I posted links to source code yesterday. In BSD, Darwin, Linux, and Windows, inet_aton() (a core socket/winsock function) does this conversion. Someone would have to replace that function in order to override the behavior. As I read the Firefox bug report, it appeared that the Mac version of FF was the only version that had a different inet_aton(), and that was pre-Darwin.
-----Original Message----- From: [email protected] [mailto:[email protected]] On Behalf Of Ben Scott Sent: Thursday, September 18, 2014 6:39 PM To: [email protected] Subject: Re: [NTSysADM] RE: Pinging with less than 3 octets On Thu, Sep 18, 2014 at 4:18 PM, Michael B. Smith <[email protected]> wrote: >> But my mozilla browser is overly helpful: doesn't look like an IP >> name or address, so add www. in front and .com after. That doesn't work! > > I think then, that in that case, Mozilla is broken. :) I believe that is an intended behavior. The dotless decimal notation has been used in various attacks. It's been used in URL obfuscating social engineering attacks, to make users think a URL is something different (http://2142308253/www.microsoft.com/important_security_patch.exe). It's also been used to attack Microsoft's "local intranet" concept -- their code used to assume "anything without dots in it must be trustworthy". It's also been used to attack filters that look for dotted quads but not other forms of IP address. http://blogs.msdn.com/b/ieinternals/archive/2014/03/06/browser-arcana-ipv4-ipv6-literal-urls-dotted-va-dotless.aspx . The thing is, in Firefox 24.8.0, these dotless decimal IP address work for me when I try them. I dunno why that is. -- Ben
