Here's one for example.com. Without the host header, it still misbehaves, but it at least does something.
Here's one for example.com. Without the host header, it still misbehaves, but it at least does something.
While nice, I can't help but imagine the mayhem once someone finds a URL parsing bug that leads to remote code execution. Then again, URL parsing is decades old now, the odds that it still contains a RCE is probably low.
Non of them accept Dotted overflow, Class B or Class C.
Decimal Dotted http://192.168.0.1/
Decimal Dotted Overflow http://448.424.256.257/
Decimal Long http://3232235521/
Decimal Long Overflow http://7527202817/
Decimal Class A http://192.11010049/
Decimal Class B http://49320.1/
Decimal Class C http://12625920.1/
Decimal Long with auth http://fake.site@3232235521/
Octal Dotted http://0300.0250.00.01/
Octal Dotted Overflow http://0700.0650.0400.0401/
Octal Long http://030052000001/
Octal Long Overflow http://070052000001/
Octal Class A http://0300.052000001/
Octal Class B http://0140250.01/
Octal Class C http://060124000.01/
Octal Long with auth http://fake.site@030052000001/
Hex Dotted http://0xc0.0xa8.0x0.0x1/
Hex Dotted Overflow http://0x1c0.0x1a8.0x100.0x101/
Hex Long http://0xc0a80001/
Hex Long Overflow http://0x1c0a80001/
Hex Class A http://0xc0.0xa80001/
Hex Class B http://0xc0a8.0x1/
Hex Class C http://0xc0a800.0x1/
Hex Long with auth http://fake.site@0xc0a80001/