EH-Net

Ethical Hacking Discussions and Related Certifications => Other => Topic started by: chugh_a on October 04, 2006, 12:37:38 AM



Title: IP Obfuscation
Post by: chugh_a on October 04, 2006, 12:37:38 AM
Can anybody pls. suggest that whether 'IP Obfuscation' should be used as an added measure to be more secure. What are the possible drwbacks of using this approach ??


Title: Re: IP Obfuscation
Post by: jimbob on October 04, 2006, 10:39:12 AM
Hi,
By IP obfusation I assume you mean the technique of using the decimal value of an IP address instead of the more common dotted quad notation. For those who don't know IP addresses are in fact 32 bit numbers and dotted quad notation splits the number up into 4 x 8 bit numbers to make it easier for humans to read. For example the IP address 1.2.3.4 equals the  decimal number 16909060...

1 * (2 ^ 24) = 16777216
2 * (2 ^ 16) = 131072
3 * (2 ^  8) = 768
4 * (2 ^  0) = 4

Total = 16909060


As far as security goes I can't see a good reason to use IP obfuscation. I've only really seen it used for obfuscating URLs to fool the punter into thinking they are visiting a host other than the one they are really hitting. If you want to do this then by all means use it, but if you want to conceal URLs from view it's pretty poor. It will also not work if you are using name-based virtual hosts on your web server.

Regards,
Jim


Title: Re: IP Obfuscation
Post by: Oyle on October 06, 2006, 04:24:19 PM
You can also express IPs as:

Registry DWORD values (decimal)
Hex
Octal
Binary
Any combination of!

Full full details on how to obscure URLS and IPs:

http://www.pc-help.org (http://www.pc-help.org/obscure.htm)