hackinglz/ip-obfuscationيُنشئ عناوين IP وعناوين URL مُشوَّهة باستخدام حيل DWORD، والثماني، والست عشري، وIPv6-mapped، والنطاق المزيف @ لاختبار الاختراق، والتوعية بالتصيّد، واختبار مرشّحات URL.
مجموعة أدوات لاختبار الأمان لتوليد عناوين IP وعناوين URL مموّهة. مفيدة لاختبار الاختراق، والبحث الأمني، والتدريب على التوعية بالتصيّد، واختبار محلّلات/مرشّحات URL.
توفّر هذه المجموعة واجهتين:
ip_obfuscator.html - واجهة رسومية قائمة على الويب للاستخدام التفاعليip_obfuscator.py - أداة سطر أوامر للبرمجة النصية والأتمتةتولّد كلتا الأداتين نفس تقنيات التمويه، بما في ذلك:
@)ip_obfuscator.html)افتح ip_obfuscator.html في أي متصفح حديث. لا حاجة إلى خادم.
192.168.1.100)@ (مثل secure.bank.com)ip_obfuscator.py)# Show all obfuscation formats for an IP
python3 ip_obfuscator.py 192.168.1.100
# Generate obfuscated URLs
python3 ip_obfuscator.py 192.168.1.100 --url
# With fake domain and path
python3 ip_obfuscator.py 192.168.1.100 --url --fake-domain secure.bank.com --path /login
| Option | Short | Description |
|---|---|---|
--url | -u | Generate full URLs instead of just IP formats |
--fake-domain | -f | Fake domain for @ trick (default: google.com) |
--fake-pass | -w | Fake password for user:pass@host format |
--path | -p | URL path (default: /) |
--port | -P | Port number |
--https | -s | Use HTTPS instead of HTTP |
--json | -j | Output as JSON |
--filter | -F | Filter results by keyword |
--list | -l | Compact list output (values only) |
--zones | -z | Analyze Windows security zone implications |
--decode | -d | Decode an obfuscated IP back to standard form |
python3 ip_obfuscator.py 192.168.1.100 --url --fake-domain secure.bank.com --path /login
المخرجات:
================================================================================
OBFUSCATED URL GENERATOR
================================================================================
Target IP: 192.168.1.100
Fake Domain: secure.bank.com
Fake Password: (none)
Port: (default)
Path: /login
Protocol: HTTP
================================================================================
DWORD/INTEGER FORMATS
--------------------------------------------------------------------------------
Standard (no obfuscation):
http://192.168.1.100/login
Decimal DWORD:
http://3232235876/login
Hex DWORD:
http://0xC0A80164/login
Octal DWORD:
http://030052000544/login
...
python3 ip_obfuscator.py 192.168.1.100 --url --fake-domain secure.bank.com --filter "fake auth" --json
المخرجات:
{
"Fake Auth + Decimal DWORD": "http://secure.bank.com@3232235876/",
"Fake Auth + Hex DWORD": "http://secure.bank.com@0xc0a80164/",
"Fake Auth + Octal DWORD": "http://secure.bank.com@030052000544/",
"Fake Auth + Dotted Hex": "http://[email protected]/",
"Fake Auth + Dotted Octal": "http://[email protected]/",
"Fake Auth + IPv6 Mapped (hex)": "http://secure.bank.com@[::ffff:c0a8:164]/",
"Fake Auth + IPv6 Mapped (decimal)": "http://secure.bank.com@[::ffff:192.168.1.100]/",
"Fake Auth + IPv6 Mapped (full)": "http://secure.bank.com@[0000:0000:0000:0000:0000:ffff:c0a8:0164]/",
"Fake Auth + Class B": "http://[email protected]/",
"Fake Auth + Class C": "http://[email protected]/"
}
python3 ip_obfuscator.py 192.168.1.100 --url --https --filter ipv6
python3 ip_obfuscator.py 192.168.1.100 --list --filter ipv6
المخرجات:
All obfuscated forms of 192.168.1.100:
::ffff:192.168.1.100
::ffff:c0a8:164
0000:0000:0000:0000:0000:ffff:c0a8:0164
0:0:0:0:0:ffff:c0a8:164
::ffff:c0a80164
::192.168.1.100
::c0a8:164
[::ffff:c0a8:164]
[::ffff:192.168.1.100]
[0000:0000:0000:0000:0000:ffff:c0a8:0164]
python3 ip_obfuscator.py --decode "http://secure.bank.com@3232235876/login"
المخرجات:
Input: http://secure.bank.com@3232235876/login
Decoded: 192.168.1.100
python3 ip_obfuscator.py 192.168.1.100 --zones
المخرجات:
================================================================================
MICROSOFT SECURITY ZONES ANALYSIS
================================================================================
The 'Dot Rule' (PlainHostName rule):
• Hostname WITHOUT dots → Local Intranet Zone
• Hostname WITH dots → Internet Zone
⚠️ SECURITY IMPACT of Intranet Zone:
• Automatic NTLM/Kerberos credential release (credential theft!)
• Less restrictive ActiveX/script policies
• May bypass security prompts and Mark-of-the-Web
================================================================================
Target IP: 192.168.1.100
================================================================================
🔴 DOTLESS → LOCAL INTRANET ZONE (HIGH RISK - credential leak)
--------------------------------------------------------------------------------
Decimal DWORD
URL: http://3232235876/
Note: CONFIRMED: MS98-016 specifically documents this as Intranet Zone bypass
Hex DWORD (0x prefix)
URL: http://0xC0A80164/
Note: CONFIRMED: Numeric hostname without dots → Intranet Zone
Octal DWORD
URL: http://030052000544/
Note: Octal integer without dots → Intranet Zone
🟢 DOTTED → INTERNET ZONE (normal security)
--------------------------------------------------------------------------------
Standard Dotted Decimal
URL: http://192.168.1.100/
Dotted Hex
URL: http://0xC0.0xA8.0x1.0x64/
...
| Category | Example | Description |
|---|---|---|
| Decimal DWORD | 3232235876 | 32-bit integer representation |
| Hex DWORD | 0xC0A80164 | Hexadecimal integer |
| Octal DWORD | 030052000544 | Octal integer (leading zero) |
| Dotted Hex | 0xC0.0xA8.0x1.0x64 | Each octet in hex |
| Dotted Octal | 0300.0250.01.0144 | Each octet in octal |
| Mixed Bases | 192.0xa8.01.100 | Combination of dec/hex/octal |
| Class B | 192.11010404 | First octet + 24-bit value |
| Class C | 192.168.356 | Two octets + 16-bit value |
| IPv6 Mapped | ::ffff:c0a8:164 | IPv4-mapped IPv6 address |
| Fake Auth | secure.bank.com@IP | URL authority section trick |
| Overflow | 7527203172 | Value + 2^32 (wraps around) |
هذه الأداة مخصّصة لـ:
لا تستخدمها لأغراض خبيثة.
MIT License - Use responsibly.