Cenzic 232 Patent
Paid Advertising
sla.ckers.org is
ha.ckers sla.cking
Sla.ckers.org
For any nonsense or banter that doesn't fit anywhere else. LoL! omg! ROFL! 
Go to Topic: PreviousNext
Go to: Forum ListMessage ListNew TopicSearchLog In
Opera CRLF weird behavior
Posted by: p0deje
Date: November 12, 2009 06:19AM

Hello, slackers

I've found something really strange in Opera :) If you enter 3145275264%0D%0A or follow such URL http://3145275264%0D%0A/ you will be redirected to http://187.121.23.128/
This only happens to Opera and I don't know the way it processes URI, because manipulating with digits before CRLF didn't told me anything.

Do you know why does this happen? Can it be used someway?

---------
http://p0deje.blogspot.com

Options: ReplyQuote
Re: Opera CRLF weird behavior
Posted by: Gareth Heyes
Date: November 12, 2009 06:43AM

It's a dword address:-
http://www.businessinfo.co.uk/labs/hackvertor/hackvertor.php#aHR0cDovLzxAZHdvcmQyaXBfMD4zMTQ1Mjc1MjY0PEAvZHdvcmQyaXBfMD4lMGQlMGEv

------------------------------------------------------------------------------------------------------------
"People who say it cannot be done should not interrupt those who are doing it.";
labs : [www.businessinfo.co.uk]
blog : [www.thespanner.co.uk]
Hackvertor : [hackvertor.co.uk]

Options: ReplyQuote
Re: Opera CRLF weird behavior
Posted by: rvdh
Date: November 12, 2009 09:52AM

Correct.

javascript: str = '3145275264'; Math.floor(str / 16777216) % 256 + '.' + Math.floor(str / 65536) % 256 + '.' + Math.floor(str / 256) % 256 + '.' + Math.floor(str) % 256;



Edited 1 time(s). Last edit at 11/12/2009 09:53AM by rvdh.

Options: ReplyQuote
Re: Opera CRLF weird behavior
Posted by: rvdh
Date: November 12, 2009 09:58AM

Oh yes it can be used for phishing and bypassing phishing filters who look for IP's only. It's how I bypassed the Opera phishing filter in 2006. not sure if they fixed it, probably not.

Options: ReplyQuote
Re: Opera CRLF weird behavior
Posted by: Gareth Heyes
Date: November 12, 2009 11:15AM

@rvdh

Don't forget you can do math.pow on that too :D

http://www.businessinfo.co.uk/labs/hackvertor/hackvertor.php#PEBpcDJkd29yZF8wKDEpPjc0LjEyNS41My4xMDA8QC9pcDJkd29yZF8wPg%3D%3D

http://www.businessinfo.co.uk/labs/hackvertor/hackvertor.php#PEBpcDJkd29yZF8wKDIpPjc0LjEyNS41My4xMDA8QC9pcDJkd29yZF8wPg%3D%3D

------------------------------------------------------------------------------------------------------------
"People who say it cannot be done should not interrupt those who are doing it.";
labs : [www.businessinfo.co.uk]
blog : [www.thespanner.co.uk]
Hackvertor : [hackvertor.co.uk]

Options: ReplyQuote


Sorry, only registered users may post in this forum.