May 17th, 2008 01:15 AM
I don't get it...
OK... that's not what I don't get... it's just a funny typo
JPnyc is correct BUT (don't you always hate the butts)
I'm not sure why it matters whether or not Mr. Hothead is running the server or not. How, when I'm using NAT, would you be able to see my internal IP (other than by using a cookie - not sure how that would even work)? If you can, I would like you to explain that. And if so, I would like you to explain how it matters whether or not you're running the server (and I really mean that... the more days go by, the more I realize I don't understand this stuff...).
If the hothead ran the physical server all bets are off. You connect to one of my servers and I know your internal IP even if you use NAT, your browser, your screen resolution hell If I wanted I could tell how much disk space you have. I'm guessing that the hothead posted A session cookie trying to look cool
May 17th, 2008 03:16 PM
I didn't say it couldn't, just that I doubted it would be. What's the purpose of it? If the guy he's concerned about is the admin of the forum, he sure doesn't need to put the IP into a cookie to know what it is.
Originally Posted by tripstone
May 17th, 2008 07:30 PM
Yo neg, it wasn't a typo ;-)
Anyway, by server I mean WEB Server. IIS, Apache, whatever have built in functions that gather tons of data. You know that IP addresses are gathered but all sorts of other data is also captured by default. To get the NAT address one only has to ask. You can use encapsulation (pretty much a pain) or script the request in a session id (easiest)
Firewalls and ad ons like noscript will prevent most of this. But the main thing to remember is that YOU initiated the connection to my server, I didn't. In essence your firewall completely trusts my server 'cause you initiated the connection. Now all I need to do is (put simply) an ARP request.
By whatever878787 in forum Web Development
Last Post: July 28th, 2006, 06:50 PM
By Kronos2k4 in forum Web Security
Last Post: April 9th, 2004, 02:24 PM
By gore in forum Newbie Security Questions
Last Post: December 29th, 2003, 07:01 AM
By hot_guy in forum AntiOnline's General Chit Chat
Last Post: August 2nd, 2003, 02:18 PM
By jared_c in forum Microsoft Security Discussions
Last Post: June 28th, 2002, 09:09 PM