Beefy Boxes and Bandwidth Generously Provided by pair Networks
Perl: the Markov chain saw
 
PerlMonks  

RE: Take a bite out of my SPAM please

by araqnid (Beadle)
on Aug 31, 2000 at 18:57 UTC ( #30534=note: print w/ replies, xml ) Need Help??


in reply to Take a bite out of my SPAM please

hmm..

s|&#(\d+);|pack("c",$1)|ge
ought to work but that produces a bunch of control characters. so there's obviously a subtlety i've missed


Comment on RE: Take a bite out of my SPAM please
Download Code
RE: RE: Take a bite out of my SPAM please
by mdillon (Priest) on Aug 31, 2000 at 19:28 UTC
    no, you haven't missed anything. the entities , , and  all encode ASCII control characters. i don't think that this string can be turned into a navigable URL using only generic conversions. my guess is that the URL in the form is converted with JavaScript or something to allow to browser to use it as a FORM target.

    i did a couple more conversions and got a bit more intelligible stuff out. here are the other conversions i ran:

    $URL =~ s/&/&/g; # numeric entities $URL =~ s/&#(\d+);/pack('c', $1)/ge; # hex escapes $URL =~ s/%(\d{2})/pack('c', $1)/ge; # 'decimal' IP $URL =~ s/(\d{5,})/join('.', unpack('C4', pack('N', $1)))/ge;
    the result was this (after running it through 'od -c'):
    0000 h t t p : / / w w w . d n s 020 002 0020 005 005 005 020 002 020 005 020 020 020 005 005 020 002 020 020 0040 002 020 020 002 m a g i c s i t e . n e 0060 t & 6 4 . 1 7 6 . 4 5 . 4 4 @ 6 0100 4 . 1 7 6 . 4 5 . 4 3 & 6 3 . 9 0120 6 . 2 . 2 3 7 @ 2 0 8 . 6 2 . 1 0140 4 . 2 4 8 ? 4 . 1 2 8 . 1 7 0 . 0160 1 2 2 & p r o x y = 6 3 . 9 6 . 0200 2 . 2 1 8 ? 6 4 . 1 7 6 . 4 5 . 0220 4 3 @ 6 3 . 9 6 . 2 . 2 3 7 ? w 0240 w w . s u 2 5 3 7 . t w | w w w 0260 . 020 002 005 005 005 020 020 020 005 005 020 002 020 020 002 0300 020 020 002 . h k ? / p r o x y = 6 3 0320 . 9 6 . 2 . 2 2 7 @ 1 3 1 . 1 0 0340 3 . 2 2 9 . 3 7 : 2 0 3 0 @ 1 3 0360 1 . 1 0 3 . 2 2 9 . 5 ? / @ 6 4 0400 . 1 7 6 . 1 2 2 . 1 4 : 8 0 8 0 0420 @ 6 4 . 1 7 6 . 1 1 3 . 8 8 @ 037 0440 036 & # ! 036 # 037 $ # \n 0452

    the main points of interest are the apparent IP addresses:

    • 64.176.45.44
    • 64.176.45.43
    • 63.96.2.237
    • 208.62.14.248
    • 4.128.170.122
    • 63.96.2.218
    • 131.103.229.37:2030
    • 131.103.229.5
    • 64.176.122.14:8080
    • 64.176.113.88

    after checking a few of these out with reverse DNS and whois.arin.net, i've come to the conclusion that it's all just random garbage. i don't think that the alleged IP addresses are owned by affiliated entities, and none of them seem to be porn sites, so i think it's just someone mucking about.

      I tried some slightly different approaches, but didn't come up with anything that looked much more usable:

      Output 1 (using araqnid's sub):
      http://www.dnsmagicsite.net&1085287724@1085287723 &1063256813@3493727992?75541114&proxy=1063256794? 1085287723@1063256813?www.su2537.tw|www..hk?/ proxy=1063256803@2204624165:2030@2204624133?/ @1085307406:8080@1085305176@%31%30%38%35%33%30%35%31%36%35

      Output 2 (using a character map):
      http://www.dns.hk?/proxy=1063256803@2204624165: 2030@2204624133?/@1085307406:8080 @1085305176@%31%30%38%35%33%30%35%31%36%35

      I've included the character map below FWIW.

      my %chars = ( 32 => '', 143 => '143', 33 => '!', 144 => '144', 34 => '"', 145 => '`', 35 => '#', 146 => "'", 36 => '$', 147 => '"', 37 => '%', 148 => '"', 38 => '&', 149 => '*', 39 => "'", 150 => '-', 40 => '(', 151 => '-', 41 => ')', 152 => '~', 42 => '*', 153 => '[tm]', 43 => '+', 154 => 's', 44 => ',', 155 => '>', 45 => '-', 156 => 'oe', 46 => '.', 157 => '&#157;', 47 => '/', 158 => '&#158;', 48 => '0', 159 => 'Y', 49 => '1', 160 => "'", 50 => '2', 161 => '', 51 => '3', 162 => '', 52 => '4', 163 => '', 53 => '5', 164 => '', 54 => '6', 165 => '', 55 => '7', 166 => '', 56 => '8', 167 => '', 57 => '9', 168 => '', 58 => ':', 169 => '', 59 => ';', 170 => '', 60 => '<', 171 => '', 61 => '=', 172 => '', 62 => '>', 173 => '', 63 => '?', 174 => '', 64 => '@', 175 => '', 65 => 'A', 176 => '', 66 => 'B', 177 => '', 67 => 'C', 178 => '', 68 => 'D', 179 => '', 69 => 'E', 180 => '', 70 => 'F', 181 => '', 71 => 'G', 182 => '', 72 => 'H', 183 => '', 73 => 'I', 184 => '', 74 => 'J', 185 => '', 75 => 'K', 186 => '', 76 => 'L', 187 => '', 77 => 'M', 188 => '', 78 => 'N', 189 => '', 79 => 'O', 190 => '', 80 => 'P', 191 => '', 81 => 'Q', 192 => '', 82 => 'R', 193 => '', 83 => 'S', 194 => '', 84 => 'T', 195 => '', 85 => 'U', 196 => '', 86 => 'V', 197 => '', 87 => 'W', 198 => '', 88 => 'X', 199 => '', 89 => 'Y', 200 => '', 90 => 'Z', 201 => '', 91 => '[', 202 => '', 92 => "\\", 203 => '', 93 => ']', 204 => '', 94 => '^', 205 => '', 95 => '_', 206 => '', 96 => '`', 207 => '', 97 => 'a', 208 => '', 98 => 'b', 209 => '', 99 => 'c', 210 => '', 100 => 'd', 211 => '', 101 => 'e', 212 => '', 102 => 'f', 213 => '', 103 => 'g', 214 => '', 104 => 'h', 215 => '', 105 => 'i', 216 => '', 106 => 'j', 217 => '', 107 => 'k', 218 => '', 108 => 'l', 219 => '', 109 => 'm', 220 => '', 110 => 'n', 221 => '', 111 => 'o', 222 => '', 112 => 'p', 223 => '', 113 => 'q', 224 => '', 114 => 'r', 225 => '', 115 => 's', 226 => '', 116 => 't', 227 => '', 117 => 'u', 228 => '', 118 => 'v', 229 => '', 119 => 'w', 230 => '', 120 => 'x', 231 => '', 121 => 'y', 232 => '', 122 => 'z', 233 => '', 123 => '{', 234 => '', 124 => '|', 235 => '', 125 => '}', 236 => '', 126 => '~', 237 => '', 127 => '?', 238 => '', 128 => '&#128;', 239 => '', 129 => '&#129;', 240 => '', 130 => ',', 241 => '', 131 => 'f', 242 => '', 132 => ',,', 243 => '', 133 => '...', 244 => '', 134 => '?', 245 => '', 135 => '?', 246 => '', 136 => '^', 247 => '', 137 => '?', 248 => '', 138 => 'S', 249 => '', 139 => '<', 250 => '', 140 => 'OE', 251 => '', 141 => '&#141;', 252 => '', 142 => '&#142;', 253 => '', 143 => '&#143;', 254 => '', 'amp' => '&' ); my $string = 'http://www.dns&#16;#2;&#5;&#5;&#5;&#16;&#2;&#16;&#5;&#16 +;&#16;&#16;&#5;&#5;&#16;&#2;&#16;&#16;&#2;&#16;&#16;&#2;magicsite.net +&amp;1085287724@1085287723&amp;1063256813@3493727992?75541114&amp;pro +xy=1063256794?1085287723@1063256813?www.su2537.tw|www.&#16;&#2;&#5;&# +5;&#5;&#16;&#16;&#16;&#5;&#5;&#16;&#2;&#16;&#16;&#2;&#16;&#16;&#2;.hk +?/proxy=1063256803@2204624165:2030@2204624133?/@1085307406:8080@10853 +05176@%31%30%38%35%33%30%35%31%36%35'; $string =~ s|\&(\S+)\;|$chars{$1}|g; print $string . "\n"; exit 0;

Log In?
Username:
Password:

What's my password?
Create A New User
Node Status?
node history
Node Type: note [id://30534]
help
Chatterbox?
and the web crawler heard nothing...

How do I use this? | Other CB clients
Other Users?
Others lurking in the Monastery: (7)
As of 2014-11-22 00:37 GMT
Sections?
Information?
Find Nodes?
Leftovers?
    Voting Booth?

    My preferred Perl binaries come from:














    Results (118 votes), past polls