June 15, 2025 at 04:26PM

10 ways to encode IPs to bypass validations πŸ‘‡

8.8.1028 β†’ Partial Decimal (Class B)
Combines the 3rd and 4th octets: 4 Γ— 256 + 4 = 1028

8.525316 β†’ Partial Decimal (Class A)
Combines the last three octets into one decimal number

0x08.8.004.004 β†’ Mixed Encoding
Hexadecimal + Decimal + Octal (segment by segment)

0x08.0x08.004.004 β†’ Double Hex + Octal
Two segments in hex, two in octal

0x08.010.4.4 β†’ Hex + Octal + Decimal Mix

134743044 β†’ Single Decimal
Full 32-bit integer representation of the IP

0x08080404 β†’ Full Hexadecimal IP
Entire IP encoded as a single hex literal

010.010.004.004 β†’ All Octal
Each segment padded with 0 to force octal interpretation

0x8.0x8.0x4.0x4 β†’ Hex per Segment
All four octets encoded individually in hex

8.8.0×404 β†’ Partial Hex (Class B)
Last segment in hex: 0x404 = 1028

You can also use unicode digits instead!

These won’t resolve with curl/ping etc but may still work with other libraries:

β‘§.β‘§.β‘£.β‘£ ← Circled Unicode digits
8.8.οΌ”.οΌ” ← Fullwidth Unicode digits
𝟠.𝟠.𝟜.𝟜 ← Mathematical Unicode digits

Credits: AndrΓ© Baptista | Linkedin