17. Quick Quiz
1. Will this URL work in IE?
http:example.com
2. What page will be opened in Firefox browser after entering this
URL?
http://example.com@coredump.cx/
Answers
1. Yes. IE and most browsers parse “” as “/” for usability reasons.
2. In Firefox, that URL will take the user to coredump.cx, because
example.com will be interpreted as a valid value for the login
field. In almost all other browsers, “” will be interpreted as a
path delimiter, and the user will land on example.com instead.
18. Now try it by yourself and
answer what you get?!
19. Tricky URLs
For all browsers
http://example.com&gibberish=1234@16777216
1/
And http://example.com@coredump.cx/
is http://example.com/ for all…
20. This is it!
For all browsers
http://example.com&gibberish=1234@16777216
1/
is http://10.0.0.1/
And http://example.com@coredump.cx/
is http://example.com/ for all…
…but for Firefox it’s
http://coredump.cx/
22. Server addresses
• http://127.0.0.1/
This is a canonical representation of an IPv4
address.
• http://0x7f.1/
This is a representation of the same address that
uses a hexadecimal number to represent the first
octet and concatenates all the remaining octets into
a single decimal value.
• http://017700000001/
The same address is denoted using a 0-prefixed
octal value, with all octets concatenated into a single
36. Consequences
• Stolen Developer Cloud access Certificates
• Malware and Spyware on PC and mobile
• Key loggers
• Money Lost – Paypal, webmoney, etc.
• Email – recovery and steal accounts
• SHAME!
37. Recommendations
• Up to date JAVA and all other software
• Antivirus – Kasper rocks!
• Encrypted keys to infrastructure
• 2 factor authentication everywhere (email first)
• Verify yourself and your browser on …
• Attention
