Hacker Newsnew | past | comments | ask | show | jobs | submit | 123048713's commentslogin

You can have a lot more fun than that if you want to break things. An IP address has lots of valid formats nobody uses.

    ;; ANSWER SECTION:
    wikipedia.org.  599 IN A    208.80.154.224
Lets try this in decimal:

http://3494943456/

Sort of cool, but what happens if we overflow it by adding 232?

    >>> 3494943456 + 2**32
http://7789910752/

I mean that's cool, but how far can we go?

    >>> 3494943456 + (2**32) ** 2

http://18446744077204495072/

So that still works, what about going further?

    >>> 3494943456 + (2**32) ** 100

http://19769064789825639936542264398379633403153906826257738...

Going further actually breaks some browsers (Firefox can handle longer than Internet Explorer for example), breaks web servers because they log the full version before it is transformed, and even acts as a fingerprinting vector. The limit is usually in the several hundred kilobyte range, and depending on the way that the underlying operating system handles it, things get seriously broken very quickly.


In Firefox, when I hover over http://3494943456/ it displays as http://208.80.154.224 in the lower left, as does 1844... and 197690..., BUT http://7789910752/ displays as exactly that string. It likewise navigates to the first, third, and fourth links but breaks on your second.


Interestingly, Safari on iOS only works with the first link you posted. From the first overflow it displays an invalid URL error.

You should probably include the OS+browser combo you used, as it does not seem to be universal.


First and last work for me on mobile Safari, but not the middle two.


Way back in high school I used to use decimal ip addresses to bypass the network content filter. It doesn't work as well these days as so many sites are virtual hosted.


Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: