| Subject: | url obfuscation |
http://www.symantec.com/connect/blogs/dotted-decimal-url-obfuscation
Below are some of the IP address numeral system obfuscation techniques Symantec has observed of spammers. (All of the samples below are just different numeral representations of the IP
address for Symantec.com)
An IP address converted to hexadecimal format. (Hexadecimal is a base-16 numeral system.)
http://0xD80C9114
An IP address converted to dotted hexadecimal format.
http://0xD8.0x0C.0x91.0x14
An IP address converted to dotted octal format. (Octal is a base-8 numeral system.)
http://0330.0014.0221.0024
A combination of Hexadecimal and Octal
http://0xd8.000000014.0x9114
{{{
#!/usr/bin/perl -w
use Regexp::Common qw/URI/;
use strict;
my @array = (
'http://0xD80C9114',
'http://0xD8.0x0C.0x91.0x14',
'http://0330.0014.0221.0024',
'http://0xd8.000000014.0x9114'
);
foreach (@array){
if(/^$RE{'URI'}/){
warn 'valid url: '.$_;
} else {
warn 'invalid url: '.$_;
}
}
}}}
$ perl url.pl
invalid url: http://0xD80C9114 at url.pl line 13.
invalid url: http://0xD8.0x0C.0x91.0x14 at url.pl line 13.
valid url: http://0330.0014.0221.0024 at url.pl line 11.
invalid url: http://0xd8.000000014.0x9114 at url.pl line 13.
I haven't looked much further than that. just an fyi.