On Thu, Sep 18, 2014 at 7:05 PM, Michael B. Smith <[email protected]> wrote: > I posted links to source code yesterday. In BSD, Darwin, Linux, and > Windows, inet_aton() (a core socket/winsock function) does this > conversion. Someone would have to replace that function in order to > override the behavior.
Or simply detect the dotless decimal address in the URL and reject the URL. I don't claim to know the implementation, or where/when/if it was done, just that there was discussion of countering this attack years ago. -- Ben
