On Thu, Sep 18, 2014 at 4:18 PM, Michael B. Smith <[email protected]> wrote: >> But my mozilla browser is overly helpful: doesn't look like an IP >> name or address, so add www. in front and .com after. That doesn't work! > > I think then, that in that case, Mozilla is broken. :)
I believe that is an intended behavior. The dotless decimal notation has been used in various attacks. It's been used in URL obfuscating social engineering attacks, to make users think a URL is something different (http://2142308253/www.microsoft.com/important_security_patch.exe). It's also been used to attack Microsoft's "local intranet" concept -- their code used to assume "anything without dots in it must be trustworthy". It's also been used to attack filters that look for dotted quads but not other forms of IP address. http://blogs.msdn.com/b/ieinternals/archive/2014/03/06/browser-arcana-ipv4-ipv6-literal-urls-dotted-va-dotless.aspx . The thing is, in Firefox 24.8.0, these dotless decimal IP address work for me when I try them. I dunno why that is. -- Ben
