DEV Community: MuneebAhmedKhan-writing

One Address, Many Spellings: CIDR Host Counts and the Loopback Notations SSRF Filters Miss

MuneebAhmedKhan-writing — Sat, 22 Aug 2026 10:37:22 +0000

A number has one value and many notations. This walks through counting usable hosts in a CIDR block from memory, then writing 127.0.0.1 five ways — the set a filter that pattern-matches on notation, rather than resolving to the value, fails to catch.

Prerequisites

Comfort with powers of two up to 2²⁴
A calculator for the large multiplications
No tools, VM, or network — this is math and notation only
Prior exposure to what SSRF is, and why loopback is the target of a bypass

Part 1 — CIDR host counts

The method, once: 32 − prefix = free bits, then 2^(free bits) − 2. The −2 removes the network address and the broadcast address, neither assignable to a host. This holds for /30 and larger; /31 and /32 are special cases, covered at the end of this part.

1. Compute /24.

32 − 24 = 8 free bits → 2⁸ = 256 → 256 − 2 = 254 usable hosts.

2. Compute /16.

32 − 16 = 16 free bits → 2¹⁶ = 65,536 → 65,534 usable hosts.

3. Compute /8.

32 − 8 = 24 free bits → 2²⁴ = 16,777,216 → 16,777,214 usable hosts (~16.7 million).

4. State the pattern.

Every 1 you subtract from the prefix doubles the host count: /24 → /23 goes from 254 to 510, and on up. Remember the doubling and you never need the table.

5. Note the two special cases.

A /31 has no room for the −2 — it would compute to zero. RFC 3021 instead makes both addresses usable, giving 2 hosts, because point-to-point links don't need a network or broadcast address. A /32 is a single host: one address, no subtraction. Below /30, the −2 rule stops applying.

Part 2 — Five spellings of 127.0.0.1

Each octet has a positional value: 256³, 256², 256¹, 256⁰. Every representation below points at the same loopback address.

1. As a single decimal integer.

127 × 256³ + 0 × 256² + 0 × 256¹ + 1 × 256⁰
= 127 × 16,777,216 + 1
= 2,130,706,433

→ 2130706433. Some parsers accept this bare integer as a host — which ones is exactly what a bypass attempt is testing.

2. As hex.

Two hex digits per octet, concatenated: 127 = 7f, 0 = 00, 0 = 00, 1 = 01 → 0x7f000001.

3. As octal.

Each octet in base 8, with a leading zero to signal octal: 127 = 0177, so 0177.0.0.1. The leading zero is load-bearing — without it the octet is read as decimal, and 177 is a different value.

4. As the short form.

127.1. Parsers using the traditional inet_aton behavior read the final part as a 24-bit value filling the remaining octets, so 127.1 resolves to 127.0.0.1.

5. As the two IPv6 forms — and know the difference.

[::1] is IPv6's own native loopback: not a conversion of the IPv4 address, its own separate concept. [::ffff:127.0.0.1] is an IPv4-mapped IPv6 address, embedding the actual IPv4 address inside IPv6 syntax. They are not interchangeable, and a filter may handle one but not the other.

Why the list exists.

A filter written as if "127.0.0.1" in url: block checks one spelling of an address that has many. Each of the five forms above reaches the identical machine while walking straight past that check.

Verification check

Reverse the decimal conversion: 2,130,706,433 ÷ 16,777,216 = 127 remainder 1. The whole-number quotient is the first octet, the remainder resolves to the last — confirming 127.x.x.1. If the quotient isn't exactly 127, recheck the arithmetic before trusting the value.

Troubleshooting

These are the traps inherent to the math, not runtime errors — there's nothing to run.

Host count off by two.

The −2 was skipped or applied twice. It removes exactly two reserved addresses (network + broadcast) for /30 and larger. Sanity anchor: a /30 has 4 total, 2 usable. If you're working below /30, use the special cases in Part 1, step 5 instead.

Octal form read as decimal.

Dropping the leading zero — 177.0.0.1 instead of 0177.0.0.1 — changes the value: 177 decimal is a different address. The zero is what signals base 8.

Treating [::1] as a conversion of 127.0.0.1.

It isn't derived from the IPv4 address; it's IPv6's separate loopback. The genuine cross-protocol encoding is [::ffff:127.0.0.1]. Conflating the two produces a bypass list that misrepresents what each entry is — which matters when you're explaining a filter gap in a report.

Closing

CIDR math and the loopback notation list look unrelated, but both come down to one habit: a number has a single value and many notations, and anything that pattern-matches on notation instead of resolving to the value is the thing you're looking for.

Drafted and revised with Claude; all math verified by me.

Downloading and Running a Kali Linux VM in VirtualBox on Windows

MuneebAhmedKhan-writing — Sat, 22 Aug 2026 10:21:06 +0000

By the end of this guide you will have VirtualBox installed and a Kali Linux virtual machine imported and running — an isolated environment for security practice that leaves your host system untouched.

Prerequisites

Windows 11 Pro (64-bit)
At least 8 GB RAM, so you can give the VM 4 GB and leave the host enough
30 GB free disk space (the VM's disk grows as you install tools — more headroom is better)
Hardware virtualization (VT-x or AMD-V) enabled in BIOS/UEFI
7-Zip, for extracting the archive
No prior virtualization experience required

Steps

1. Download VirtualBox.

Get it from the official site, virtualbox.org/wiki/Downloads. Use the Windows hosts package. Avoid third-party mirror and download sites — a virtualization host is not something to install from an unverified source.

2. Install VirtualBox.

Run the installer with default options. Expect: a brief network interruption partway through, which is normal — the installer adds virtual network adapters.

3. Download the Kali VirtualBox image.

Get it from kali.org/get-kali/ and choose the VirtualBox 64-bit image, a .7z archive of several GB. Note the SHA256 value shown on the download page.

4. Verify the checksum before extracting.

Open PowerShell in your download folder and run:

Get-FileHash kali-linux-*-virtualbox-amd64.7z -Algorithm SHA256

Expect: a hash that matches the value on Kali's page exactly. If it doesn't match, delete the file and download again — do not extract it.

5. Extract the archive.

Right-click the .7z file and extract it with 7-Zip. Expect: a folder containing a .vbox file and a large .vdi disk image.

6. Add the VM to VirtualBox.

Open VirtualBox, click Add (the machine menu, not File → Import Appliance), and select the .vbox file from the extracted folder. Expect: the VM appears in the left-hand list.

If your download extracted to a single .ova file instead of a .vbox + .vdi pair, use File → Import Appliance and select the .ova. Kali ships the prebuilt image in either form depending on the release; the rest of this guide is the same once the VM is in the list.

7. Check the allocated resources.

Right-click the VM, open Settings, then System → Motherboard for RAM and System → Processor for CPU cores. Keep RAM at or below half your host's total, and leave at least two cores for the host. Expect: the sliders stay in the green range.

8. Start the VM.

Select it and click Start. Expect: a boot sequence, then the Kali login screen.

9. Log in.

Use the default credentials, kali / kali. These are specific to Kali's prebuilt VM image — a Kali installer ISO sets its own credentials during install instead.

Verification

The VM boots to the Kali desktop and the terminal opens. Run this inside the VM:

ip a

You should see an interface with an address, confirming networking works. A VM that boots but has no network is only half-configured.

If the desktop is stuck at a small resolution or clipboard sharing doesn't work, the Guest Additions version in the image doesn't match your VirtualBox. It's not a failure — the VM is running. Reinstalling Guest Additions from the VirtualBox Devices menu fixes the display and clipboard when you want them.

Troubleshooting

VirtualBox only offers 32-bit options, or the VM fails to start.

Hardware virtualization is disabled. Reboot into BIOS/UEFI and enable VT-x (Intel) or AMD-V (AMD). The setting is usually under CPU or Advanced.

The VM starts but is extremely slow, or throws a VT-x error on Windows 11.

Hyper-V is holding the virtualization layer, and VirtualBox can't use it at the same time. Disable Hyper-V, Windows Hypervisor Platform, and Virtual Machine Platform in "Turn Windows features on or off," then reboot. Memory integrity under Windows Security → Device security → Core isolation also enables Hyper-V silently; turn it off too.

The checksum doesn't match.

Delete the file and download it again. A mismatch means the download was corrupted or the file was tampered with. Do not extract or import it either way.

The extraction fails or the folder looks incomplete.

Extract to a path with no spaces or non-English characters, and make sure you have twice the archive size free — 7-Zip needs room for both the archive and the expanded disk image.

Closing

The point of the VM is separation. Anything you install, break, or get compromised by inside Kali stays inside Kali, and the host system is never touched.

Drafted and revised with Claude; every step tested by me.

Send an HTTP Request by Hand With Netcat

MuneebAhmedKhan-writing — Sun, 16 Aug 2026 11:05:18 +0000

Type a raw HTTP request into a TCP socket, read back a real 200 OK, then watch one wrong character kill it. No browser, no library.

Prerequisites

A Linux terminal (any distro; a VM is fine)
bash or zsh
Internet access

Steps

1. Check for netcat and identify the variant.

which nc && nc -h 2>&1 | head -1

Expect: a path such as /usr/bin/nc, then a line naming the build — OpenBSD netcat or Ncat 7.xx. Write down which one; steps 11 and 12 use a different flag on each. Anything else, such as a bare version like [v1.10-47], is netcat-traditional — use the flags exactly as written. If nothing prints, continue to step 2. Otherwise skip to step 3.

2. Install netcat.

sudo apt install netcat-openbsd     # Debian, Ubuntu
sudo dnf install nmap-ncat          # Fedora, RHEL

On other distros, install your package manager's OpenBSD netcat package. Re-run step 1. Expect: a path and a variant name.

3. Confirm outbound port 80 works.

nc -vz example.com 80

Expect: a success message naming the port. A timeout or a name-resolution error means your network blocks outbound port 80 or cannot resolve the host — nothing below will work until you move to a network that permits both. If -z is rejected, see Troubleshooting.

4. Store the request.

REQ='GET / HTTP/1.1\r\nHost: example.com\r\nConnection: close\r\n\r\n'

Use single quotes. They stop the shell from expanding anything inside the string, which matters once you add header values containing $ or a backtick.

5. Send the request.

printf '%b' "$REQ" | nc example.com 80 | tee response.txt

%b makes printf interpret the \r\n escapes instead of printing them as text; tee writes to the file and the screen at once.

Expect: HTTP/1.1 200 OK, a block of headers, a blank line, then HTML. The body scrolls past — read it from the file in the steps below. Re-running overwrites the file.

6. Read the status line.

head -1 response.txt

Expect: three parts in order — protocol version, status code, reason phrase.

7. Read the header block.

sed -n '1,/^\r$/p' response.txt

Look for Content-Length or Transfer-Encoding, and for Allow. Any of them may be absent.

8. Open the whole response.

less response.txt

Every header line ends in ^M, as do the chunk-size lines further down. That is the carriage return you sent, not corruption. Press q to exit.

9. Find the first line after the headers.

sed -n '/^\r$/{n;p;q;}' response.txt

The {n;p;q;} advances one line past the blank line, prints it, and stops. Applies only if step 7 showed Transfer-Encoding: chunked. Expect: a short hex number such as 22f.

10. Read the end of the response.

tail -2 response.txt

Applies only to a chunked response. Expect: a lone 0, then a line that looks blank. It isn't — it holds the carriage return from the terminating chunk's own CRLF, the same ^M you saw in step 8.

11. Break the terminator on purpose.

BAD='GET / HTTP/1.1\r\nHost: example.com\r\nConnection: close/r/n/r/n'
printf '%b' "$BAD" | nc -w 5 example.com 80

On nmap-ncat, use -i 5 instead of -w 5 — its -w times the connect only and will not close an idle socket.

Expect: nothing — no status line, no error, no body. The flag closes the socket after five idle seconds. Press Ctrl+C to exit early.

Silence is what you see inside that window. Drop the timeout and wait, and some servers eventually answer 408 Request Timeout — the same finding stated differently. The server never saw a complete request.

12. Repeat with more headers.

BAD='GET / HTTP/1.1\r\nHost: example.com\r\nUser-Agent: curl\r\nAccept: */*\r\nConnection: close/r/n/r/n'
printf '%b' "$BAD" | nc -w 5 example.com 80

Same flag swap as step 11 on nmap-ncat. Expect: identical silence. Four headers behave exactly like two.

Verification check

printf '%b' "$REQ" | nc example.com 80 | head -1

Exactly one line prints: HTTP/1.1 200 OK. Anything else means the request is malformed. If nothing prints, re-run step 3 — a success there means the port is open and the fault is in your request.

Troubleshooting

No output — the command sits, then returns to the prompt.
Copy the command rather than retyping it. The terminator needs backslashes: \r\n\r\n. printf gives forward slashes no special meaning, so /r/n/r/n lands inside the last header value as text and the terminator never gets sent.

Nothing happens and echo "$REQ" prints an empty line.
Re-run step 4. Shell variables do not survive a new terminal window or tab.

Step 11 or 12 hangs and never returns.
You are on nmap-ncat, where -w covers the connect only. Use -i 5. Ctrl+C to break out of the current run.

Your netcat rejects -z as an unknown option.
Not all builds include it. Use nc -vw 5 example.com 80 < /dev/null instead. -w is correct on every variant here, since this test only needs the connect to succeed or fail. The -v prints the result — without it you get silence whether the port is open or closed.

You expected 400 Bad Request and got silence.
Treat the hang as the normal symptom of a broken terminator, not a network fault. With no terminator, the server has nothing to reject — it is still listening.

Header values are not parsed as expected.
Put one space after every colon when you add your own headers. Host:example.com is widely tolerated but not guaranteed.

Closing

One wrong character — / for \ — is the difference between a page and total silence. HTTP is plain text over a socket, and it has no tolerance for text that is almost right.

Drafted and revised with Claude; every command tested by me.

Organizing Bug Bounty Notes in Obsidian: A Vault Structure for Beginners

MuneebAhmedKhan-writing — Sun, 09 Aug 2026 19:25:25 +0000

By the end of this guide, you will have a working Obsidian vault structured for bug bounty research, with a reusable target template you can drop into every new target note instead of rebuilding structure from scratch each time.

Prerequisites

Obsidian installed (any OS). No prior Obsidian experience required.

Steps

Download Obsidian from obsidian.md and open it. The first screen gives you the option to create a new vault. Name it something dedicated to security research, such as security-notes, kept separate from your personal notes.
Click the new folder icon in the left sidebar and create three folders: Targets, Methodology, and Templates.
Create a note called Target Template inside Templates, and give it a reusable structure:

## Scope
- 

## Subdomains Found
- 

## Endpoints Tested
- 

## Findings
- 

## Status
- [ ] Recon
- [ ] Testing
- [ ] Reporting
- [ ] Submitted

Create a new note inside Targets for an actual target. Type [[ and Obsidian auto-pairs it to [[]], placing your cursor in the middle. Type the note name, Target Template, and select it from the dropdown. This creates a link: [[Target Template]].
Clicking that link navigates you away to the template note, which is not what you want for a reusable structure. Instead, use ![[Target Template]] to embed the full content directly into the new note.

Verification

The new target note shows the full template content inline, including headings, checklist, and sections, without needing to open a separate note.

Troubleshooting

Typing [[ auto-pairs to [[]]. This is expected, not an error; your cursor sits ready in the middle.
Clicking a [[link]] navigates away to the linked note, which is not what you want for a reusable template.

Fix

Use ![[Target Template]], with the exclamation mark and no space, to embed the note instead of linking to it.

Outlined and reviewed with Claude; written and tested by me.

Capturing Your First Web Request with Wireshark on Windows

MuneebAhmedKhan-writing — Fri, 07 Aug 2026 03:08:24 +0000

A live packet capture in Wireshark, filtered down to a single request and response, so you can see exactly what your browser sends and receives at the network level.

Prerequisites

Windows 11 Pro (64-bit), Wireshark installed, connected to Wi-Fi. No prior networking experience required.

Steps

Open Wireshark. You will see a list of interfaces (Wi-Fi, Ethernet, Loopback) with live traffic graphs.
Double-click your Wi-Fi interface to start capturing.
Open your browser and visit http://example.com.
Return to Wireshark and click the red square to stop the capture.
In the display filter bar, type http and press Enter to narrow the list to HTTP traffic.
Find your GET request to example.com in the list, right-click it, and choose Conversation Filter → TCP to isolate just that exchange.
Click on the GET request packet, then expand Hypertext Transfer Protocol in the details pane to see the request.
Click on the matching 200 OK response packet to see the reply.

Verification

The filtered list shows a short, self-contained exchange: a few TCP setup packets, one GET request, and one 200 OK response, instead of the full, unfiltered flood of background traffic.

Troubleshooting

The unfiltered capture shows an overwhelming number of unrelated IP addresses moving constantly. This is normal background traffic (Windows Update, background apps), not something you did wrong. Filtering with http and Conversation Filter narrows it to what matters.
The first HTTP packet you click on may not be your own browser traffic at all. Windows generates its own background HTTP traffic, such as update checks. Generate your own traffic deliberately by visiting a known site, rather than clicking the first packet you see.

Outlined and reviewed with Claude; written and tested by me.

Intercepting Your First Request with Burp Suite Community Edition on Windows

MuneebAhmedKhan-writing — Thu, 06 Aug 2026 16:12:14 +0000

By the end of this guide, you will have a working Burp Suite setup that intercepts, freezes, and forwards live web traffic. This is the foundational skill every web app security exercise afterward depends on.

Prerequisites

Windows 11 Pro (64 bit), Burp Suite Community Edition installed. No prior networking or proxy experience required.

Steps

Launch Burp, choose Temporary Project, use Burp defaults, and click Start Burp.
Confirm the proxy listener is active. Go to Proxy → Proxy Settings and check that 127.0.0.1:8080 is enabled.
Open Burp's built in browser. Go to Proxy → Intercept → Open Browser. This avoids manual proxy and certificate setup entirely, which makes it the simplest starting point for a beginner.
Turn Intercept on.
Visit a test site, for example http://example.com, and watch the request freeze in Burp.
Forward the request in the Intercept tab and confirm the page loads.
Check Proxy → HTTP History to see the logged request.

Verification

The frozen raw HTTP request appears in the Intercept tab. After forwarding, the same request shows up in HTTP History with the full request and response detail.

Troubleshooting

If the site does not freeze in Intercept, the most common cause is browser cache. If you have visited the site before in the same browser session, it may load from cache instead of sending a new network request. Fix this by disabling cache in DevTools (F12 → Network → Disable cache), doing a hard reload with Ctrl+Shift+R, or clearing browser history and cache.
Intercept and Intruder are easy to confuse. Intercept, under the Proxy tab, freezes live traffic. Intruder is a separate tool for automated attacks and shows nothing unless you send a captured request to it manually.
Testing against major sites like Google can trigger CAPTCHA or bot detection pages, since proxied traffic looks suspicious to sites with strong bot protection. Stick to neutral test domains like example.com while learning.

Written while learning web application security. More tutorials from this journey coming soon.

Outlined and reviewed with Claude; written and tested by me.