TechKnowSurge
TechKnowSurge Catalog Videos DEMO: URL Obfuscation
VideoSecurityFree

DEMO: URL Obfuscation

URL obfuscation is a social engineering technique that disguises a link's true destination by manipulating the structure of a URL, redirecting users to malicious sites without their knowledge.

⚑ Complete this video to capture a CTF flag worth 1 point.

About this video

URL obfuscation is a deception technique that takes advantage of the structural rules governing uniform resource locators and uniform resource identifiers to hide a link's true destination. A URL identifies a resource on the internet by specifying a protocol, a host, and a path to a specific file or query. A URI extends that structure to optionally include a username, separated from the host by an @ symbol, and it is this element that attackers exploit. Because everything before the @ is treated as a user credential rather than a domain, a crafted link can display a trusted domain name like google.com in the visible portion of the URL while directing the browser to an entirely different host placed after the @. To make the malicious destination even harder to detect, attackers can encode the target IP address in formats other than standard decimal notation. The same address can be expressed in hexadecimal, octal, or a mixture of both, all of which resolve correctly in a browser but are far less recognizable to a typical user. Alternatively, a seemingly unrelated domain name can be used in place of the IP address entirely. Each of these variations produces the same result: the browser silently redirects to the attacker's chosen destination while the user believes they are navigating to a legitimate site. Recognizing these obfuscation patterns is an essential skill for identifying phishing attempts and other URL-based social engineering attacks.

What you'll learn

What's covered

URL Obfuscation

Key terms

Phishing
A social engineering attack that uses deceptive emails or messages to trick users into revealing sensitive information.
Social Engineering
A manipulation technique that exploits human psychology to trick individuals into revealing confidential information.
URL Obfuscation
A technique that disguises a URL's true destination by encoding the target address using methods such as hexadecimal, octal, or username-field embedding to deceive users.
Uniform Resource Locator
URL
A standardized address used to identify and locate specific resources on the web, consisting of components such as schema, host, directory, and file path.
Hexadecimal Encoding
A base-16 numbering system used in URL obfuscation to represent IP address octets as hex values, masking the true destination from users.
Octal Encoding
A base-8 numbering system used in URL obfuscation to represent IP address octets as octal values, concealing the actual target address.
Spoofing
An attack where an adversary impersonates a trusted entity by falsifying data such as an IP address or email address.

Topics

Url Obfuscation Social Engineering Phishing Cybersecurity Hexadecimal Encoding Web Security

Transcript

One way a user can be tricked is through something called URL obfuscation. Obfuscation just means not easily expressed or understood. It's a way to obscure things, to make things a little more hidden.

What a URL is

From the URL perspective, URL stands for uniform resource locator. So what does it locate? Resources. This is a uniform way to identify resources and locate them, and specifically it's on the internet. So this is what we have to locate and go to a site and the resources of that site.

So we've got the site itself, the domain that we're going to, and we've got some sort of directory that it's going to be in, the file that we're accessing, any kind of query or fragment that we're accessing of that, and what is the protocol that we're using to communicate back and forth.

URLs are based off of a format called URI, or uniform resource identifier, so these can be used in a lot of different areas. A URI actually has a few more aspects to it, and I've included one of those aspects of being a user in here. What we can see here is that it has the schema, where we identify what is the protocol being used; a user, separated by the at sign; the host that we're accessing, and it could be by an IP address or it could be by domain; then, once again, the directories, files, any kind of queries or fragments that are part of that. So we can identify exactly what resource we're locating and what information we're looking for.

Hiding the real site after the at sign

URL obfuscation is the obfuscation, or hiding, of things within the URL, and there are some ways to do that because of the format. So let's say we want to go to google.com. Typically, a lot of times there's something at the end of it — if we're doing some sort of search or something, then we'll see something at the end of it. But what we can do to obfuscate or hide what the true site is is we can bury it after the at sign. Remember, anything before the at on the URI means that this is the user side of things, and so then this is the actual site. So now the at means that the browser thinks that this is going to be a user, and then this is where we're actually going to be directed to.

I'm on a demo machine here and I'm going to bring up a browser. There's a website here, 10.1.30.23. Let's say there's some sort of malicious software that's on this site and we want to get people to click on it, but we want to hide the URL. We want to obfuscate it so that way it's hidden what site they're actually going to go to.

So if I just type in www.google.com and hit enter, it brings me to Google. Now instead, what we're going to do is we're going to do an at and we're going to do that IP address, so 10.1.30.23. It's not going to respond to HTTPS, so I'm going to delete the S off of there so it can respond to HTTP, and then I'll hit enter. Notice now it doesn't bring me to Google. It brings me to that 10.1.30.23 site.

Hex, octal and name resolution

To further trick the user, we don't necessarily have to use an IP address. I mean, that kind of sticks out. So what we could do is we could change it. This one right here is using hex values. Notice that we've got periods here, so it's separating things out by a hex value, and the 0x at the beginning of this is specifying a hex value for it.

Here, right here, we actually got octal. So if we've got four digits here, it's representing octal, and so that's hidden as well. It looks a little different as well. Or we can intermix the two. Notice we're doing a hex on the first octet and then octal in the second and then hex again, then octal. You can also do some sort of name resolution on this, so in this case right here, it's going to techknowsurge.com.

So here are those different variations. Let's try this out. The first one is 10.1.30.23 — in fact, we already did that one, so I won't do that one again. This next one is in the hex value, so I'm going to paste it in here and hit enter, and notice it brings me to that same site. The next one is an octal, so we'll paste it in here: same site. The next one here is going to the kind of mix-up there, so the ones that have both hex and octal. And then the last one: I don't have name resolution for this 10.1.30.23, so I'm just going to direct us to the techknowsurge.com website. So I'm going to copy that, paste it in here.

This is an example of how it can redirect a user who thinks that they're going to Google, but it redirects them to another site. So here's that attack card on URL obfuscation. What we're doing is, it looks like we're going to google.com, but instead we're actually redirecting them to another site of our choosing. So what we're doing is the URL's true destination is hidden to deceive a user.

About TechKnowSurge

TechKnowSurge builds IT and cybersecurity professionals through hands-on, concept-first training built around real understanding — not memorization. Free interactive tools, structured programs, and 25+ years of real-world experience, all in one place.

Explore free tools and programs →