glibc getaddrinfo accepts Unicode lookalike IPv4 addresses
Original title: Pushing the Limits with getaddrinfo
glibc's getaddrinfo accepts Unicode characters that map to digits and dots, allowing many non-standard representations of the same IPv4 address to resolve to the same IP.
glibc's getaddrinfo accepts input containing Unicode characters that IDNA mapping converts to standard ASCII before numeric address parsing. This allows many different representations of the same IPv4 address to resolve correctly. The post demonstrates this behavior with various Unicode lookalikes including circled digits, math bold letters, and segmented digits that all resolve to 69.30.206.130.
- IDNA conversion runs before the numeric address parser
- Any combination of mapped characters resolves to the same IP
- Example: ⑥⑨.㉚.⑳⑥.⑬⓪ resolves to 69.30.206.130
- Vendors
- glibc
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| ipv4 | 205.185.122.90 | the hex integer 0xcdb97a5a , and inet_aton() turns it into 205.185.122.90 . curl connects there, sends Host: 0xcdb97a5a , and ignores |
| ipv4 | 39.30.206.130 | also percent-decodes the host part of a URL, so http://%36%39.30.206.130/ , http://69%2E30%2E206%2E130/ , and the fully percent-enco |
| ipv4 | 69.30.206.130 | t looks like line noise. Hand it to getaddrinfo() and it is 69.30.206.130 . Every example in this post points at the same server, 69. |
From the original article
11 min read at acid.vegas
An IPv4 address is just a 32-bit number, and glibc will accept it in forms you would never recognize. ⁰𝑋⁴5．🯰３₆。⁵₂₈𝟲🯶 is one of them. Anything that judges an address by how it looks can be walked around.
By acid.vegas via freddyb · acid.vegas
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.