecimal number. The URL looks like this:

http:// 0x ded 6d8a1/www.paypal.com/int ... /index.htm

(Spaces added to circumvent phishing filters.)

Obviously the IP-address is disguised as an hexcode, to distract
unexperienced users from the fact that they are not actually visiting
PayPal.

This seems to be an old problem, and links like that - IMHO - just
shouldn't work. They don't do when using proxy servers, but they do in
some Firefox-versions, in Konqueror and in Microsoft's Internet Explorer.

While the IE presents the IP-addresses in dotted-decimal format., KDE's
Konqueror simply shows the hexcode-URL in the address bar.

Some Info here (german):
http://blog.datenritter.de/archives/421-Phisher-tarnen-IP-Adressen-als-Hexcode.html

Why does this still work?

n.

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/