Two points for Ben. :) -----Original Message----- From: [email protected] [mailto:[email protected]] On Behalf Of Ben Scott Sent: Thursday, September 18, 2014 7:14 PM To: [email protected] Subject: Re: [NTSysADM] RE: Pinging with less than 3 octets
On Thu, Sep 18, 2014 at 7:05 PM, Michael B. Smith <[email protected]> wrote: > I posted links to source code yesterday. In BSD, Darwin, Linux, and > Windows, inet_aton() (a core socket/winsock function) does this > conversion. Someone would have to replace that function in order to > override the behavior. Or simply detect the dotless decimal address in the URL and reject the URL. I don't claim to know the implementation, or where/when/if it was done, just that there was discussion of countering this attack years ago. -- Ben
