Skip to content

Bug report: IP Address extraction is not consistent when IPv4 address contains leading zeros #2008

Open
@ericli-splunk

Description

@ericli-splunk

Describe the bug
When an IPv4 address contains a leading 0, many tools treat it as octal representation (e.g. https://superuser.com/a/857618). However, when extracting IP addresses using CyberChef, some octal IP addresses are extracted (e.g. 011.012.013.014), but some are not (e.g. 0377.0377.0377.0377).

To Reproduce
Steps to reproduce the behaviour or a link to the recipe / input used to cause the bug:

  1. Go to https://gchq.github.io/CyberChef/#recipe=Extract_IP_addresses(true,false,false,false,false,false)&input=OS4xMC4xMS4xMgowMTEuMDEyLjAxMy4wMTQKCjI1NS4yNTUuMjU1LjI1NQowMzc3LjAzNzcuMDM3Ny4wMzc3Cg
  2. See that 011.012.013.014 appears in the Output, but not 0377.0377.0377.0377.

Expected behaviour
Either both 011.012.013.014 and 0377.0377.0377.0377 appear in the Output, or neither.

Screenshots
Image

Desktop (if relevant, please complete the following information):

  • OS: macOS
  • Browser: Chrome 134
  • CyberChef version: 10.19.4

Additional context
The root cause is likely this regular expression:

ipv4 = "(?:(?:\\d|[01]?\\d\\d|2[0-4]\\d|25[0-5])\\.){3}(?:25[0-5]|2[0-4]\\d|[01]?\\d\\d|\\d)(?:\\/\\d{1,2})?",

Metadata

Metadata

Assignees

No one assigned

    Labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions