Beefy Boxes and Bandwidth Generously Provided by pair Networks
Clear questions and runnable code
get the best and fastest answer
 
PerlMonks  

RE: Take a bite out of my SPAM please

by araqnid (Beadle)
on Aug 31, 2000 at 18:57 UTC ( #30534=note: print w/ replies, xml ) Need Help??


in reply to Take a bite out of my SPAM please

hmm..

s|&#(\d+);|pack("c",$1)|ge
ought to work but that produces a bunch of control characters. so there's obviously a subtlety i've missed


Comment on RE: Take a bite out of my SPAM please
Download Code
RE: RE: Take a bite out of my SPAM please
by mdillon (Priest) on Aug 31, 2000 at 19:28 UTC
    no, you haven't missed anything. the entities , , and  all encode ASCII control characters. i don't think that this string can be turned into a navigable URL using only generic conversions. my guess is that the URL in the form is converted with JavaScript or something to allow to browser to use it as a FORM target.

    i did a couple more conversions and got a bit more intelligible stuff out. here are the other conversions i ran:

    $URL =~ s/&/&/g; # numeric entities $URL =~ s/&#(\d+);/pack('c', $1)/ge; # hex escapes $URL =~ s/%(\d{2})/pack('c', $1)/ge; # 'decimal' IP $URL =~ s/(\d{5,})/join('.', unpack('C4', pack('N', $1)))/ge;
    the result was this (after running it through 'od -c'):
    0000 h t t p : / / w w w . d n s 020 002 0020 005 005 005 020 002 020 005 020 020 020 005 005 020 002 020 020 0040 002 020 020 002 m a g i c s i t e . n e 0060 t & 6 4 . 1 7 6 . 4 5 . 4 4 @ 6 0100 4 . 1 7 6 . 4 5 . 4 3 & 6 3 . 9 0120 6 . 2 . 2 3 7 @ 2 0 8 . 6 2 . 1 0140 4 . 2 4 8 ? 4 . 1 2 8 . 1 7 0 . 0160 1 2 2 & p r o x y = 6 3 . 9 6 . 0200 2 . 2 1 8 ? 6 4 . 1 7 6 . 4 5 . 0220 4 3 @ 6 3 . 9 6 . 2 . 2 3 7 ? w 0240 w w . s u 2 5 3 7 . t w | w w w 0260 . 020 002 005 005 005 020 020 020 005 005 020 002 020 020 002 0300 020 020 002 . h k ? / p r o x y = 6 3 0320 . 9 6 . 2 . 2 2 7 @ 1 3 1 . 1 0 0340 3 . 2 2 9 . 3 7 : 2 0 3 0 @ 1 3 0360 1 . 1 0 3 . 2 2 9 . 5 ? / @ 6 4 0400 . 1 7 6 . 1 2 2 . 1 4 : 8 0 8 0 0420 @ 6 4 . 1 7 6 . 1 1 3 . 8 8 @ 037 0440 036 & # ! 036 # 037 $ # \n 0452

    the main points of interest are the apparent IP addresses:

    • 64.176.45.44
    • 64.176.45.43
    • 63.96.2.237
    • 208.62.14.248
    • 4.128.170.122
    • 63.96.2.218
    • 131.103.229.37:2030
    • 131.103.229.5
    • 64.176.122.14:8080
    • 64.176.113.88

    after checking a few of these out with reverse DNS and whois.arin.net, i've come to the conclusion that it's all just random garbage. i don't think that the alleged IP addresses are owned by affiliated entities, and none of them seem to be porn sites, so i think it's just someone mucking about.

      I tried some slightly different approaches, but didn't come up with anything that looked much more usable:

      Output 1 (using araqnid's sub):
      http://www.dnsmagicsite.net&1085287724@1085287723 &1063256813@3493727992?75541114&proxy=1063256794? 1085287723@1063256813?www.su2537.tw|www..hk?/ proxy=1063256803@2204624165:2030@2204624133?/ @1085307406:8080@1085305176@%31%30%38%35%33%30%35%31%36%35

      Output 2 (using a character map):
      http://www.dns.hk?/proxy=1063256803@2204624165: 2030@2204624133?/@1085307406:8080 @1085305176@%31%30%38%35%33%30%35%31%36%35

      I've included the character map below FWIW.

      my %chars = ( 32 => '', 143 => '143', 33 => '!', 144 => '144', 34 => '"', 145 => '`', 35 => '#', 146 => "'", 36 => '$', 147 => '"', 37 => '%', 148 => '"', 38 => '&', 149 => '*', 39 => "'", 150 => '-', 40 => '(', 151 => '-', 41 => ')', 152 => '~', 42 => '*', 153 => '[tm]', 43 => '+', 154 => 's', 44 => ',', 155 => '>', 45 => '-', 156 => 'oe', 46 => '.', 157 => '&#157;', 47 => '/', 158 => '&#158;', 48 => '0', 159 => 'Y', 49 => '1', 160 => "'", 50 => '2', 161 => '', 51 => '3', 162 => '', 52 => '4', 163 => '', 53 => '5', 164 => '', 54 => '6', 165 => '', 55 => '7', 166 => '', 56 => '8', 167 => '', 57 => '9', 168 => '', 58 => ':', 169 => '', 59 => ';', 170 => '', 60 => '<', 171 => '', 61 => '=', 172 => '', 62 => '>', 173 => '', 63 => '?', 174 => '', 64 => '@', 175 => '', 65 => 'A', 176 => '', 66 => 'B', 177 => '', 67 => 'C', 178 => '', 68 => 'D', 179 => '', 69 => 'E', 180 => '', 70 => 'F', 181 => '', 71 => 'G', 182 => '', 72 => 'H', 183 => '', 73 => 'I', 184 => '', 74 => 'J', 185 => '', 75 => 'K', 186 => '', 76 => 'L', 187 => '', 77 => 'M', 188 => '', 78 => 'N', 189 => '', 79 => 'O', 190 => '', 80 => 'P', 191 => '', 81 => 'Q', 192 => '', 82 => 'R', 193 => '', 83 => 'S', 194 => '', 84 => 'T', 195 => '', 85 => 'U', 196 => '', 86 => 'V', 197 => '', 87 => 'W', 198 => '', 88 => 'X', 199 => '', 89 => 'Y', 200 => '', 90 => 'Z', 201 => '', 91 => '[', 202 => '', 92 => "\\", 203 => '', 93 => ']', 204 => '', 94 => '^', 205 => '', 95 => '_', 206 => '', 96 => '`', 207 => '', 97 => 'a', 208 => '', 98 => 'b', 209 => '', 99 => 'c', 210 => '', 100 => 'd', 211 => '', 101 => 'e', 212 => '', 102 => 'f', 213 => '', 103 => 'g', 214 => '', 104 => 'h', 215 => '', 105 => 'i', 216 => '', 106 => 'j', 217 => '', 107 => 'k', 218 => '', 108 => 'l', 219 => '', 109 => 'm', 220 => '', 110 => 'n', 221 => '', 111 => 'o', 222 => '', 112 => 'p', 223 => '', 113 => 'q', 224 => '', 114 => 'r', 225 => '', 115 => 's', 226 => '', 116 => 't', 227 => '', 117 => 'u', 228 => '', 118 => 'v', 229 => '', 119 => 'w', 230 => '', 120 => 'x', 231 => '', 121 => 'y', 232 => '', 122 => 'z', 233 => '', 123 => '{', 234 => '', 124 => '|', 235 => '', 125 => '}', 236 => '', 126 => '~', 237 => '', 127 => '?', 238 => '', 128 => '&#128;', 239 => '', 129 => '&#129;', 240 => '', 130 => ',', 241 => '', 131 => 'f', 242 => '', 132 => ',,', 243 => '', 133 => '...', 244 => '', 134 => '?', 245 => '', 135 => '?', 246 => '', 136 => '^', 247 => '', 137 => '?', 248 => '', 138 => 'S', 249 => '', 139 => '<', 250 => '', 140 => 'OE', 251 => '', 141 => '&#141;', 252 => '', 142 => '&#142;', 253 => '', 143 => '&#143;', 254 => '', 'amp' => '&' ); my $string = 'http://www.dns&#16;#2;&#5;&#5;&#5;&#16;&#2;&#16;&#5;&#16 +;&#16;&#16;&#5;&#5;&#16;&#2;&#16;&#16;&#2;&#16;&#16;&#2;magicsite.net +&amp;1085287724@1085287723&amp;1063256813@3493727992?75541114&amp;pro +xy=1063256794?1085287723@1063256813?www.su2537.tw|www.&#16;&#2;&#5;&# +5;&#5;&#16;&#16;&#16;&#5;&#5;&#16;&#2;&#16;&#16;&#2;&#16;&#16;&#2;.hk +?/proxy=1063256803@2204624165:2030@2204624133?/@1085307406:8080@10853 +05176@%31%30%38%35%33%30%35%31%36%35'; $string =~ s|\&(\S+)\;|$chars{$1}|g; print $string . "\n"; exit 0;

Log In?
Username:
Password:

What's my password?
Create A New User
Node Status?
node history
Node Type: note [id://30534]
help
Chatterbox?
and the web crawler heard nothing...

How do I use this? | Other CB clients
Other Users?
Others musing on the Monastery: (8)
As of 2015-07-04 08:35 GMT
Sections?
Information?
Find Nodes?
Leftovers?
    Voting Booth?

    The top three priorities of my open tasks are (in descending order of likelihood to be worked on) ...









    Results (58 votes), past polls