ip-obfuscation

IP Obfuscator

A security testing toolkit for generating obfuscated IP addresses and URLs. Useful for penetration testing, security research, phishing awareness training, and testing URL parsers/filters.

Overview

This toolkit provides two interfaces:

• ip_obfuscator.html - Web-based GUI for interactive use
• ip_obfuscator.py - Command-line tool for scripting and automation

Both tools generate the same obfuscation techniques, including:

• DWORD/Integer formats (decimal, hex, octal)
• Dotted notation variants (hex, octal, mixed bases)
• IPv6-mapped addresses
• URL authority tricks (fake domain with @)
• Class B/C shorthand notation
• Overflow techniques
• URL encoding variants

Web Interface (ip_obfuscator.html)

Open ip_obfuscator.html in any modern browser. No server required.

Features

• HTTPS Toggle - Switch between HTTP and HTTPS protocols
• Filter/Search - Real-time filtering of results by keyword
• Export - Download results as JSON or CSV
• Test in Browser - Open any generated URL in a new tab
• Collapsible Categories - Click headers to expand/collapse sections
• Security Zone Analysis - See which formats trigger Windows Intranet Zone

Screenshot Workflow

1. Enter target IP address (e.g., 192.168.1.100)
2. Set fake domain for @ trick (e.g., secure.bank.com)
3. Configure path and port as needed
4. Toggle HTTPS if required
5. Click "Generate Obfuscations"
6. Use tabs to switch between URLs, IP Formats, and Security Zones
7. Click any result to copy, or use "Test in Browser"

Command-Line Tool (ip_obfuscator.py)

Requirements

• Python 3.6+
• No external dependencies (uses only standard library)

Basic Usage

# Show all obfuscation formats for an IP
python3 ip_obfuscator.py 192.168.1.100

# Generate obfuscated URLs
python3 ip_obfuscator.py 192.168.1.100 --url

# With fake domain and path
python3 ip_obfuscator.py 192.168.1.100 --url --fake-domain secure.bank.com --path /login

Command-Line Options

Option	Short	Description
--url	-u	Generate full URLs instead of just IP formats
--fake-domain	-f	Fake domain for @ trick (default: google.com)
--fake-pass	-w	Fake password for user:pass@host format
--path	-p	URL path (default: /)
--port	-P	Port number
--https	-s	Use HTTPS instead of HTTP
--json	-j	Output as JSON
--filter	-F	Filter results by keyword
--list	-l	Compact list output (values only)
--zones	-z	Analyze Windows security zone implications
--decode	-d	Decode an obfuscated IP back to standard form

Examples

Generate URLs with Fake Domain

python3 ip_obfuscator.py 192.168.1.100 --url --fake-domain secure.bank.com --path /login

Output:

================================================================================
OBFUSCATED URL GENERATOR
================================================================================
  Target IP:     192.168.1.100
  Fake Domain:   secure.bank.com
  Fake Password: (none)
  Port:          (default)
  Path:          /login
  Protocol:      HTTP
================================================================================

DWORD/INTEGER FORMATS
--------------------------------------------------------------------------------

  Standard (no obfuscation):
  http://192.168.1.100/login

  Decimal DWORD:
  http://3232235876/login

  Hex DWORD:
  http://0xC0A80164/login

  Octal DWORD:
  http://030052000544/login

...

Filter Results with JSON Output

python3 ip_obfuscator.py 192.168.1.100 --url --fake-domain secure.bank.com --filter "fake auth" --json

Output:

{
  "Fake Auth + Decimal DWORD": "http://secure.bank.com@3232235876/",
  "Fake Auth + Hex DWORD": "http://secure.bank.com@0xc0a80164/",
  "Fake Auth + Octal DWORD": "http://secure.bank.com@030052000544/",
  "Fake Auth + Dotted Hex": "http://[email protected]/",
  "Fake Auth + Dotted Octal": "http://[email protected]/",
  "Fake Auth + IPv6 Mapped (hex)": "http://secure.bank.com@[::ffff:c0a8:164]/",
  "Fake Auth + IPv6 Mapped (decimal)": "http://secure.bank.com@[::ffff:192.168.1.100]/",
  "Fake Auth + IPv6 Mapped (full)": "http://secure.bank.com@[0000:0000:0000:0000:0000:ffff:c0a8:0164]/",
  "Fake Auth + Class B": "http://[email protected]/",
  "Fake Auth + Class C": "http://[email protected]/"
}

Generate HTTPS URLs

python3 ip_obfuscator.py 192.168.1.100 --url --https --filter ipv6

List IPv6 Formats Only

python3 ip_obfuscator.py 192.168.1.100 --list --filter ipv6

Output:

All obfuscated forms of 192.168.1.100:

  ::ffff:192.168.1.100
  ::ffff:c0a8:164
  0000:0000:0000:0000:0000:ffff:c0a8:0164
  0:0:0:0:0:ffff:c0a8:164
  ::ffff:c0a80164
  ::192.168.1.100
  ::c0a8:164
  [::ffff:c0a8:164]
  [::ffff:192.168.1.100]
  [0000:0000:0000:0000:0000:ffff:c0a8:0164]

Decode Obfuscated URLs

python3 ip_obfuscator.py --decode "http://secure.bank.com@3232235876/login"

Output:

Input:   http://secure.bank.com@3232235876/login
Decoded: 192.168.1.100

Security Zone Analysis

python3 ip_obfuscator.py 192.168.1.100 --zones

Output:

================================================================================
MICROSOFT SECURITY ZONES ANALYSIS
================================================================================

The 'Dot Rule' (PlainHostName rule):
  • Hostname WITHOUT dots → Local Intranet Zone
  • Hostname WITH dots    → Internet Zone

⚠️  SECURITY IMPACT of Intranet Zone:
  • Automatic NTLM/Kerberos credential release (credential theft!)
  • Less restrictive ActiveX/script policies
  • May bypass security prompts and Mark-of-the-Web

================================================================================
Target IP: 192.168.1.100
================================================================================

🔴 DOTLESS → LOCAL INTRANET ZONE (HIGH RISK - credential leak)
--------------------------------------------------------------------------------
  Decimal DWORD
    URL: http://3232235876/
    Note: CONFIRMED: MS98-016 specifically documents this as Intranet Zone bypass

  Hex DWORD (0x prefix)
    URL: http://0xC0A80164/
    Note: CONFIRMED: Numeric hostname without dots → Intranet Zone

  Octal DWORD
    URL: http://030052000544/
    Note: Octal integer without dots → Intranet Zone

🟢 DOTTED → INTERNET ZONE (normal security)
--------------------------------------------------------------------------------
  Standard Dotted Decimal
    URL: http://192.168.1.100/

  Dotted Hex
    URL: http://0xC0.0xA8.0x1.0x64/
...

Obfuscation Techniques Reference

Category	Example	Description
Decimal DWORD	3232235876	32-bit integer representation
Hex DWORD	0xC0A80164	Hexadecimal integer
Octal DWORD	030052000544	Octal integer (leading zero)
Dotted Hex	0xC0.0xA8.0x1.0x64	Each octet in hex
Dotted Octal	0300.0250.01.0144	Each octet in octal
Mixed Bases	192.0xa8.01.100	Combination of dec/hex/octal
Class B	192.11010404	First octet + 24-bit value
Class C	192.168.356	Two octets + 16-bit value
IPv6 Mapped	::ffff:c0a8:164	IPv4-mapped IPv6 address
Fake Auth	secure.bank.com@IP	URL authority section trick
Overflow	7527203172	Value + 2^32 (wraps around)

Security Considerations

This tool is intended for:

• Penetration testing (with authorization)
• Security research
• Phishing awareness training
• Testing URL filters and parsers
• CTF challenges

Do not use for malicious purposes.

References