Skip to content
BranchesTags

Folders and files

NameName
Last commit message
Last commit date

Latest commit

 

History

5 Commits
LICENSE
LICENSE
 
 
README.md
README.md
 
 
ip_obfuscator.html
ip_obfuscator.html
 
 
ip_obfuscator.py
ip_obfuscator.py
 
 

Repository files navigation

IP Obfuscator

A security testing toolkit for generating obfuscated IP addresses and URLs. Useful for penetration testing, security research, phishing awareness training, and testing URL parsers/filters.

Overview

This toolkit provides two interfaces:

  • ip_obfuscator.html - Web-based GUI for interactive use
  • ip_obfuscator.py - Command-line tool for scripting and automation

Both tools generate the same obfuscation techniques, including:

  • DWORD/Integer formats (decimal, hex, octal)
  • Dotted notation variants (hex, octal, mixed bases)
  • IPv6-mapped addresses
  • URL authority tricks (fake domain with @)
  • Class B/C shorthand notation
  • Overflow techniques
  • URL encoding variants

Web Interface (ip_obfuscator.html)

Open ip_obfuscator.html in any modern browser. No server required.

Features

  • HTTPS Toggle - Switch between HTTP and HTTPS protocols
  • Filter/Search - Real-time filtering of results by keyword
  • Export - Download results as JSON or CSV
  • Test in Browser - Open any generated URL in a new tab
  • Collapsible Categories - Click headers to expand/collapse sections
  • Security Zone Analysis - See which formats trigger Windows Intranet Zone

Screenshot Workflow

  1. Enter target IP address (e.g., 192.168.1.100)
  2. Set fake domain for @ trick (e.g., secure.bank.com)
  3. Configure path and port as needed
  4. Toggle HTTPS if required
  5. Click "Generate Obfuscations"
  6. Use tabs to switch between URLs, IP Formats, and Security Zones
  7. Click any result to copy, or use "Test in Browser"

Command-Line Tool (ip_obfuscator.py)

Requirements

  • Python 3.6+
  • No external dependencies (uses only standard library)

Basic Usage

# Show all obfuscation formats for an IP
python3 ip_obfuscator.py 192.168.1.100

# Generate obfuscated URLs
python3 ip_obfuscator.py 192.168.1.100 --url

# With fake domain and path
python3 ip_obfuscator.py 192.168.1.100 --url --fake-domain secure.bank.com --path /login

Command-Line Options

Option Short Description
--url -u Generate full URLs instead of just IP formats
--fake-domain -f Fake domain for @ trick (default: google.com)
--fake-pass -w Fake password for user:pass@host format
--path -p URL path (default: /)
--port -P Port number
--https -s Use HTTPS instead of HTTP
--json -j Output as JSON
--filter -F Filter results by keyword
--list -l Compact list output (values only)
--zones -z Analyze Windows security zone implications
--decode -d Decode an obfuscated IP back to standard form

Examples

Generate URLs with Fake Domain

python3 ip_obfuscator.py 192.168.1.100 --url --fake-domain secure.bank.com --path /login

Output:

================================================================================
OBFUSCATED URL GENERATOR
================================================================================
  Target IP:     192.168.1.100
  Fake Domain:   secure.bank.com
  Fake Password: (none)
  Port:          (default)
  Path:          /login
  Protocol:      HTTP
================================================================================

DWORD/INTEGER FORMATS
--------------------------------------------------------------------------------

  Standard (no obfuscation):
  http://192.168.1.100/login

  Decimal DWORD:
  http://3232235876/login

  Hex DWORD:
  http://0xC0A80164/login

  Octal DWORD:
  http://030052000544/login

...

Filter Results with JSON Output

python3 ip_obfuscator.py 192.168.1.100 --url --fake-domain secure.bank.com --filter "fake auth" --json

Output:

{
  "Fake Auth + Decimal DWORD": "http://secure.bank.com@3232235876/",
  "Fake Auth + Hex DWORD": "http://secure.bank.com@0xc0a80164/",
  "Fake Auth + Octal DWORD": "http://secure.bank.com@030052000544/",
  "Fake Auth + Dotted Hex": "http://secure.bank.com@0xc0.0xa8.0x1.0x64/",
  "Fake Auth + Dotted Octal": "http://secure.bank.com@0300.0250.01.0144/",
  "Fake Auth + IPv6 Mapped (hex)": "http://secure.bank.com@[::ffff:c0a8:164]/",
  "Fake Auth + IPv6 Mapped (decimal)": "http://secure.bank.com@[::ffff:192.168.1.100]/",
  "Fake Auth + IPv6 Mapped (full)": "http://secure.bank.com@[0000:0000:0000:0000:0000:ffff:c0a8:0164]/",
  "Fake Auth + Class B": "http://secure.bank.com@192.11010404/",
  "Fake Auth + Class C": "http://secure.bank.com@192.168.356/"
}

Generate HTTPS URLs

python3 ip_obfuscator.py 192.168.1.100 --url --https --filter ipv6

List IPv6 Formats Only

python3 ip_obfuscator.py 192.168.1.100 --list --filter ipv6

Output:

All obfuscated forms of 192.168.1.100:

  ::ffff:192.168.1.100
  ::ffff:c0a8:164
  0000:0000:0000:0000:0000:ffff:c0a8:0164
  0:0:0:0:0:ffff:c0a8:164
  ::ffff:c0a80164
  ::192.168.1.100
  ::c0a8:164
  [::ffff:c0a8:164]
  [::ffff:192.168.1.100]
  [0000:0000:0000:0000:0000:ffff:c0a8:0164]

Decode Obfuscated URLs

python3 ip_obfuscator.py --decode "http://secure.bank.com@3232235876/login"

Output:

Input:   http://secure.bank.com@3232235876/login
Decoded: 192.168.1.100

Security Zone Analysis

python3 ip_obfuscator.py 192.168.1.100 --zones

Output:

================================================================================
MICROSOFT SECURITY ZONES ANALYSIS
================================================================================

The 'Dot Rule' (PlainHostName rule):
  • Hostname WITHOUT dots → Local Intranet Zone
  • Hostname WITH dots    → Internet Zone

⚠️  SECURITY IMPACT of Intranet Zone:
  • Automatic NTLM/Kerberos credential release (credential theft!)
  • Less restrictive ActiveX/script policies
  • May bypass security prompts and Mark-of-the-Web

================================================================================
Target IP: 192.168.1.100
================================================================================

🔴 DOTLESS → LOCAL INTRANET ZONE (HIGH RISK - credential leak)
--------------------------------------------------------------------------------
  Decimal DWORD
    URL: http://3232235876/
    Note: CONFIRMED: MS98-016 specifically documents this as Intranet Zone bypass

  Hex DWORD (0x prefix)
    URL: http://0xC0A80164/
    Note: CONFIRMED: Numeric hostname without dots → Intranet Zone

  Octal DWORD
    URL: http://030052000544/
    Note: Octal integer without dots → Intranet Zone

🟢 DOTTED → INTERNET ZONE (normal security)
--------------------------------------------------------------------------------
  Standard Dotted Decimal
    URL: http://192.168.1.100/

  Dotted Hex
    URL: http://0xC0.0xA8.0x1.0x64/
...

Obfuscation Techniques Reference

Category Example Description
Decimal DWORD 3232235876 32-bit integer representation
Hex DWORD 0xC0A80164 Hexadecimal integer
Octal DWORD 030052000544 Octal integer (leading zero)
Dotted Hex 0xC0.0xA8.0x1.0x64 Each octet in hex
Dotted Octal 0300.0250.01.0144 Each octet in octal
Mixed Bases 192.0xa8.01.100 Combination of dec/hex/octal
Class B 192.11010404 First octet + 24-bit value
Class C 192.168.356 Two octets + 16-bit value
IPv6 Mapped ::ffff:c0a8:164 IPv4-mapped IPv6 address
Fake Auth secure.bank.com@IP URL authority section trick
Overflow 7527203172 Value + 2^32 (wraps around)

Security Considerations

This tool is intended for:

  • Penetration testing (with authorization)
  • Security research
  • Phishing awareness training
  • Testing URL filters and parsers
  • CTF challenges

Do not use for malicious purposes.

References

  • MS98-016: Internet Explorer URL Parsing Vulnerability
  • SANS ISC Diary on IP Obfuscation
  • Mandiant: URL Schema Obfuscation techniques
  • inet_aton() man page (BSD sockets)

License

MIT License - Use responsibly.

About

IP obfuscation and URL generator.

Topics

ip-obfuscationntlmpenetration-testingphishingpythonsecurity-researchsecurity-testingurl-obfuscation

Resources

Readme
MIT license
Activity

Stars

2 stars

Watchers

0 watching

Forks

0 forks
Report repository

Releases

Packages

Contributors

Languages