File sharing On Internet !

What is p2p ?

Peer-to-peer file sharing software (also known as P2P Software), is a very attractive way for Internet users to obtain a wealth of material from the Internet. It enables users to share content on their hard drives with others connected to the Internet at the same time. Probably the most famous and widely used file-sharing application to date has been “Napster??�. While at face value, the concept of file sharing sounds a harmless and enticing practice, users need to be aware of some hidden dangers.

The file-sharing software allows you to share content on your computer’s hard drive with other computers connected to the Internet. Essentially, it makes contact with a centralised server and uploads your list of available files. This list is made available to others who are also logged into that server. If someone wants one of those files, the server provides them with your computer’s address, so that their computer can connect directly to yours through the Internet, peer-to-peer.

P2P is a term for "peer to peer" where a client transfered directly to another client (no server required)
Bit Torrent is a method or application of delivering data between clients, its method is a P2P method.

How does one make one's computer a virtual FTP server ?

FTP= file transfer protocol.
Using FTP is like downloading from any server as you do it on internet.
How?
Get a FTP software and install.
Ask your friend to install it.
Enter your and your friend's IP.
Ask him to do so.
Softwwre will find the IP.
Will wait for confirmation.
Both sides agree ? If true.
Voila.. you r done.
Start transfer.
u nd your friend.
unlimited data.


which softwares to use ?
Lots are there. test and use.
i use bittorrent software "azerues"
Google search for "torrent softwares"
Google search for "FTP clients"


p2p softwares like kaaza , and many more will limit your file search to the users who are its members , while bittorrent system will allow you to download any file on the internet as long it is a torrent . No limitation. I suggest bittorrenting !

What is the Registry?

The Registry is a database used to store settings and options for the 32 bit versions of Microsoft Windows including Windows 95, 98, ME and NT/2000/XP. It contains information and settings for all the hardware, software, users, and preferences of the PC. Whenever a user makes changes to a Control Panel settings, or File Associations, System Policies, or installed software, the changes are reflected and stored in the Registry.

The physical files that make up the registry are stored differently depending on your version of Windows; under Windows 95 & 98 it is contained in two hidden files in your Windows directory, called USER.DAT and SYSTEM.DAT, for Windows Me there is an additional CLASSES.DAT file, while under Windows NT/2000 the files are contained seperately in the %SystemRoot%\System32\Config directory. You can not edit these files directly, you must use a tool commonly known as a "Registry Editor" to make any changes (using registry editors will be discussed later in the article).

The Structure of The Registry

The Registry has a hierarchal structure, although it looks complicated the structure is similar to the directory structure on your hard disk, with Regedit being similar to Windows Explorer.

Each main branch (denoted by a folder icon in the Registry Editor, see left) is called a Hive, and Hives contains Keys. Each key can contain other keys (sometimes referred to as sub-keys), as well as Values. The values contain the actual information stored in the Registry. There are three types of values; String, Binary, and DWORD - the use of these depends upon the context.

There are six main branches, each containing a specific portion of the information stored in the Registry. They are as follows:


* HKEY_CLASSES_ROOT - This branch contains all of your file association mappings to support the drag-and-drop feature, OLE information, Windows shortcuts, and core aspects of the Windows user interface.
* HKEY_CURRENT_USER - This branch links to the section of HKEY_USERS appropriate for the user currently logged onto the PC and contains information such as logon names, desktop settings, and Start menu settings.
* HKEY_LOCAL_MACHINE - This branch contains computer specific information about the type of hardware, software, and other preferences on a given PC, this information is used for all users who log onto this computer.
* HKEY_USERS - This branch contains individual preferences for each user of the computer, each user is represented by a SID sub-key located under the main branch.
* HKEY_CURRENT_CONFIG - This branch links to the section of HKEY_LOCAL_MACHINE appropriate for the current hardware configuration.
* HKEY_DYN_DATA - This branch points to the part of HKEY_LOCAL_MACHINE, for use with the Plug-&-Play features of Windows, this section is dymanic and will change as devices are added and removed from the system.



Each registry value is stored as one of five main data types:


* REG_BINARY - This type stores the value as raw binary data. Most hardware component information is stored as binary data, and can be displayed in an editor in hexadecimal format.
* REG_DWORD - This type represents the data by a four byte number and is commonly used for boolean values, such as "0" is disabled and "1" is enabled. Additionally many parameters for device driver and services are this type, and can be displayed in REGEDT32 in binary, hexadecimal and decimal format, or in REGEDIT in hexadecimal and decimal format.
* REG_EXPAND_SZ - This type is an expandable data string that is string containing a variable to be replaced when called by an application. For example, for the following value, the string "%SystemRoot%" will replaced by the actual location of the directory containing the Windows NT system files. (This type is only available using an advanced registry editor such as REGEDT32)
* REG_MULTI_SZ - This type is a multiple string used to represent values that contain lists or multiple values, each entry is separated by a NULL character. (This type is only available using an advanced registry editor such as REGEDT32)
* REG_SZ - This type is a standard string, used to represent human readable text values.



Other data types not available through the standard registry editors include:


* REG_DWORD_LITTLE_ENDIAN - A 32-bit number in little-endian format.
* REG_DWORD_BIG_ENDIAN - A 32-bit number in big-endian format.
* REG_LINK - A Unicode symbolic link. Used internally; applications should not use this type.
* REG_NONE - No defined value type.
* REG_QWORD - A 64-bit number.
* REG_QWORD_LITTLE_ENDIAN - A 64-bit number in little-endian format.
* REG_RESOURCE_LIST - A device-driver resource list.



Editing The Registry

The Registry Editor (REGEDIT.EXE) is included with most version of Windows (although you won't find it on the Start Menu) it enables you to view, search and edit the data within the Registry. There are several methods for starting the Registry Editor, the simplest is to click on the Start button, then select Run, and in the Open box type "regedit", and if the Registry Editor is installed it should now open and look like the image below.

An alternative Registry Editor (REGEDT32.EXE) is available for use with Windows NT/2000, it includes some additional features not found in the standard version, including; the ability to view and modify security permissions, and being able to create and modify the extended string values REG_EXPAND_SZ & REG_MULTI_SZ.

Create a Shortcut to Regedit
This can be done by simply right-clicking on a blank area of your desktop, selecting New, then Shortcut, then in the Command line box enter "regedit.exe" and click Next, enter a friendly name (e.g. 'Registry Editor') then click Finish and now you can double click on the new icon to launch the Registry Editor.

Using Regedit to modify your Registry
Once you have started the Regedit you will notice that on the left side there is a tree with folders, and on the right the contents (values) of the currently selected folder.

Like Windows explorer, to expand a certain branch (see the structure of the registry section), click on the plus sign

* to the left of any folder, or just double-click on the folder. To display the contents of a key (folder), just click the desired key, and look at the values listed on the right side. You can add a new key or value by selecting New from the Edit menu, or by right-clicking your mouse. And you can rename any value and almost any key with the same method used to rename files; right-click on an object and click rename, or click on it twice (slowly), or just press F2 on the keyboard. Lastly, you can delete a key or value by clicking on it, and pressing Delete on the keyboard, or by right-clicking on it, and choosing Delete.


Note: it is always a good idea to backup your registry before making any changes to it. It can be intimidating to a new user, and there is always the possibility of changing or deleting a critical setting causing you to have to reinstall the whole operating system. It's much better to be safe than sorry!

Importing and Exporting Registry Settings

A great feature of the Registry Editor is it's ability to import and export registry settings to a text file, this text file, identified by the .REG extension, can then be saved or shared with other people to easily modify local registry settings. You can see the layout of these text files by simply exporting a key to a file and opening it in Notepad, to do this using the Registry Editor select a key, then from the "Registry" menu choose "Export Registry File...", choose a filename and save. If you open this file in notepad you will see a file similar to the example below:

Quote:

REGEDIT4

[HKEY_LOCAL_MACHINE\SYSTEM\Setup]
"SetupType"=dword:00000000
"CmdLine"="setup -newsetup"
"SystemPrefix"=hex:c5,0b,00,00,00,40,36,02


The layout is quite simple, REGEDIT4 indicated the file type and version, [HKEY_LOCAL_MACHINE\SYSTEM\Setup] indicated the key the values are from, "SetupType"=dword:00000000 are the values themselves the portion after the "=" will vary depending on the type of value they are; DWORD, String or Binary.

So by simply editing this file to make the changes you want, it can then be easily distributed and all that need to be done is to double-click, or choose "Import" from the Registry menu, for the settings to be added to the system Registry.

Deleting keys or values using a REG file
It is also possible to delete keys and values using REG files. To delete a key start by using the same format as the the REG file above, but place a "-" symbol in front of the key name you want to delete. For example to delete the [HKEY_LOCAL_MACHINE\SYSTEM\Setup] key the reg file would look like this:

Quote:

REGEDIT4

[-HKEY_LOCAL_MACHINE\SYSTEM\Setup]


The format used to delete individual values is similar, but instead of a minus sign in front of the whole key, place it after the equal sign of the value. For example, to delete the value "SetupType" the file would look like:

Quote:

REGEDIT4

[HKEY_LOCAL_MACHINE\SYSTEM\Setup]
"SetupType"=-


Use this feature with care, as deleting the wrong key or value could cause major problems within the registry, so remember to always make a backup first.

Regedit Command Line Options
Regedit has a number of command line options to help automate it's use in either batch files or from the command prompt. Listed below are some of the options, please note the some of the functions are operating system specific.


* regedit.exe [options] [filename] [regpath]
* [filename] Import .reg file into the registry
* /s [filename] Silent import, i.e. hide confirmation box when importing files
* /e [filename] [regpath] Export the registry to [filename] starting at [regpath]
e.g. regedit /e file.reg HKEY_USERS\.DEFAULT
* /L:system Specify the location of the system.dat to use
* /R:user Specify the location of the user.dat to use
* /C [filename] Compress (Windows 9
* /D [regpath] Delete the specified key (Windows 9

Maintaining the Registry

How can you backup and restore the Registry?

Windows 95
Microsoft included a utility on the Windows 95 CD-ROM that lets you create backups of the Registry on your computer. The Microsoft Configuration Backup program, CFGBACK.EXE, can be found in the \Other\Misc\Cfgback directory on the Windows 95 CD-ROM. This utility lets you create up to nine different backup copies of the Registry, which it stores, with the extension RBK, in your \Windows directory. If your system is set up for multiple users, CFGBACK.EXE won't back up the USER.DAT file.

After you have backed up your Registry, you can copy the RBK file onto a floppy disk for safekeeping. However, to restore from a backup, the RBK file must reside in the \Windows directory. Windows 95 stores the backups in compressed form, which you can then restore only by using the CFGBACK.EXE utility.

Windows 98
Microsoft Windows 98 automatically creates a backup copy of the registry every time Windows starts, in addition to this you can manually create a backup using the Registry Checker utility by running SCANREGW.EXE from Start | Run menu.

What to do if you get a Corrupted Registry
Windows 95, 98 and NT all have a simple registry backup mechanism that is quite reliable, although you should never simply rely on it, remember to always make a backup first!

Windows 95
In the Windows directory there are several hidden files, four of these will be SYSTEM.DAT & USER.DAT, your current registry, and SYSTEM.DA0 & USER.DA0, a backup of your registry. Windows 9x has a nice reature in that every time it appears to start successfully it will copy the registry over these backup files, so just in case something goes wrong can can restore it to a known good state. To restore the registry follow these instruction:
[list=1]
* Click the Start button, and then click Shut Down.

* Click Restart The Computer In MS-DOS Mode, then click Yes.

* Change to your Windows directory. For example, if your Windows directory is c:\windows, you would type the following:

cd c:\windows

* Type the following commands, pressing ENTER after each one. (Note that SYSTEM.DA0 and USER.DA0 contain the number zero.)

attrib -h -r -s system.dat
attrib -h -r -s system.da0
copy system.da0 system.dat
attrib -h -r -s user.dat
attrib -h -r -s user.da0
copy user.da0 user.dat

* Restart your computer.



Following this procedure will restore your registry to its state when you last successfully started your computer.

If all else fails, there is a file on your hard disk named SYSTEM.1ST that was created when Windows 95 was first successfully installed. If necessary you could also change the file attributes of this file from read-only and hidden to archive to copy the file to C:\WINDOWS\SYSTEM.DAT.

Windows NT
On Windows NT you can use either the "Last Known Good" option or RDISK to restore to registry to a stable working configuration.

How can I clean out old data from the Registry?
Although it's possible to manually go through the Registry and delete unwanted entries, Microsoft provides a tool to automate the process, the program is called RegClean. RegClean analyzes Windows Registry keys stored in a common location in the Windows Registry. It finds keys that contain erroneous values, it removes them from the Windows Registry after having recording those entries in the Undo.Reg file.

top 10 hacking incidents of all time — instances where some of the most seemingly secure computer networks were compromised

Early 1990s

Kevin Mitnick, often incorrectly called by many as god of hackers, broke into the computer systems of the world's top technology and telecommunications companies Nokia, Fujitsu, Motorola, and Sun Microsystems. He was arrested by the FBI in 1995, but later released on parole in 2000. He never termed his activity hacking, instead he called it social engineering.

November 2002

Englishman Gary McKinnon was arrested in November 2002 following an accusation that he hacked into more than 90 US military computer systems in the UK. He is currently undergoing trial in a British court for a "fast-track extradition" to the US where he is a wanted man. The next hearing in the case is slated for today.

1995

Russian computer geek Vladimir Levin effected what can easily be called The Italian Job online - he was the first person to hack into a bank to extract money. Early 1995, he hacked into Citibank and robbed $10 million. Interpol arrested him in the UK in 1995, after he had transferred money to his accounts in the US, Finland, Holland, Germany and Israel.

1990

When a Los Angeles area radio station announced a contest that awarded a Porsche 944S2 for the 102nd caller, Kevin Poulsen took control of the entire city's telephone network, ensured he is the 102nd caller, and took away the Porsche beauty. He was arrested later that year and sentenced to three years in prison. He is currently a senior editor at Wired News.

1983

Kevin Poulsen again. A little-known incident when Poulsen, then just a student, hacked into Arpanet, the precursor to the Internet was hacked into. Arpanet was a global network of computers, and Poulsen took advantage of a loophole in its architecture to gain temporary control of the US-wide network.

1996

US hacker Timothy Lloyd planted six lines of malicious software code in the computer network of Omega Engineering which was a prime supplier of components for NASA and the US Navy. The code allowed a "logic bomb" to explode that deleted software running Omega's manufacturing operations. Omega lost $10 million due to the attack.

1988

Twenty-three-year-old Cornell University graduate Robert Morris unleashed the first Internet worm on to the world. Morris released 99 lines of code to the internet as an experiment, but realised that his program infected machines as it went along. Computers crashed across the US and elsewhere. He was arrested and sentenced in 1990.

1999

The Melissa virus was the first of its kind to wreak damage on a global scale. Written by David Smith (then 30), Melissa spread to more than 300 companies across the world completely destroying their computer networks. Damages reported amounted to nearly $400 million. Smith was arrested and sentenced to five years in prison.

2000

MafiaBoy, whose real identity has been kept under wraps because he is a minor, hacked into some of the largest sites in the world, including eBay, Amazon and Yahoo between February 6 and Valentine's Day in 2000. He gained access to 75 computers in 52 networks, and ordered a Denial of Service attack on them. He was arrested in 2000.

1993

They called themselves Masters of Deception, targeting US phone systems. The group hacked into the National Security Agency, AT&T, and Bank of America. It created a system that let them bypass long-distance phone call systems, and gain access to private lines.

A mass-mail worm that exploits a vulnerability in Yahoo Inc.'s Web e-mail is making the rounds, but the impact appears to be low, security vendor Symantec Corp. said Monday.

The worm, which Symantec calls JS.Yamanner@m, is different from others in that a user merely has to open the e-mail to cause it to run, said Kevin Hogan, senior manager for Symantec Security Response. Mass-mail worms have usually been contained in an attachment with an e-mail note encouraging a user to open it.

The worm, written in JavaScript, takes advantage of a vulnerability that allows scripts embedded in HTML e-mail to run in the users' browsers. Yahoo users should be able to modify their settings to block the zero-day exploit, Hogan said.

Symantec rated the worm a Level 2 threat, one notch above its least harmful ranking. Hogan said the worm did not appear to be spreading widely, and he did not anticipate the threat level rising.

When activated, the worms then sends itself to other users in the victim's address book who also use Yahoo e-mail with the suffixes of @yahoo.com or @yahoogroups.com. The worm mimics a function within Yahoo's Web mail called "Quickbuilder," which allows a user to add contacts in an address book from received e-mail, Hogan said. The process, however, is transparent to the victim, he said.

The harvested e-mail addresses are sent to a remote server. Users of Yahoo Mail Beta do not appear to be affected, Symantec said.

The worm also opens a browser that displays a Web page that does not appear to contain malicious content.

Although Yahoo's Web e-mail has not been fixed, users are advised to update virus and firewall definitions and block any e-mail sent from [email protected]. The subject line of the e-mail with the worm says "New Graphic Site," and the body says "this is test."

Yahoo officials could not immediately be reached for comment.

DO U WANT TO KNOW THE EXACT LOCATION OF YOUR CHATTING FRIEND?

HERE IS WAY TO FIND Wink

JUST FOLLOW THESE STEPS

RESTART YOUR SYSTEM, SWITCH OFF YOUR FIRWALL,ANTIVIRUS UPDATES,AND ALLL...
LOGON TO CHAT
INVITE YOUR FRIEND TO FILE TRANSFER
SHARE ANY THING WITH HIM LIKE MUSIC,PHOTO'S ANY THING
AFTER HE ACCEPT YOU TRANFER ,WHEN FILE IN TRANSFER PROGREE
OPEN "RUN" TYPE "CMD" PRESS ENTER
IN CMD TYPE THIS COMMAND "NETSTAT -N"
IT WILL SHOWS ALL IPS CONNECTING TO YOUR SYSTEM
THEN U CAN FIND EASILY FROM IP ADDRESS
AFTER THAT GO TO GOOGLE SEARCH AND PEAST THAT IP
IT IS ENOUGH IT WILL SHOW IP'S LOCATION

Obtaining other peoples passwords can sometimes be extremely difficult, but with the tools available today... it is usually trivial. This paper will cover various tools and techniques for getting those passwords. While passwords can be obtained by brute force using software such as L0phtcrack, John the Ripper, Guess, Merlin, etc. this paper documents a less intrusive style of obtaining passwords.



Introduction:

Obtaining other peoples passwords can sometimes be extremely difficult, but with the tools available today... it is usually trivial. This paper will cover various tools and techniques for getting those passwords. While passwords can be obtained by brute force using software such as L0phtcrack, John the Ripper, Guess, Merlin, etc. this paper documents a less intrusive style of obtaining passwords. The reason for this paper is not to teach script-kiddies how to obtain the passwords of others, but to teach network admin just how insecure a network can be...




Disclaimer:

The standard disclaimer applies. You do what you will and I am not responsible. If you can read this, you obviously have some form of intellect, and as such; your actions are controlled by you. Not me. This document was written under the influence of many many Corona's (with lime), as such, please do not flame me for not covering enough details, poor grammar, etc.



Concepts:

This paper mainly deals with the Data-Link layer of the OSI Model.



Data-Link Important terms and information:

MAC address (Hardware address): a 48-bit number which is supposed to be unique to each network adapter (ex. John's 3com network adapter does not have the same MAC address as Dave's 3com adapter).

Note: In Linux, you can change your adapters MAC address with the ifconfig hw class address command.

ARP (Address Resolution Protocol): Ethernet IP uses ARP to locate the hardware address of a given IP address (RFC 826). For example, a router would use an ARP request to determine the MAC address of a host with the IP address of 69.69.69.69. This would be a broadcast (sent to all hosts on the network) and only the NIC with the IP address of 69.69.69.69 would respond by sending an ARP reply to the aforementioned router. The router would then pass all traffic destined to 69.69.69.69 to that MAC address.

Example:

Router- "Who is 69.69.69.69?"

69.69.69.69 Host- "That would be me and my hardware (MAC) address is 00:XX:DB:27:XX:10"

Router- "Ok. I will add you to my ARP table and send all traffic destined to 69.69.69.69 to MAC address 00:XX:DB:27:XX:10"



ARP Table/cache: Internal database containing IP address to MAC address mappings (dynamic or static).
To view ARP tables, enter the following commands:

Cisco IOS: show arp

Linux: arp

Windows: arp -a



Switch: Works at the data-link layer (layer 2). Switches listen to network traffic and learn which MAC address/addresses reside off which ports, the switch then adds the entries to its ARP table. If a switch does not have the MAC address in it's ARP table, it will send the traffic (frame) to all ports (ie. broadcast).



Network Layer Important Terms and Information:

IP address: I'm going to assume you know what it is.



Important General terms and Information:

Man-in-the-middle (MiM): When a third-party or host relays or observes information not intended for it. By placing a computer in between communication endpoints, we see all data that passes between those endpoints. This is useful for not only observing and relaying traffic, but also for injecting commands or information into the communication channel, and for session hijacking. For example, if I installed a proxy server on a network and configured every client web browser to direct HTTP traffic to me, I could observe you trading on-line and get your username and password, etc. I may also be able to wait for you to log in and then steal that connection from you and sell off your Cisco stock to buy shares of netflood.net

While that's not likely because your not going to allow me to come in and set up a proxy server on your network and because netflood isn't a publicly traded company, all it takes is someone with the correct tools to logically (if not physically) do that on your network. This is referred to as a man-in-the-middle attack.



Details:

There are numerous man-in-the-middle attack tools, this article will only focus on tools capable of ARP spoofing/poisoning with the sole intention of obtaining passwords. ARP spoofing/poisoning is the act of pretending to be someone else by falsely sending non-requested ARP replies or by answering ARP requests regardless of what host (IP address) the communication is intended for, strictly for observing or relaying* the data that passes between the two hosts. ARP is stateless (or unreliable). It doesn't matter if a host sent an ARP request or not, it will usually accept your reply ARP (with the bogus information) regardless. ARP spoofing/poisoning can only be done on local area networks (even switched LAN's). Obviously you cannot spoof a MAC address of a host on a different network because that traffic would never be routed to you.

Note: ARP requests/replies, RARP requests/replies, etc are simply indicators in the Operation portion of an ARP packet, all we need to spoof MAC addresses is a tool which can modify the Operation portion. 1 = ARP Request, 2 = ARP Reply, 4 = RARP Request, etc.

* make sure you are forwarding the traffic if you are going to spoof the gateway. Otherwise you could hose your entire network segment (subnet).



The Tools:



Ettercap (v0.4.3) -download RPM here or TAR

An Excellent tool for sniffing networks (and password discovery). Collects passwords for the following protocols: TELNET, FTP, POP, RLOGIN, SSH1, ICQ, SMB, MySQL, HTTP, NNTP, X11, Napster, IRC, RIP, BGP, SOCKS 5, IMAP 4, VNC (other protocols coming soon...).


That means that if I am on a non-switched network and I have ettercap installed, I will get almost every password from every user on my segment (network), including MS share passwords.. A scary proposition for administrators with Linux/*BSD boxes on their network. If I am on a switched network I can poison the switch's ARP table, so that I will receive all traffic destined for the victim.



Using Ettercap:

Ettercap is relatively easy to use, in fact; I don't know how they could have made it any easier.



Synopsis:

ettercap [Option] [host:port] [host:port] [MAC] [MAC]

See man page for available options/variables



#ettercap - If you just start ettercap with no variables (options), ettercap will build a list of all hosts on your network via an ARP storm.



Choose a source and destination.



You will then be able to select the following options by typing the h key:

ARP poison for man-in-the-middle attack

IP based sniffing for sniffing traffic between IP addresses

MAC based sniffing for sniffing traffic between hardware addresses

Run a plugin to enhance ettercap functionality

check for other (ARP) Poisoner

Fingerprint an OS which is actually pretty powerful and usually correct.



Running ettercap with variables/options such as -za will cause ettercap to start in silent mode (no ARP storms) = z, ARP sniff = a and allow you to perform MiM attacks, sniffing through gateways and switches.



Dsniff: Download RPM here or Tar

Written by Dug Song

dsniff is a collection of tools for network auditing and penetration testing. dsniff, filesnarf, mailsnarf, msgsnarf, urlsnarf, and webspy passively monitor a network for interesting data (passwords, e-mail, files, etc.). arpspoof, dnsspoof, and macof facilitate the interception of network traffic normally unavailable to an attacker (e.g, due to layer-2 switching). sshmitm and webmitm implement active "monkey-in-the-middle attacks" against redirected SSH and HTTPS sessions by exploiting weak bindings in ad-hoc PKI.



As mentioned in a previous netflood article:

dsniff -w Filename.txt will write all sniffed passwords to Filename.txt

dsniff -r Filename.txt will read the file and list sniffed passwords



To arp poison, after installing dsniff:

#arpspoof -i [interface] -t [target] host

Choose interface, if necessary. Choose target, for example if I wanted to poison the ARP table on just the switch I would enter the IP address of the switch using the -t variable (it's my target). If I do not use the -t variable, I will attempt to poison all hosts on the LAN. The host is whose traffic you want to see.



Detecting ARP spoofing/poisoning:

Use the Ettercap "Detect Poisoner" option



Use Arpwatch:

Arpwatch is a tool that monitors ethernet activity and keeps a database of ethernet/ip address pairings. It also reports certain changes via email. Arpwatch requires tcpdump and libpcap. Includes FDDI support, updated ethercodes, uses autoconf.



RARP a MAC address and watch for a return of multiple IP addresses.

Telnet Explained [Part 1]
By Abhisek Datta
http://hackersclub.focusindia.com
[email protected]

Note: I have decided to launch manuals about hacking using telnet in two parts. In the first part I'll explain basics of telnet and working with telnet and in the second part I'll show some advanced methods of hacking through telnet. Further this manual is in its BETA stage and I'll be grateful for suggestions for improvements.
Part 1

Welcome to another hackersclub manual. In here I am going to figure out one the most kewl utility available under the TCP/IP set of protocols. Well I guess you peoples are familiar with TCP/IP protocols. Then also I am gonna tell you the basics of these sets of protocols. Well first of all, protocols means some rules for communication between systems over a network. TCP/IP is the most popular sets of protocols used in our current state for communication over the internet. There are various utilities under TCP/IP, some are command utilities, some are transfer utilities and some are printer utilities..

Command Base Utility : REXEC (Remote Execution) , RSH (Remote Shell) and Telnet

Transfer Utilities : FTP , RCP, TFTP
Printer Utilities : LPR, LPQ

Well all these utilities works according to the TCP/IP and obeying the protocols of TCP/IP (Transmission Control Protocol/Internet Protocol). In this manual I'll lay stress mainly on Telnet, a command base utility available under the TCP/IP set of protocols.

What is telnet?
Basically telnet a.k.a(also know as) terminal emulator is a console based tool which enables an user to use the resources of another system by connection to it using its IP address and a valid shell in the target system. Well in simpler sense telnet also works like Trojans, in client server fashion. Using a telnet client an user connects to the telnet server of a remote system running on a specified port. The default port for telnet is port 23. Well these are all about telnet in the conventional sense of term. Now I think I should tell you more about telnet in hackers sense of term.. Well to start with I must say that telnet is the ultimate tool for hackers. All big big hackers use it in exploiting loopholes in systems.. You can start telnet by going to run and type telnet and press enter. Generally in win 95/98/Me a telnet window will pop up.. but in windows xp, windows 2000 telnet will start within a dos box ie. within console.
To run telnet in console even in win 98/95,Me just copy the coding below save as i_wanna_be_a_hacker.reg and run it..

REGEDIT 4 [HKEY_USERS\S-1-5-21-1229272821-1563985344-1060284298-1003\Software\Microsoft\Telnet]"MODE"="CONSOLE"

Well you can also use that telnet available in win 98 which opens up in a separate window. Click on connect and in the host field enter the target IP. In the terminal type write vt100. Or plain and simple way.. just open DOS box.. and type telnet without <and>open anisurrahman.net
Connecting to anisurrahman.net....
Connected..
.
.
.

well now what.. now the SMTP service is mine.. I just played around with it? well if you are not used with telnet commands just type HELP after your connected and you will get the list of all the commands supported by the webserver.

Anyway I am going to show how I send a fake mail using simple commands supported by all ESMTP sever (ESMTP = Extended Simple Mail Transfer Protocol)

Here we go :
Telnet>open anisurrahman.net 25
Connecting?.
Connected to anisurrahman.net

220 Welcome to anisurrahman.net ESMTP service 8.9.3
HELO Abhisek
220 Welcome to sendmail Abhisek
MAIL FROM:[email protected]
240 Sender set to [email protected]
RCPT TO:[email protected]
240 Recipient set to [email protected]
DATA
220 End with "."
Subject : Hello Rony
Hey whats up boss? I am sending fake mail using you SMTP service? Don't be angry on me? Sorry..
.
240 CA55910 Message accepted for delivery..

Note: thinking what the values 240 , 220 or CA55910 is..
Don't think much.. the values 240 or 220 are just message code of the server. For example the server will response with 220 for displaying a banner in here.. see all the banners has come up with 220.. the server has denote confirmation with 240 in here? its not much important according to me..
And about CA55910..its the MSGID or Message ID? in the logs of the server this ID denotes the mail that you just send along.

Note: This is my earnest request to each and everybody who reads this manual.. please do not send any fake mail at [email protected] and please do not use the service at anisurrahman.net He is a very good friend of mine.. I have learnt many things regarding web designing and web programming from him..

Please note: sometimes you may get Relay Denied error on some server.. well I wont go into much details about this topic cause I guess I don't have enough knowledge about it..

Bingo !! I have send a fake mail !!! I am a hacker !!! yes !!
Well nothing to think like that cause sending fake mails doesn't make you a hacker. Well it has nothing to do with hacking. Fake mails can also easily be traced down and your ISP can be found out easily. Then if the victim sends a mail at [email protected] and complains about your activity then sorry boy you may lose you ISP account..
Anyway try sending some fake mails to yourself and get used with telnet.

Hey guys [and gals if any] don't get excited and get going to hack with telnet cause things are not that easy as it seems to be. I have made myself in only to the SMTP service of anisurrahman.net I haven't yet got root on it.

Well there are many more games which you can play using telnet. For example you can start a raw session of IRC using telnet.
I guess you all are familiar with IRC(internet relay chat). You may use mIRC, Pirc etc softwares to start an IRC session. But there you don't have to do much as the software will do things for you.
Well I think here I need to explain some basics of IRC and how IRC servers works.

Well for starting an IRC session you need to connect to an IRC server on the port running the IRC daemon. The default ports are 7000,6667 etc. in mIRC when you wish to connect to a server the default port used is 6667.
Type /server irc.dal.net [port] in mIRC window.

Note : in place of port type the port number without []

If you leave it blank then the default port will be taken as 6667.
This command will connect to irc.dal.net server then by typing /join #channelname you can join any channel and start you IRC session.

Tip : To know the IP address or the host name of a person in IRC session is the easiest. Just type /whois in the channel window and you will get his/her IP address (some types this IP is resolved into host name?it depends on the server)

Now I guess your familiar with basic IRC command which you can use in mIRC.

Now lets come to our point..ie. starting a raw IRC session using telnet.
Generally many IRC warfare technique writers or others have written many manuals on starting a raw IRC session using telnet but I think they are not really intended for newbies. In here I am going to explain things in a simple easy to understand way.

When you connect to an IRC server it authenticates you only by your username and host address and asks for a nick. While using mIRC these infos are provided by the software itself as provided by the user. But while connecting to an IRC server in raw mode.. ie. using telnet you need to provide these infos.

Note : Some servers doesn't support raw IRC session as it is quite a bit insecure..

Now to start.. telnet in to an IRC server on port 7000 or 6667

Tip: In raw mode you don't need to give a / before commands as in mIRC.

Telnet>open irc.servername.net 6667


nick

user


please note: don't give the <> sign.. I have used these signs only to distinguish the commands that I have to type in to the terminal.

you are now connected to an IRC server using telnet.. you can use mIRC commands here but without /
to send a private message the command is :

PRIVMSG NICK MESSAGE :


Now I guess you are quite familiar with the workings and usage of telnet.
With telnet you can know surely use the resources of a remote computer provided that you are allowed the access the resources?. If not? then what else but to hack into it.
Brief idea of telnet hacking (basics)

Generally telnet is used to connect to a particular daemon running on a particular port on a target system. Well the very aim of using telnet to connect to the daemons is to get root on the system. But if you are thinking that you'll connect to the SMTP server of your ISP and will get root in your ISP's system then forget it pal. What hackers do is first port scan the target system and find out the open ports and the daemons running the open ports.
Note: you can use nMAP. It is a very fast and so called SYN Stealth port scanner available for download with source file at http://www.insecure.org
but remember if your ISP kick your ass for port scanning their system then don't get flamed on me..

Now as you have found an open port say port 21 running an ftp server. Well all you need to do is to telnet in to the port. But things are not that easy and you wont get root easily.. some ftp servers or better to say 98% of the daemons running on a server allow access only to valid users thus asking for user name and password. In such case when your facing an username and password prompt either you have to make the sysadmin's daughter you girl friend and then trick her to know the password or you have to play around with other methods like brute force hacking.. etc.
Well another vulnerability existing on various daemons is the trust-relationship. Well often servers authenticates an user only by his IP considering that the server has trust-relationship with the client and the clients IP is already in the database of the trusted IP's. Now if you can spoof your IP according to one of the trusted IP's of the server then you can get yourself inside a system. Spoofing IP is a complicated subject though apparently its definition stands as "Faking the actual IP with some other". Its not really easy to spoof your IP and exploit a trust-relationship as you have to block the trusted client with DoS attack so that it cannot reply to the SYN/ACK packets send by the server to it. If it receives the SYN/ACK packets from the sever unexpectedly then surely it will reply with a FIN packet so as to end the connection.
Anyway I wont go into much details about IP Spoofing since it's a very complicated subject and you have to understand it thoroughly in order to execute it.

Note: Please don't get angry on me for using terms like SYN/ACK packets FIN Packets in the above paragraph if you are not familiar with it.. well its common terms in IP spoofing.. I just came across a very good IP Spoofing manual.. you can come across it..
"IP Spoofing Demystified" available for download in the books section of http://blacksun.box.sk

Well that's it for now.. the second part of this manual will be up soon.. if anybody of you know about some more fun with telnet do let me know about it or write an article by yourself and I'll be glad to publish it on HC

Abhisek Datta
http://hackersclub.focusindia.com
[email protected]


"But did you, in your three- piece psychology and 1950's
techno brain, ever take a look behind the eyes of the hacker?
Did you ever wonder what made him trick,
what forces shaped him, what may have molded him?
I am a hacker, enter my world..."
("The Conscience of a Hacker", The Mentor)

The ICQ Security Tutorial


Author's notes: I'm getting tired of repeating myself*, so please read my previous tutorials (located at http://blacksun.box.sk). Otherwise, you might not understand some of the terminology.
* Until recently, I had to repeat concepts and terminology that I already explained about in previous tutorials so people who are just reading my first tutorial won't have any difficulties understanding it. Well, I'm kinda tired of doing so, and I'd rather spend my precious time on writing the actual content, so please read my previous tutorials first.
Oh, by the way, I just want you to understand that I am writing this tutorial in order to teach people how to protect themselves. Also, I am not responsible for anything you do, but I do recommend that you won't start stealing everyone's passwords and flooding people etc'. Use this information in order to protect yourself.If you want to impress someone, the best way is to protect him, not to attack him. This will show your true power. Wink
Anyway, have fun!

Oh, by the way, if you're having trouble reading some parts of this tutorial, it's because some was written on a Linux box, and Windows cannot read Unix/Linux "end of line" characters properly, so you'll have to view this tutorial in a browser or an advanced editor such as Microsoft Word.

(Send comments or questions to [email protected], or post them on our message board at blacksun.box.sk)
the files mentioned in the decryption are included with 'Wang Hack FAQ volume 6' from http://www.wangproducts.co.uk

What's new in this version:
---------------------------
Version 1.2: added the "what's new" section.
Also added appendixes A and B.
Version 1.3: added appendix C.
Version 1.4: added appendix D.
Version 1.5: added appendices E and F.
Version 1.6: added appendix G.
Version 1.7: added appendix H.
Version 1.8: added appendix I.
Version 1.9: added appendix J.

Table of Contents
<What> UIN convertion by yourself
* Why would I wanna do this?
* How can I do this?

Appendix D: More fun with contact lists
* How can I easily delete someone's contact list without using a spoofer?
* How can I evade this vicious trick?

Appendix E: Incredible tricks with the ICQ protocol
* What cool tricks can I do once I learn the ICQ protocol?
* Where can I learn the ICQ protocol?

Appendix F: Reading someone's contacts and history log
* How can I read someone's contacts and history log?
* Can I also get his ICQ password that way?

Appendix G: WebIcq.com
* What is WebIcq.com?
* What's so interesting about it?

Appendix H: Cracking the ICQ Password By Yourself
* How can I fix the ICQ password all by myself, without the use of a program, once I have the DB files?

Appendix I: 00.00.00.00?? / 0.0.0.0??
* Why do I sometimes get false IPs such as 0.0.0.0?
* How can I overcome this?

Appendix J: Newer ICQ Holes
* ICQ Guestbook holes.
* ICQmail hole.

Other tutorials by BSRF
* FTP Security.
* Sendmail Security.
* Overclocking.
* Ad and Spam Blocking.
* Anonymity.
* Info-Gathering.
* Phreaking.
* Advanced Phreaking.
* More Phreaking.
* IRC Warfare.
* Proxies, Wingates and SOCKS Firewalls.
* RM Networks.
* The Windows Registry.
* Cracking, part I and II (III coming soon).
* Mailing List Security.
* HTML.
* IP Masquerading.
* Cool info about computer hardware.
* The #2,000 "bug" in IRC.
* The "javasCript" bug in Hotmail.
* Basic Local/Remote Unix Security.

What is ICQ?
===========
ICQ stands for "I Seek You" (witty little wordgame). It is an innovative program that was invented by Mirabilis (a software company, which was later sold to AOL for about 400 million U.S dollars in 1998). ICQ allows you to see whenever your best friends are online, and to communicate with them. You can send text messages, URLs, chat requests (you may have an ICQ chat with more than two users), transfer files, send greeting cards, send voice messages etc' etc' etc'. Such a program is called an "Instant Messanger".
IMHO (In My Humble Opinion) ICQ is the best instant messanger out there. It beats the hell out of other instant messangers, such as AIM (AOL Instant Messanger), Yahoo Instant Messanger, MSN Instant Messanger, Gooey (which let's you talk to other people who are on the same website as you are) etc'. ICQ also has the highest amount of users (I lost count, but you can get the current amount of users at www.icq.com).
You can download ICQ from www.icq.com or www.mirabilis.com (both domains point to the exact same server).
ICQ is available for all versions of Windows and Mac. For running ICQ under Linux, see the final notes chapter.
NOTE: if you are new to ICQ, please get used to it before you start reading this tutorial. Otherwise, you might not understand everything and get frustrated. Anyway, play around with it and see what you can do.

Why is ICQ so insecure?
=======================
ICQ, being the wonderfully innovative and useful program it is, is also quite insecure. This is because:

A) Too many operations are done by the client (client-side operations).
B) The people at Mirabilis are sloppy programmers.
Here, let me explain.
First of all, client-side operations make ICQ more vulnerable to attacks because of several reasons. Take message spoofing for example. It is possible to spoof messages (send fake messages that will appear to be sent from a different user. Don't worry, we'll get to that later) on ICQ, because ICQ will receive messages from every IP. You see, some people choose to tell their client to send their messages, while other prefer to send their messages through the server, so ICQ will simply receive messages from anyone, not only the server. If all messages were sent through the server, ICQ wouldn't have agreed to receive messages from anyone else but the server, and it would have made spoofing messages and other ICQ events (such as URLs, file transfers etc') much harder.
Another example: the next chapter discussed about fixes for ICQ. Please read it and then return back to this part (but please read the rest of this chapter first). Done already? Wow, you're quick! Have you taken any special courses or anything? Nevermind, forget it. Stupid joke... Wink
So anyway, I don't know much about software cracking, but I know that some of these fixes weren't possible to make if all the operations were done by the ICQ servers.
Take the IP unhider fix for example. Your ICQ needs other people's IP addresses in order to send them events. If sending events was possible only through the server, your ICQ client would have had to contact the server and tell it to send an event to this or that UIN, without even knowing this UIN's IP. The server, on the other hand, knows everyone's IPs, so he does the delivery for you. That way, the only way to reveal a person's IP is to have access to the server, which would certainly be much more difficult than downloading a fix and running it... Wink
Second of all, the guys at Mirabilis are quite sloppy with their programming. Don't get me wrong, I'm not saying that I'm a better programmer than them. In fact, I suck at programming. My code (in case you know nothing about programming, a source code is all that stuff programmers write all day long while sitting in front of their computer monitors. Code is a programmers' slang for source code) always looks messy and I keep forgetting what I did five minutes ago. On the other hand, I'm not saying that the people at Mirabilis are gods. Everyone makes mistakes, and I believe most of their mistakes are done because of poor beta testing (to do beta testing: the act of testing a program before it's final release to the public).
Just in case you're wondering, ICQ is not the only instant messanger out there that is vulnerable to various security holes. In fact, the least secure instant messanger is the MSN (Microsoft Network) instant messanger (shock, shock!). To learn about it's amazingly-idiotic and easily-exploitable security holes, head off to our homepage (http://blacksun.box.sk), find the Byte Me page and read about MSN instant messanger's security holes.

The fixes
==========
First of all, a fix is a small executable file that changes something in a certain program. For example: turns shareware programs (software that may be freely distributed, but has some of the most important features disabled, or stops operating after a number of days, unless you register the program using a serial number) into registered programs, gives you options you're not supposed to have etc'.
The ICQ fixes allow you to:

A) View someone's IP address, even if he turned "don't show my IP" on in his preferences menu.
B) Add someone to your contact list without authorization.
C) Run more than one ICQ at the same time (in order to use multiple UINs at the same time).
D) Add yourself to your own contact list (this becomes quite useful in protecting yourself from DB corruptions. See the spoofing chapter for more information).

If you've already read the previous chapter (why is ICQ so insecure), you should know by now why these fixes work. But if your question is how... well, I'm not exactly a "cracking guru"... I know very little about cracking (relatively, of course. I don't wanna show off, but I do know how these fixes are made, and how to operate cracking software such as SoftIce, procdump, various unpackers etc'), so I don't want to provide you with any false information. If you want cracking tutorials, I suggest going to neworder.box.sk and entering the cracking section.

However, you can find the IP by yourself, in a much cooler way than just downloading a fix.
Send a message to someone. Make sure it doesn't go through the server. If it has to, then start a chat session or a file transfer, which never go through the webserver, and then open a DOS window and type:
netstat -a
This displays all active connections. One of them should be to the guy you're messaging, and it should have his IP address.
The best way to determine which one is the guy you're messaging is to run netstat -a, then send the message and then run netstat -a again to see what has changed.

Ok, moving on. The best fix-pack for ICQ is, IMHO, IsoaQ. You can get it at http://thor.prohosting.com/~bornic. Using it is quite simple. If you have any problems with it, read the FAQ that is attached to the package (I recommend reading it anyway. It contains some interesting information).

Flooding
========
Flooding menas, of course, flooding someone else with tons of messages or any other events. There are several ways to flood someone's ICQ:

A) The first way is, of course, double-clicking someone's name in your contact list, writing a message, copying it, sending it, and then double-clicking on his name again, pressing paste, sending, double-clicking again, pressing paste, sending... as you can see, this is quite frustrating and ineffective.
B) Using a "canned" flooder (these kinds of programs are often called "canned" programs, because they come like food in a can - all you have to do is to open the can and eat. Of course, the food you cook by yourself tastes much better, and gives you much more satisfaction. Well, unless you're a bad cook... Wink ).
These flooders have been programmed by either people who learned the ICQ protocol by themselves by "eavasdropping" ICQ or setting up a fake server on their computers and listening to what ICQ does, or by other people who read some articles and tutorials and ran off to make a flooder. Also, some flooders will do much more damage. They will send as many messages as you tell them to, but instead of sending them all from one UIN, they will send them one by one, each one from a fake UIN. That way, the victim will suddently see his contact list filling with people he doesn't even know and fake UINs, and be amazed to see that each one has sent him a single identical message.
You can get a good flooder at www.warforge.com. It's a site maintained by script kiddies and for script kiddies. A script kiddie, in case you don't know yet, is a person that thinks he's a "hacker" because he uses other people's software, often without even knowing how they work.
Anyway, I personally don't advise you to start flooding people. This will only make you look like either a lamer, a total jerk or both.
Oh, by the way, you'll need the ICQ port in order to operate such a flooder. The ICQ port is a port that ICQ opens and listens to. They are always somewhere between 1024 to 2000. All you need is to scan this range with a regular portscanner and put a relatively high timeout (one or two seconds).
Since these flooders and many other ICQ "utilities" require the ICQ port to operate, you could open several ports in that range in order to confuse lamers who try to flood you. You can do this by either programming such a thing by yourself, playing around with /etc/inetd.conf or other files if you're using Unix, using Netcat (the network administrator's swiss army knife. Can be found, together with full documentation, of course, at www.l0pht.org) or use some canned tool (again, www.warforge.com).
C) ICQ also has a feature called Email Express. Let's suppose your UIN is 5917057 (just to make things clear, it's not your UIN. Actually, it's my UIN... Wink ). If someone sends a message to [email protected], you will receive it as an Email Express message straight into your ICQ client. Now, what happens if you run some canned mailbomber and flood this Email address? That's right, this person will get flooded as well.
To protect yourself from such things, you can disable Email Express from the preferences menu in ICQ. Also, I don't advise you to do such things, not only because flooding is lame and idiotic, but also because the victim will be able to see your Email address and your IP (to learn how to fake Emails and the IPs in their headers, read my Sendmail tutorial).
If you've been flooded, there are programs out there that will ask you to close your ICQ client and will then simply erase every unread message (make sure you didn't get any important messages while you were flooded). Again, such a program can be found at www.warforge.com.

Spoofing
========
First of all, spoofing is faking. For example: spoofing messages - faking messages, spoofing your IP - faking your IP, etc'. Consider the word spoofing an alias to the word faking.
Again, spoofing messages and other events or making programs that do this is possible by learning the ICQ protocol. The best spoofer is called Lame Toy, and again, you can get it at www.warforge.com.
You can play lots of fun and amusing pranks on people using spoofers. For example: you can send people messages from themselves, pretending to be their own computer or something, or you could send someone a break-up letter from his beloved one (but you won't do THAT, now would you? Wink ). Lame Toy is also capable of spoofing other events, such as URLs, file transfer requests, chat requests etc'.
Also, if you send someone a message from himself and he adds himself to his contact list, the next time he will start his ICQ client he will lose his entire contact list. This is called a DB corruption. DB stands for DataBase. Your ICQ DB contains your entire contact list and all of your private information and settings. It is stored in a subdirectory in ICQ's directory which will either be called DB (in versions older than ICQ99a), NewDB (in ICQ99a) or DB99b (in ICQ99b).
If the victim has already added himself to his contact list and you want to see immediate results, you could always DoS him so he'll have to reconnect to the net and restart ICQ.
Anyway, such an action is cruel and quite illegal, so I suggest not doing so. If you merely want to protect yourself, get a fix for ICQ that allows you to add yourself to your own contact list (see the fixes chapter).
Also, I recommend backing up your contact list once a week.

ICQ homepage flaws
==================
ICQ homepage is a feature that all ICQ versions since ICQ99a build #1700 have. It allows you to open a small webserver on your own computer and put a nice little website on it without any special knowledge. You will even have a nice counter, and be alerted on ICQ whenever someone hits your webpage (unless you disable this feature, of course). You could also serve numerous files from your own computer. Of course, this website is up only when you are online, but since some people have either LAN connections, DSL connections or other frame-relay connections which keep them online 24 hours a day, 7 days a week, this feature could come to be quite useful.
Now, let's move to the interesting part - how secure is this little webserver?The ICQ homepage webserver that comes with ICQ99a builds #1700 and #1701 is vulnerable to two enormously stupid attacks.

A) When you connect to it manually (with either telnet, Netcat or any other program) and enter a non-standard webserver command, it simply crashes and takes the victim's ICQ client together with it. For example: the command get, combined with a parameter, simply gets a certain file. For example: if you want the file http://blacksun.box.sk/poop/shit.jpg (just for your information, there isn't such a file on our server), you simply connect to blacksun.box.sk on port 80 and type in "get /poop/shit.jpg" (without the quotes).
Now, if you connect to an ICQ homepage webserver and simply type get without any parameters the webserver crashes together with ICQ and you'll get a "connection lost" message.
On newer versions of ICQ you will get a connection lost message as well, but this time it's because the webserver simply closed the connection, not because it crashed or anything.
B) The ICQ webserver's directory is c:\program files\icq\homepage\ by default. Anything on this directory can be read by any web browser (or telnet application, if you choose to surf with telnet for some blurred and strange reason). But what if you had the option to climb up in this field? You know, get to c:\program files\icq\, or even to c:\ and it's subdirectories?This can be done with the ICQ webserver that comes with ICQ99a buils #1700 and #1701. For example: if you want to read someone's system.ini file, which is located at c:\windows\system.ini, you will need to climb up three times to get from c:\program files\icq\homepage to c:\, and then climb down once to get from c:\ to c:\windows. This can be done by accessing the following URL on the victim's webserver: "/..../windows/system.ini" (without the quotes). Here, let me explain.
One dot means "current directory". Two dots mean one directory up. Three mean two up, and four, in our case, mean three directories up. Once we climbed three directories up and got to c:\, we climb down to c:\windows and then get to c:\windows\win.ini. This rule is universal, which means it works on every OS (or at least every OS I know), including Windows, which is the OS the ICQ webserver runs on.
Now, wait a second... we type in this URL, but we got a 304 (forbidden) error. Oh, wait, I know why... this webserver only allows us to access .html pages, .jpg files, .gif files and other files that can be found on usual websites. It is very simple to trick this stupid webserver. Simply type in this URL (again, without the quotes): "/..../.html/windows/system.ini". Isn't this stupid or what?!You could also download the victim's DB files and use them later to retrieve his password (see the password stealing chapter). Hell, you could even use a download manager such as GetRight, Go!Zilla, ReGet etc' to download it, 'cause the ICQ webserver supports resuming!Note: newer versions of the ICQ homepage are not vulnerable to this hole anymore.

Note: /../../../ is the same as .... (going up three times).

Tricking ICQ's file transfer feature
====================================
When you receive a file transfer request from someone else, you can see the filename in a small text box inside the request dialog box. But what happens if the filename is too long to be displayed?Let's make an experiment. Take an executable file called "file.exe" (without the quotes), and change it's name into "file.jpg .exe" (again, without the quotes. I'm getting tired of saying that...). Now, send this file to someone on ICQ.
Since the filename is too long to display, the little text box will only show as much as it can, thus hiding the " .exe" part from the victim's eyes. The victim will receive the file without thinking twice (I mean, it's just an innocent little .jpg image. OR IS IT?!! MWHAHAHAHAHAHAHA!!), run it and get infected with a virus or whatever you want to put in that executable file.
You can go even further if you'd like to. Make an executable file called "sex-story.txt .exe" and give it the icon of a simple .txt file.So the next time you receive a file from another user on ICQ, think twice before you run it... Wink

Unhiding invisible users
========================
ICQ has a feature in it called an "invisible list". Everyone on this list won't be able to see whether you are online or offline, even if he has you on his contact list.
If someone put you on invisible and you want to know whether he is online or offline, simply do the following:
(a) Find his UIN (suppose it's my UIN, 5917057).
(b) Go to www.icq.com/5917057
(c) Look for a little image that says whether he is online or offline.
What is this thing, you ask? Well, it's an option called web-aware. It allows people who don't have ICQ to see whether you are online or offline. It is also necessary for ICQ web pagers (some HTML code that, when placed into an HTML document, let's people send you a message or see whether you are online or offline without the need for having ICQ or the hassle of finding you on ICQ).
Web-aware can be turned off using the preferences menu. If you turn web-aware off, people who will go to www.icq.com/your-uin will see an image saying "disabled" instead of "online" or "offline".
Even if your victim turns web-aware off, you could still manage to detect his online presence.
For example: immature people will react if you curse them or say bad things about them.
Also, you could register another ICQ user (takes about 3-4 minutes), in addition to your regular one, and then switch to it and add this person. Do not communicate with this person while you're using this new account. He will probably forget about you in time, and won't bother putting you on invisible or anything. That way, you could simply switch to this new user whenever you want and see if your victim is online or not.

Stealing passwords
==================
If you somehow manage to get a hold of someone's DB files, you could easily steal his password. The passwords are stored in clear text (unencrypted) inside the .dat files. They are always placed in the end of the iUserSound line.
If you can't find the password, you could always download progenic.com's local password retriever and get the password out of the .dat files.
Also, some people write fake Email addresses in their info, such as [email protected], [email protected] etc'. In the first case ([email protected]), you could try to see if [email protected] belongs to someone. If not, register it, and then go to www.icq.com and look for the "forgot your password?" link. Enter the victim's UIN, and the password will be sent to "his" Email address ([email protected]). Then, login to your hotmail account and wait for the password to show up in your inbox... Wink
Here's another example: the victim puts [email protected] as his Email address. Too bad he didn't write pentagon.gov, because pentagon.com are giving free Email addresses AFAIK (As Far As I Know). Simply register [email protected] and get his password.
If your victim wrote something like this: [email protected], you could always try to register real.com for 70$, register the subdomain not.real.com, put a POP3 mail server there, register the account "fake", and walla! You now own [email protected]. Okay, I know, most people won't go into so much trouble just to get someone's ICQ password... but what the heck.
Also, you could always try to guess someone's password, but that should take some time.
Oh, by the way, have you noticed that the maximum length of an ICQ password is 8 chars? So what's so interesting about it?Once upon a time, years ago (back in 1997, to be exact. Please correct me if I'm wrong), you were able to use Linux clones for ICQ (Mirabilis don't have an official release of ICQ for Linux, so the only way to use ICQ under Linux is to use an ICQ "clone", which is a program that uses the ICQ protocol and uses ICQ's features, but is not an official release by Mirabilis) to get into people's ICQ accounts without the need for a password. How?
Some ICQ clones for Linux didn't force the user to have a password that was more than 8 chars long. But if you tried to login as someone else and entered a password that is longer than 8 chars, a buffer overflow would have occur and the password verification part would have simply got "skipped over".
In short, a buffer overflow happens when the program is assigned a certain buffer size for certain actions and exceeds that buffer. Buffer overflows can cause all sorts of "embarrassing situations", and in this case, they simply caused the program to skip the password verification phase.
Anyway, this little flaw doesn't exist anymore. Too bad... Wink

Final notes
===========
To use or not to use?
---------------------
I know many people who do not use ICQ nor any other instant messanger because of security reasons. You could also refuse to use Email in fear of being mailbombed or receiving "hostile applications" by mail, refuse to use the web in fear of getting into a hostile page, refuse to use IRC in fear of getting DoSsed or hacked by someone etc'. I personally do not believe that the solution is to simply give up. If you face a security problem, learn it and do your best to fix it.
I hope that you will use the knowledge you have learned while reading through this tutorial to do your best to secure yourself from ICQ and it's security issues and flaws, instead of just giving up.

Why did AOL buy Mirabilis for so much money?
--------------------------------------------
Those of you who read the introduction (you're saying you didn't read it? Naughty naughty!), or those of you who heard about it in the news, know that Mirabilis was bought by AOL for 400 million U.S. dollars in 1998. But why would AOL buy Mirabilis for so much money?
The answer is - Email addresses. ICQ has hundreds of millions of users, and hundreds of thousands of more people are registering more ICQ accounts every day. Most of those people will have an Email address, and put it somewhere in their info. My guess is that AOL are selling some of these Email addresses to spammers (not too many and not in one time, in order not to scandalize the net) for money (and lot's of it. I was once offered 90$ by some firm for every 1,000 Email addresses I sell to them).

Running ICQ under Linux
-----------------------
ICQ for Windows 3.11, ICQ for Windows 9x, ICQ for Windows NT, ICQ for Mac, ICQ for Java... what? No ICQ for Linux?
You must be wondering why Mirabilis didn't release ICQ for Linux. Well, let me tell you a little story. The Cyber God, a member of BSRF, signed up for some mailing list he found at Mirabilis's homepage. It said that members of this mailing list will be notified when a Linux version of ICQ goes out. He waited and waited but nothing happened. After a while, he decided to go back to Mirabilis's homepage and look for the page where he signed up. He searched and he searched, all with no luck - this mailing list disappeared without a trace.
Conclusion:
Did Mirabilis fail to port ICQ to Linux (to port: to make a version of a certain program for another OS)? Did the project lose it's budget? Nobody knows...
Anyway, if you really want to run ICQ on Linux, you could either:

A) Download ICQ for Java, and get a Java Virtual Machine for Linux. Start your JVM and run ICQ for Java on it.
B) Go to www.linuxberg.com, go to their software page, find the ICQ page and you will get a nice list of ICQ clones for Linux.

Some rant about ICQ chain letters
---------------------------------
Probably the most annoying thing about ICQ is not it's poor security, but it's never-ending flow of chain letters. Forward this or Mirabilis will start charging money for the use of ICQ!! Forward this and your ICQ will change colors!! Forward this and your crush will kiss you!! Forward this to everyone - there is a virus in the new release of ICQ!! Forward this to everyone - do not add 5917057 (or any other UIN), he is sending viruses!! Forward this to 1-5 people and your crush will kiss you, forward this to 6-10 people and you will win the lottery etc' etc'...!! Forward this or your monitor will melt down!!
People, people, be reasonable! I never forwarded any of this crap, and Mirabilis didn't charge a penny from me, I didn't get runned over by 49 Budist monks, I didn't get my computer infected with any viruses nor hacked etc' etc' (although my monitor did melt... kidding!).
Please don't forward any of this crap. I promise you that nothing bad will happen if you won't forward these letters (I mean, everybody knows that the only chain mail that brings you bad luck if you don't send it comes by real mail... Wink ).
Also, if you want a good laugh at someone who forwards you a chain letter, send him this message:

This is an ICQ chain letter. Please do not stop the chain!
Cindy from Sydney forwarded this letter to 49 million people and became the queen of Zaire!!
Masha from Russia forwarded this letter to 23.7 million people and became an astronaut and got to fly to the moon!!
Gil from Brasil didn't forward this letter to anyone and was turned into a frog!!
Chan from Japan forwarded this letter to 107 thousand people and became the world's Pokemon and PacMan champion!!
If you forward this letter to 1-5 people: 1-5 people will be pissed at you for forwarding them a stupid chain letter!
If you forward this letter to 6-10 people: 6-10 people will be pissed at you for forwarding them a stupid chain letter!
If you forward this letter to 11-15 people: 11-15 people will be pissed at you for forwarding them a stupid chain letter!
If you forward this letter to 16-20 people: 16-20 people will be pissed at you for forwarding them a stupid chain letter!

Funny, huh? I wrote it myself... *grin*

Appendix A: Getting that little port by yourself
================================================
Yes. You can get that little ICQ port by yourself, faster than any stupid "ICQ Portscanning 3l33t k-rad h4x0r1ng proggie" and flood, spoof or just plain annoy people like hell!! WHEEEEEEEE!!!
How? Simple. Remember when I told you about "the cool way" to get IPs on ICQ? Well, getting the port is almost the same. You see, once you find the IP you will also see the port nearby. Connections in netstat are displayed by their IP, the local port and the remote port, so all you have to do is find the remote IP of your target. This is what you'll see: his-IP:the-port. So simply look after the : and you'll see the port.
Also, there is an even easier way to do this. Read appendix B to find out more.
Thanks to Zero Alpha for the idea behind this trick.

Appendix B: The advantages of Unix ICQ clones
=============================================
Although ICQ clones always have less features than official releases of ICQ itself, they sometimes have some neat features, such as a menu option that updates all of your contact list's info, a button that tries to connect to the next server out of a large list of servers if you fail connecting etc'.
Also, most ICQ will display the target's IP and ICQ port within a new field in the info page, as well as let you add people without authorization nor without notifying them (although you could choose to notify someone he's been added).
Hell, some ICQ clones will even have a built-in message spoofer! Hehe...

Appendix C: IP ==> UIN convertion by yourself
=============================================
Suppose someone just tried to nuke you. Your firewall stopped the DoS attempt. You wanna chat with the idiot and tell him how stupid he is, but alas - you only have his IP address. No problemo! If this user has ICQ, you can get his UIN quite easily.
There are infinite reasons for why you would wanna know how to convert IPs to UINs. I'm sure you could think of at least five in about a minute and a half, so instead, let's just get on with it, shall we?
This little trick is quite simple. First of all, grab a simple message spoofer. Then, feed it with the target's IP, and send a spoofed message that comes from your UIN. For example: if your UIN is 5917057 (that's MY UIN, actually... Smile ), you should spoof a message from that UIN (spoof messages from my UIN and I'll kill you!! Smile ). So grab a simple message spoofer and send a "spoofed" message to your target's IP. Now, in this message, you need to include something that will surely get replied to. It could be something offensive, something interesting or appealing (sending a "Wanna learn how to hack Hotmail" to the usual script kiddie would surely get replied. Also try "Hey, I have a surprise for you...". In other words, anything that will surely get replied to) etc'. Now, suppose the target replies to your message. Where do you think the reply goes to? You, of course! It's your UIN, after all! Since you've sent this message from your UIN, this is where the reply will go to.
Now, that you received an ICQ message from your target, you will also have his/her UIN

Appendix D: More fun with contact lists
=======================================
As I've already said, if you make someone add himself, he will lose his contact list unless he has the patch against it. I've already gone through the process of using message spoofers to make someone add himself. Now, here's another cool way to do this.
First thing's first, you need to have this person in your contact list. Then, change his name on your contact list, and send him himself as a contact. It will appear to him that the contact you're sending him is another person's contact, and he will add this person, which is actually himself!
If you want to protect yourself against such things, simply install the patch that let's you add yourself to your own contact list (we've already discussed about where u can get this patch), or simply make sure you don't add yourself. Smile

BTW the cool person who came up with this trick is Dr. Virus (another member of BSRF. He's the one that made the flash intro and menu).

Appendix E: Incredible tricks with the ICQ protocol
===================================================
Imagine that you could hijack someone's session with another person and eavasdrop their conversation. Imagine being able to get the IP, port and a lot of information about a certain user within a couple of seconds. Imagine having more power over the system that you can think of.
You can get this power by learning the ICQ protocol. The problem is that other people can learn it as well, and use this knowledge in order to maliciously harm you. Don't get caught with your pants down. Smile
Learn the ICQ protocol here: http://www.student.nada.kth.se/~d95-mih/icq/
Get some canned programs to see what can be done using this knowledge and learn more about the ICQ protocol from the source (please do not abuse these programs!): http://www.hackology.com/~ewitness/

Thanks to Eyewitness for the URLs.

Appendix F: Reading someone's contacts and history log
======================================================
If you manage to get someone's DB (stands for database) files, located at the appropriate DB directory under his ICQ directory (for example: the DB files in icq99a should be under db99a or something of that sort), you can place them in your DB directory and then start ICQ as another account with that person's contact list, history log etc'.
Just remember that if the other person has an older version of ICQ, you might have to use the DB converter to convert his DB files to fit with your new version of ICQ, and if the other user has a newer version, than you have to get his version to fit.
Oh, and you can also get his ICQ password. It's usually located in the line that starts with IUserSound (or maybe it was I_UserSound or something of that sort. You should experiment with your own DB files), or just get an automated ICQ password recovery tool from the net (there are thousands of these in every script-kiddie archive).

Appendix G: WebIcq.com
======================
www.webicq.com is a service that enables you to access your ICQ account from anywhere in the world. But what's so interesting about it?
Well, first, as for the moment, it enables you to add people to your contact list without their authorization. Groovy!
But that's not all. If you're having any difficulties with the fix that enables you to run multiple instances of ICQ at the same time, or cannot find a fix for your version of ICQ, relax! You can always use webicq.com as a second ICQ window. Have fun, and play nice. Wink

Appendix H: Decrypting The ICQ Password
=======================================
The following is taken with permission from www.wangproducts.co.uk:

Decrypting the ICQ99b password
------------------------------

Last volume we talked about playing around with ICQ and we briefly mentioned the ICQ password. Here is what I said:

Versions before ICQ99b store the ICQ password in plain text (i.e. not encrypted) in their DB file (I believe they are now encrypted? - email me if I am wrong). The DB file is located in the following different places depending on your version:

Version lower that ICQ99a = \ICQ\DB\

ICQ99a = \ICQ\NewDB\

ICQ99b = \ICQ\DB99b\

Simply look through the file for the password - it usually appears on the line beginning "iUserSound". You could also use the web-server exploit detailed earlier to get the DB file.

Well, I have been doing some research on the ICQ99b password - and yes, it is still in the DB file...but encrypted. The DB files are two files which are called:

.dat
.idx

In order to decrypt the ICQ password, you will need 3 pieces of information:


Your UIN

Your CryptIV value

The encrypted password

Your ICQ99b password is encrypted in the .dat file, in the folder \ICQ\DB99b\ and it appears after the text:

Password

I bet you couldn't have guessed that one! Right, the actual encrypted password is the text 4 chars on from the word 'password'. Here is an example:

Password k? af799034f6bb402e837f

So, 4 chars after the word 'Password' makes the encrypted password:

af799034f6bb402e837f

Some of you may have noticed that the encrypted password is actually made up of hex. Now what we do is make the encrypted password a bit more friendly - by putting spaces in and making it uppercase!

AF 79 90 34 F6 BB 40 2E 83 7F

This is just so you will be able to read each hex number easily later on - you don't have to worry about this if you don't want to.

**Note**

For the people familiar with hex, this obviously represents:

0xAF
0x79
0x90
0x34
0xF6
0xBB
0x40
0x2E
0x83
0x7F

**Note**

Now to get the other important item - your CryptIV value! This will appear in the .dat file - after the text:

99BCryptIV

which is just before the word 'password'. The CryptIV value is used in generating the decryption key.

Search the .dat file for "99BCryptIV", and then once you have found it, skip past the null terminator and character 'h'. In the other words - ignore the first 2 characters after the word "99BCryptIV". The next 4 characters are your CryptIV value. They will probably look like strange ascii characters. Here is an example of what you could find:

99BCryptIV h]?~t

In the case above, the CryptIV value would be:

]?~t

Now we need to work out the ascii values of each character, like so:

] = 93
? = 223
~ = 152
t = 116

For all you newbies, the Ascii value of something is its numerical value. Every single character on the keyboard has a special number associated with it called the Ascii value.

Now the fun bit!

Once you have your 4 character long CryptIV value converted to ascii, we need to perform this calculation with it:

( 1st + 2nd * 256 + 3rd * 65536 + 4th * 16777216 ) = CryptIV

The 1st, 2nd, 3rd, and 4th bits represent the ascii value of each character of the 99BCryptIV. So, for our example, we would do:

(93 + 223 * 256 + 152 * 65536 + 116 * 16777216) = 1956175709

The final step is to convert the result into hex. Yes, im afraid it has to be done. The easiest way is to go into a programming language and make it convert it. For example, to convert the result above using Visual Basic, the code would be:

msgbox hex(1956175709)

That simple! The code above will make it display a message box showing the hex value. In delphi that code would be:

showmessage(inttohex(1956175709,1));

After converting to hex, you should get the value:

7498DF5D

This can be properly represented as 0x7498DF5D or 7498DF5Dh depending on how your inclined.

Ok, lastly - your UIN. Suprisingly, this is the easiest piece of information to get!! Your UIN is your ICQ number. My UIN was: 16831675

Now we have all the information we need:

UIN : 16831675

CryptIV : 7498DF5D

Encrypted password: AF 79 90 34 F6 BB 40 2E 83 7F

Now we need to use the above information to generate a decryption key (or an XOR key). This is quite complicated, and it would not be feasible for us to do it manually here - but you can use the program I compiled quickly for this volume. It should be along with this file, and its called "ICQ99b.exe".

Actually, all we need to generate the decryption key is the UIN and the CryptIV - but we will need the Encrypted password soon. Go into the program and enter the UIN and the CryptIV and click "Generate Key". Keep a note of the key it generates for you.

**Note**

Although the XOR key generating process is too complex to do here manually, I have included the source to it with this volume. It is called "XorKeyGn.pas" and it is written in pascal. The compiled program "ICQ99b.exe" is merely a port of this source code into delphi to make it easier for newbies to generate the XOR key. The XorKeyGn.pas source was written entirely by CovertD - who is a very talented coder and deserves all the credit for this decryption, he has helped me to understand this decryption and create this tutorial for you.

**Note**

Ok! once you have the decryption key - the real decryption can begin. The decryption will require you to be familiar with XOR - if you are not familiar with this...I have included the visual basic and delphi source code to decrypt it.

The hands-on approach:

What we now need to do is XOR the encrypted password character-by-character with the decryption key (or XOR key as it should be known).

Using the above example, my program generated the decryption key as:

A7 79 F8 55-95 D0 26 4F-F2 7F 2C

**Note**

Remember this is in hex too, so it really means:

0xA7 0x79 0xF8 0x55 etc.

**Note**

Ok, now the odd bit...remove the first two hex values of both the XOR key and the encrypted password. Why this is needed is explained a bit later. So, for my example we would end up with:

ENCRYPTED PASS = 90 34 F6 BB 40 2E 83 7F

XOR KEY = F8 55-95 D0 26 4F-F2 7F 2C

So looking back at the encrypted password, we will actually be XOR'ing:

0x90 xor 0xF8

0x34 xor 0x55

0xF6 xor 0x95

0xBB xor 0xD0

etc.

and just to do a quick example XOR:

[ 0x90 xor 0xF8 ]

0x90 = 144

0xF8 = 248

010010000
011111000
----------------
001101000

= 104

XOR all of the encrypted password like this and write all of the results down (so for our example, the first result would be 104). Now convert the results to their Ascii symbols, so 104 would become: h

The easier approach:

Ok, if all the talk of XOR scares you, here is the easier way. Below is the code for both visual basic and delphi to perform the XOR calculations above. The visual basic code to do this (using the example) would be:

Dim Key, Encrypted As Variant
Dim Decrypted As String
Dim x As Integer

'If you are doing this for your own password and not the example,
'remember to replace the values with your own.
Key = Array(&HF8, &H55, &H95, &HD0, &H26, &H4F, &HF2, &H7F, &H2C)
Encrypted = Array(&H90, &H34, &HF6, &HBB, &H40, &H2E, &H83, &H7F)

'Begin XOR'ing the encrypted text with the key, and converting them to ascii chars.
For x = 0 To 7
Decrypted = Decrypted & " " & Chr(Key(x) Xor Encrypted(x))
Next

'Show a message with the decryption text.
MsgBox Decrypted

Write down all of the results that are stated in the message box. Here is the delphi code:

Var
Decrypted : String;
x : Integer;

Const
//If you are doing this for your own password and not the example,
//remember to replace the values with your own.
Key : Array[0..8] of Integer = ($F8, $55, $95, $D0, $26, $4F, $F2, $7F, $2C);
Encrypted : Array[0..7] of Integer = ($90, $34, $F6, $BB, $40, $2E, $83, $7F);

begin

//Begin XOR'ing the encrypted text with the key, and converting them to ascii chars.
For x := 0 To 7 do
begin
Decrypted := Decrypted + ' ' + Chr(Key

• Xor Encrypted
• );

end;

//Show a message with the decryption text.
ShowMessage(Decrypted);

end;

The conclusion:

Now lets look at what you have ended up with (whether you used the manual approach or the code above). You should have something in the format of this:

<The> <maybe>

And yes, the password should have decrypted as 'hackfaq'.

If you were wondering what the 3 useless characters actually mean, then here it is:

The first character is a length word and is a hex value (therefore you shouldn't really convert it to it's ascii value) - the hex value should be equal to the length of the decrypted password. To cut a long story short, the first character holds the length of the password.

The second character is rubbish - I believe? or it might be part of the length...who knows.

The last useless character is simply a null terminator - i.e. zip, nothing, 0

I am really really sorry if I lost anyone during this topic! It is probably the most complex topic we have covered, and is quite difficult to explain - although I felt I should include this as we covered ICQ last volume...and as no-one else has explained it well Smile

If it really was a bit much and you are completely lost - then you can download the new program off my web site called "ICQ Decrypt". It will do everything mentioned above for you - just point it in the direction of your ICQ99b dat file and it will show you the password. Get it here

Actually, I would be interested to hear some comments about what people thought of this topic. Mail me

And lastly, many many thanks go to CovertD for the brilliantly coded xorkeygn.pas - which is the heart of the decryption. Keep it up CovertD!!!

Appendix I: 00.00.00.00?? / 0.0.0.0??
=====================================
Sometimes (this happens VERY rarely, though), when you try to determine someone's IP, you hit 00.00.00.00 or 0.0.0.0. This is impossible, right? Noone can be coming from 0.0.0.0!!
You'd bet your sorry ass it's impossible. Then why does this happen?
Simple. Incompatibility. This only happens when VERY, VEEERY old icq clones for Unix/Linux or version of ICQ for Windows, or old version of Java ICQ collide with the most modern versions of ICQ. People have first seen these cases in ICQ 99b, and it continues on to ICQ 2000 (all versions and beyond).
So if such a thing happens, you're gonna have to use the netstat -a technique (described above, in the fixes chapter, at the end, where it tells you how to do this by yourself).

Thanks to Morix for this tip!

Appendix J: Newer ICQ Holes
===========================
These were copied from various sources around the net.

Guestbook.cgi
-------------
Submissions to this guestbook are handled by a script called guestbook.cgi. This
guestbook CGI contains a security vulnerability that allows remote attackers to cause
the ICQ client to crash.

Vulnerable systems are ICQ Version 99b Beta v.3.19 Build #2569

When an external visitor requests the URL:
http://icqstation.example.com/guestbook.cgi

They will get a Forbidden HTTP reply.
However, if the URL is:
http:// icqstation.example.com/guestbook.cgi?

(With a ? at the end), ICQ will crash with a GPF. (Note added by me: General Protection Fault. It's a UAE - Unrecoverable Application Error)

-----

ICQ's Guest book CGI long name buffer overflow
Jun, 06 2000 - 16:54
Web front is a simple HTTP server that comes with ICQ. It allows users to host a home page on their own computer. This personal web server suffers from a number of
security vulnerabilities that we described in the past, but this new vulnerability enables attackers to execute code on the client machine.
When passing a long 'name' to ICQ's guest book CGI, the ICQ client may crash, possibly executing arbitrary code.

Vulnerable systems:
ICQ 2000a
ICQ 99b
ICQ 99a

It is possible to cause the ICQ client to crash by sending it a specially crafted URL, which will cause a buffer overflow in the ICQ program possibly causing it to execute
arbitrary code.

Example:
http://host.example.com/guestbook.cgi?name=01234567890012345678901234567890

provided by: Meliksah Ozoral.
mailto:[email protected]

ICQmail
-------
ICQ2000A ICQmail temporary Internet link vulnerability
Jul, 05 2000 - 09:16
When reading or sending an email using the ICQmailclient ( http://www.icqmail.com ) with ICQ2000A ( http://www.icq.com ) a temporary Internet link is created in the
default temp directory, containing the user ID and encrypted password. This temporary Internet link is never deleted, not even when signing off from ICQwebmail,
disconnecting from ICQ or closing ICQ altogether. When opening the temporary Internet link, any user is able to login to the ICQmail web account, and read, write and
change any email messages or preferences.

Exploit:
Any user using a shared computer can open the temporary Internet link located in the default TEMP directory and use the ICQwebmail to read, write email and change
preferences

Example:
Name=icq91.url
Location=C:\TEMP

An example of the temporary Internet link looks like this:

[InternetShortcut]
URL=http://cf.icq.com/cgi-bin/icqmail/write.pl5?uname=gertfokkema&pwd=12345678

Temporary solution:
Automatically or manually delete all items in the users default TEMP directory after logging out of the computer.

provided by: Gert Fokkema.
mailto:[email protected]

Other tutorials by BSRF
-----------------------
* FTP Security.
* Sendmail Security.
* Overclocking.
* Ad and Spam Blocking.
* Anonymity.
* Info-Gathering.
* Phreaking.
* Advanced Phreaking.
* More Phreaking.
* IRC Warfare.
* Proxies, Wingates and SOCKS Firewalls.
* RM Networks.
* The Windows Registry.
* Cracking, part I and II (III coming soon).
* Mailing List Security.
* HTML.
* IP Masquerading.
* Cool info about computer hardware.
* The #2,000 "bug" in IRC.
* The "javasCript" bug in Hotmail.
* Basic Local/Remote Unix Security


Credits
Written by R a v e N (blacksun.box.sk) - 13/7/2000, version 1.9

GUIDE TO (mostly) HARMLESS HACKING

Vol. 3 No. 7, Part 1

Introduction to Computer Viruses


It's Saturday morning. You boot up your Windows 98 computer and lo and behold, the graphics on the desktop are a mirror image of what they should be. Congratulations, you have a computer virus!

According to "Virus Bulletin," the Oxfordshire, England-based technical journal that tracks viruses, this new virus flips any uncompressed bitmaps horizontally, but only on Saturdays. This bulletin credits GriYo of the 29A virus-writing group as the author of this 32-bit polymorphic Windows virus now known as HPS (Hantavirus Pulmonary Syndrome).

Panda Software of Spain has announced that it has the antidote to HPS. Meanwhile, other antivirus companies scramble to code a cure for this Windows 98 desktop graphics virus.

So far HPS appears, like many viruses, to be harmless and humorous. According to the book "Computer Viruses" by Robert Slade (Springer, 1996), "The truth is that relatively few viral programs perform any overt damage to a system." However, no matter how harmless any virus may appear to be, people worry that it might do something else, perhaps on some Friday the 13th or maybe, who knows Jan. 1, the year 2000. Even if GriYo had the best of intentions, people worry that a mistake buried somewhere in his HPS code might accidentally cause harm.

Let's face it. Turn a computer virus loose and you can become mighty unpopular -- regardless of how harmless, funny, or even beneficial you believe your virus might be. People don't like to have programs running on their computers unless they make the decision to put them there.

In this Guide you will learn:

Part One:
* What is a computer virus?
* Types of computer viruses
* Why study and create viruses?
* How to catch them
* How to fight them

One of the nice things about the recent escalation in computer crime is that the media doesn't make such a big fuss over viruses any more. Sure, they (viruses and the media both) can be a pain. However, with all those antivirus programs we can call upon for help, and with almost everyone now understanding the importance of frequent backups, viruses are no big deal, right?

"Computer viruses are no big deal." Famous last words? Digital viruses may be the first stages of artificial life. Think about it -- are we ready yet to share the planet with artificial life? Will we find some means of friendly coexistence, just as we have learned to safely enjoy cheetahs, lions and wolves? Will viruses perhaps even evolve into helpful life forms that will end poverty and war, help us understand the meaning of life itself and even shed light on the nature of God? Or will some computer virus designer create code that evolves into something that destroys the human race? Or ... maybe you readers will get fed up with me hyping viruses and flame war me into hiding!

What is a Computer Virus?

In 1988 the Internet was shut down by the "Morris Worm," a self-replicating program coded by Robert Tappan Morris of the Chaos Computer Club. It used sendmail and finger exploits to break into and propagate from one Unix computer to another. By the time it had infected some 10% of the computers on the Internet, it was clogging essential Internet communications lines as the worm shipped around ever more copies of itself.

Yet many computer scientists say we shouldn't call the Morris Worm a computer virus.

Before the first computer virus was ever coded, in 1984, Dr. Fred Cohen wrote his doctoral thesis on the topic (published in his book "Computer Viruses," ASP Press, 1986). As a result, Cohen is credited by many with being the first to conceive of their existence. It is important to remember

-- Cohen is AGAINST computer viruses. He didn't invent them, but was the
first to prove they could be created, and to foresee the damage they could cause. Purists hold by the definition of virus that appeared in Cohen's doctoral thesis: a computer virus is code that, when active, attaches itself
to other programs.

However, long before Dr. Cohen detailed the characteristics of viruses, mathematician John von Neumann proved that a Turing machine (a mathematical construct representing a single-processor computer) is capable of containing a "universal constructor" which, if provided with a program containing its own description, is able to reproduce itself. Von Neumann's "universal constructor" proof covers not only Cohen's definition of a computer virus, but also self-replicating programs such as the Morris Worm.

Are these definitions making you dizzy? Me, too. So I decided in this Guide to use the definition proposed by virus researcher Dr. Mark Ludwig. He defines a computer virus as "a program that reproduces. When executed, it simply makes more copies of itself. Those copies may later be executed to create still more copies, ad infinitum." This definition is broad enough to include the Morris Worm.

Newbie note: To "execute" a program means to make it run. As long as a
program is merely a file, it is doing nothing. However, when something is done to feed the information of a file into the central processing unit of a computer in such a way as to command it to do something, we say the program has been "executed."

Each virus program must consist of at least two parts. It must contain a search routine which helps it find new files, disks or host computers on which to replicate. It also must have a routine that copies itself to these new computers that its search routine discovers.

Many viruses also contain self-defense features that allow them to hide from or even fight back against anti-virus programs.

Some also, like HPS, contain a harmless message or prank. The Stoned virus carries the message "Your computer is now stoned" along with an occasional plea to legalize marijuana.

Unfortunately, a few viruses do something harmful. Often the harm is accidental, as few virus coders wish to harm anyone. Robert Tappan Morris had no intention of crashing the Internet with his Worm. Each individual worm was harmless. The trouble came because they multiplied far faster than he had expected.

Also, there are a few -- very few -- people who willfully misuse their programming talents to unleash destructive viruses on the world.

Types of Viruses

There are several major types of viruses.

* Boot sector infectors, which can live even on a blank DOS/Windows disk by taking advantage of the little-known program which tells your computer how to read the disk.

* Program file infectors (this includes MS Word document macro viruses)

* Worms (such as the Morris Worm) which use other programs to replicate but do not attach themselves to programs.

Currently the most common type of virus is the macro virus. A recent example of a macro virus is WM/PolyPoster. This virus will wait until you go online and post your infected document(s) to alt.sex.stories and other popular Usenet news groups under the title "Important Monica Lewinsky Info". For more details, see http://www.datafellows.com/news/pr/eng/fsav/19980618.htm and
http://www.datafellows.com/v-descs/agent.htm

Why Study -- and Create -- Viruses?

"The Giant Black Book of Computer Viruses" by Ludwig (American Eagle Press, 1995) argues "Should we not be a Socrates, who ... sought Truth and Wisdom ... the question that really matters is not how computers can make us wealthy or give us power over others, but how they might make us wise. What can we learn about ourselves? about our world? and yes, maybe even about God? Might we not understand life a little better if we can create something similar, and study it, and try to understand it?"

Some researchers seek to figure out new ways to defeat antivirus programs because they believe it is the best way to design them to stay one jump ahead of the tiny minority of virus writers who release damaging code. Do you really want to rely on a commercial antivirus program to be your only defense? Yes, these programs can be really helpful. However, if you are a serious hacker who downloads and tests lots of Windows programs (almost all viruses attack Windows), you had better be prepared to fight viruses that the antivirus companies have never even heard of.

Other people research viruses because they could become potent weapons in time of war. The story of a computer virus being unleashed against Iraq during the Desert Storm War is a April Fool's Day hoax that got out of hand. But the day is coming when they will be used in wartime.

If you live in a country where the government is run by a dictatorship or is occupied by an invader's troops, viruses may be the guerrilla warrior's best friend.

Some virus designers want to create artificial life forms that will, for good or evil, revolutionize history.

How to Catch Them

Have you ever gotten an email from a friend that reads something like this?

Internet Virus !!!!Warning!!!! Hello; Please Broadcast this message.

Mails CCMAIL or E-MAIL name's JOINT THE CREW & PENPALS GREETINGS should destroy all datas on your hard disk when you open them. These virus call CHEVAL TROYEN make infection on boot sector. These can be autoduplicator.

You should destroy them, DO NOT OPEN THEM.....

After a week or so you are probably are getting the same message again and again, each time slightly mutated:

VIRUS WARNING !!!!!! If you receive an email titled "JOIN THE CREW" DO NOT open it. It will erase everything on your hard drive.

Forward this letter out to as many people as you can. This is a new, very malicious virus and not many people know about it. This information was announced yesterday morning from IBM; please share it with everyone that might access the internet...

This "join the crew" virus warning is yet another example of the kind of message that first warned of an email virus entitled "Good Times." In 1994-5 that first emailed virus warning flashed across the Internet with amazing speed and persistence. Soon people were getting Good Times warnings every day. Even reputable sysadmins broadcast the warning to all their users.

Good Times was a hoax. It is impossible to catch a virus from merely reading email. You must run a program to catch a virus.

True, there are macro viruses such as those that infest Microsoft Word (MS Word) documents. They replicate when you merely read a file in MS Word. However, macros are programs which are executed when you read a text file -- but only when you read it in MS Word. Unfortunately, this "feature" of MS Word has the consequence that macro viruses are now the most common of viruses.

However, email is structured so that macros cannot, absolutely cannot, be embedded in it. If someone wants to email a macro to you, it will always be in a file attached to email. As long as you refuse to load email attachments into programs that run macros such as MS Word, you are safe.

Some people have argued that phony email virus warnings are in themselves computer viruses. They have a search routine -- the plea to email them to everyone you know. Their copy mechanism is you -- if you are dumb enough to command your email program to send these warnings on to other people.

So how does a computer get infected by a computer virus? You must always run a vulnerable program in association with the virus code in order to catch one. In the case of the Morris Worm, all you needed to do was hook up your computer as an Internet host. The sendmail and finger daemons, which run quietly in the background all the time, were the active programs that spread the Worm. In the case of MS Word macros, the act of reading an MS Word text file activates a macro which replicates the virus. In the case of a boot sector virus, simply putting a floppy disk into a drive and giving a command to see what is on the disk propagates the virus.

How to Fight Them

Maybe you are one of those people who greet each new uninvited program with the shout "Get that !@#$@#$% virus OUT of my COMPUTER!" If so, what is the best way to avoid infection? Once infected, how do you get that !@#$@#$% virus OUT?

There are a number of commercial antivirus programs that automatically scan for viruses very day at a certain time, as well as every time you start your computer. They also scan every floppy disk for boot sector viruses every time you load one in a disk drive and try to read it. I use Norton Antivirus with good results; many others say McAffee works well. Dr. Ludwig reports that all commercial antivirus software works about equally poorly. Of course, he's always testing them against the most amazing, exotic, tricky viruses in the world, half of which he has written himself. So it's understandable that he's not impressed.

I learned the hard way that a really bad way to get antivirus software was from a floppy given to me by a friend. I tried that once and caught a new virus from his floppy instead of getting rid of an old one! That disk was infected with a boot sector infector. So before I could even run it on my friend's program, the instant my computer tried to read the directory on the disk, it got infected. This new virus had the cute side effect of disabling the antivirus program.

Because of this problem, commercial antivirus software comes complete with instructions on how to bootstrap your computer back to health. If you don't follow those instructions exactly, you may end up like me, giving your computer a virus instead of eradicating one.

Since, according to Ludwig, there are many viruses out there for which there are no antivirus programs, this should motivate us to try to avoid catching them in the first place. What are some precautions even those of us who run commercial antivirus programs should take? Here are my top recommendations.

1) Use the Unix operating system. There are few Unix viruses or worms. I like to think that is because it is a superior operating systems. However, it may also be largely because Windows computers are common and cheap and the kind of people who code malicious viruses are so lame that they can't figure out how to code for Unix systems. However, be warned -- the second part of this Guide includes the source code for a Unix virus!

2) See that kewl offer d00dz site? Wouldn't it be nice to get thousands of dollars worth of commercial software from them for free? Watch out! The kind of guys who pirate software might also be the kind of guys who get a chuckle out of reformatting your hard drive by giving you viruses hidden in their archives. Also, some people fight offer sites by secretly booby-trapping them with viruses.

3) See that lovely haxor dOOdz site full animated flames, spinning skulls and creepy organ music? See all those programs on that site that promise to empower you to mail bomb people, crash their computers and break into the Pentagon? Now, is it just possible that the kind of people who want to help other people raise heck -- gosh -- could they also be the kind of people who would slip a virus or two into those programs you download?

4) See that email with an attached file? The sender says it is a really kewl program. A new game, better than Quake or Barbie Fashion Designer. Wait, why is a stranger sending you a free game program? Maybe he's up to no good. Or -- maybe it is an attached file sent to you by a friend. Wait! How do you know that email is really from your friend? Does it have his or her PGP signature? Have you phoned your friend to ask whether he or she really sent you that program? Don't run a new program unless you are certain it comes from a trustworthy source.

5) Upgrade Microsoft Office (or Microsoft Word) to Office 97 (Word 97). This disables all the old macro viruses. It also checks for macros in any new file you open. If it finds them, it prompts you to decide whether you want to disable these macros. Unfortunately, it is even easier to write macro viruses for Office 97, which uses Visual basic for its macro language. So if you want to be really safe, simply refuse to let any macros whatsoever run on this office suite. Better yet, use some other office suite such as Corel. Only Microsoft programs are vulnerable to macro viruses.

6) Disable Java on your Web browser. Haven't heard about Java viruses yet? In part two of this Guide you will get source code for a Java virus that infects Unix computers that run the Bourne shell. Java can also transmit viruses that will infect Windows computers.

7) Do or don't do all the other stuff I forgot to put in this list. What this really means is, don't trust me or anyone to be the last word on viruses. Good books to study which include source code to viruses are "It's Alive" by Dr. Fred Cohen, (Wiley, New York, 1994) and "The Giant Black Book of Computer Viruses" by Dr. Mark Ludwig (American Eagle, Show Low AZ, 1998). You can also get lots of information from the virus-l email list, a moderated, digested mail forum. To subscribe to the email list, email [email protected] with message subscribe virus-l. Archives are at ftp://ftp.cs.ucr.edu/pub/virus-l. An archive of virus FAQs is at
http://webworlds.co.uk/dharley/anti-virus/virFAQs. For Mac viruses, email
[email protected] a message containing the line "subscribe mac-virus-announce YOUR FULL NAME".

Where are those back issues of GTMHHs and Happy Hacker Digests? Check out the official Happy Hacker Web page at http://www.happyhacker.org/.
We are against computer crime. We support good, old-fashioned hacking of the kind that led to the creation of the Internet and a new era of freedom of information. So don't email us about any crimes you have committed! To subscribe to Happy Hacker and receive the Guides to (mostly) Harmless Hacking, please email [email protected] with message "subscribe happy-hacker" in the body of your message. Copyright 1998 Carolyn P. Meinel <cmeinel>. You may forward, print out or post this GUIDE TO (mostly) HARMLESS HACKING on your Web site as long as you leave this notice at the end.

Carolyn Meinel
M/B Research -- The Technology Brokers
http://techbroker.com/

Distributed by HackerThreads.org
Unix password files for beginners, by Caboom ([email protected]) and R a v e N ([email protected]).
http://blacksun.box.sk
Version 1.0
Date: 14/1/2000

1) First thing's first
======================
I guess you're a newbie in pass-cracking like I was and you've probably started John the Ripper full of enthusiasm, and got.... nothing. So the first thought you have is 'my god this must be hard, and I'm a newbie'. Forget it!!! You're always a newbie, and we all are... in pass cracking world, pardon, pass recovering world (or any world else) you always have something to learn. Sometimes, even if you are experienced in password cracking, you won't be able to fix the password or even get your own password. This is a pure technical manual and will give you only the recipe for cracking, but every password needs different approach...

OK, so a good way to get somewhere is to start getting somewhere...
What you're about to learn is to fix *nix(Unix/Linux/etc.) password files. It does not mean that you need to have some Unix distribution on your box, but it means you'll have to stop clicking your ass off all around the screen... 'What this fool is trying to say', you'll probably ask... This fool is trying to say that john is a DOS program (there is also Linux/Unix version, but I guess that most of the people that read this tutorial have win boxes). I will try to put this tutorial through the examples so it wouldn't look like a boring script with incredible amount of switches. After reading this text it wouldn't be a bad idea to look at the texts you get with John. I learnt it all from there, but that, of course, was the hard way, and you want the easy way, right? Right.

First, it wouldn't be a bad idea to get yourself John the Ripper, I guess... if you don't have it you can find it at:

1) packetstorm.securify.com (look at archives, password cracking)
2) neworder.box.sk (do some searching by yourself)

John can be found practically anywhere. For example: try going to altavista.com and running a search for 'john the ripper'.

Second thing you'll need is.... a HUUUUGE amount of password dictionaries (I'll explain what these are in a minute). The best dictionary around is at www.theargon.com and packetstorm (look at the archives) and is called theargonlistserver1 and is about 20Mb packed, and over 200Mb
unpacked... get it!!!! The people at theargon did a terrific job.

You should also get some smaller dictionary files (I'll explain why later).

2) Do we look like *nix?
========================
So now you have john, loaded with that huuuuge pass dictionary, and you think that you can fix anything... If you plan to live for 100000 years, that wouldn't be a problem, but you only have some 80 years left in the best case scenario (unless, of course, scientists find a way to... oh, nevermind).

Now, the first thing is that you have to make sure your password file really looks like a Unix password file (were talking about the /etc/passwd file).

Let's see how Unix pass files look like

owner:Ejrt3EJUnh5Ms:510:102:Some free text:/home/subdir/owner:/bin/bash

The important part is the username and the encrypted password, which are the first and the second parts (each line is divided into seven parts by : symbols)

owner:Ejrt3EJUnh5Ms

Owner is the username and 'that other thing' is the crypted password (encrypted in altered DES (Data Encryption Standard) encryption). For the other part you can put anything that looks like that but the structure must be same so the john could recognize it as unix pass. In fact the other part

:510:102:Some free text:/home/subdir/owner:/bin/bash

Is just some information about the user, his home directory, etc...

Sometimes you'll have passes that have only the first and second part, such as password files that you got from a webboard running matt's web board script.

owner:Ejrt3EJUnh5Ms

You'll have to put the other part so that password would look like unix pass, and you can do a copy-paste from another pass, you can even use

:510:102:His name:/home/subdir/owner:/bin/bash

What you have now should look like:

owner:Ejrt3EJUnh5Ms:510:102:His name:/home/subdir/owner:/bin/bash

Hell, you can even put

owner:Ejrt3EJUnh5Ms:a:a:a:a:a

It won't matter to john at all.

3) We're getting somewhere... nowhere
=====================================

Now you're ready to fix. Type in

john -w:words.lst password.file

Where words.lst is password dictionary and password file where you have your password or passwords. If you use it on example i gave to you you'll probably get password because it's really weak pass. You'd be surprised to see that people usually use really weak passes like their names, pet names, or even their username (for example: username=zalabuk, password=zalabuk).

Hint: Don't be stupid! Use strong passes like

p4sswr!@
p@s$w11s
with as many characters you can remember. Hint is to use special characters and numbers those passes are much harder to fix (I'll explain why in a minute).
The other hint is to use passes as long as you can remember, 8 characters are sometimes not enough... it depends what box that someone who fixes has... on dual alpha is certainly not enough... in other words... more than 10 characters will do fine, even more wouldn't hurt (like 16...). By the way, older *nix have fixed pass length of 8 chars... that is old DES crypted pass that uses a 64-bit key... now there are 128-bit keys, and some perverts use even more, so there is more fun now Smile

john -w:words.lst password.file

Wait wait wait! What am I doing here?
Alright, listen up carefully. The DES encryption that Unix uses CANNOT be reversed. Some encryptions can be reversed using a sometimes simple or sometimes incredibly complicated algorithm (in the 3rd century AD, Ceasar used to send encrypted letters which used a formula of "shift by three", which means that d stands for a, e stands for b etc'. At that time, such an algorithm was just fine. Today, it isn't).
So anyway, the altered DES encryption that Unix uses for it's password files cannot be reversed. Why? Because it's a key-based encryption. The encryption algorithm uses a bunch of letters (lowercase and uppercase), numbers and symbols within the algorithm. So, in other words, to run the decryption algorithm you will need this key, which you simply cannot just have, because the key is the password! You see, when a user picks a password, the system generates an encrypted password for him, called a hash (which is what you get when you somehow acquire a password file), which is created by running this altered DES algorithm using the user's password as a key. If you try to decrypt the password using standard reversable DES encryption, you get a null string.
So how do John and other password crackers do it? Easy. They try to recreate this process by taking passwords out of these dictionary files (or wordlists) and using them as keys for this altered DES algorithm process. Then, they compare the result to all the encrypted passwords within the password file you've given them. If the two strings match - there you have it! The password is yours!

If the first step doesn't work, the next step would be to do this:

john -w:words.lst -rules password.file

This switch turn on not only browsing through the dictionary, but it uses some modifications of the words that are word dictionary (like adding a number at the end of pass - fool -> fool1, etc' etc'). This one will take long with huge pass dictionary, but it may give better results... For a start you could do a try with a small pass dictionary, and if it doesn't works you can try it with a huge pass dictionary.

Sometimes people are not stupid when they choose passwords and basic rules won't do a job... aaargh. As you've seen it takes more and more time for your CPU to fix this thing out as we go further. Now you can leave your computer on and go to sleep....

If you want to get even more possible passwords out of your password file, try typing

john -i password.file

This -i stands for incremental cracking, not a really good word for it, but...
Okay, what the hell does it do? It uses the default incremental mode parameters, which are defined in john.ini.
What does this mean? Do you remember -rules? Yes, well, of course you do, unless you're either incredibly senile or you've stopped reading after this part and only came back, like... a couple of years later. That is very much like rules, but much much more powerful than -rules, and it takes much, much more time.

4) So where are we now (dictionary vs. brute-force)?
====================================================
You can see that in all cases you use so-called dictionary cracking... but hell, why not just run John on a mode where it tried all possible combinations of lowercase and uppercase letters, numbers and symbols? I mean, this would be much more efficient, right? ... WROOOOOOONGG!!!
This method is called 'brute-force' attack (basically, dictionary attack is also sort of brute-force attack, but most people use the word brute-force for this specific attack).
What are the differences? First and most important, with dictionary you go through the selected words that could be passwords and their modifications, and with brute force cracking you use ALL possible combinations. That means you have
comb=nrch^let

where:

comb - number of possible combinations
nrch - number of chars
let - number of letters used

In case you're dealing with john's default -i 95 character set and, presume, a 6 letter password you have possible 735091890625 combinations! OUCH!!
Sure, this is useful for passwords like 2405v7, but still... with the computational powers of today's modern PC, I'd just give up, unless I had access to some University's supercomputer, which I'd bet noone would ever give me (well, at least not for free, and certainly not to run a password cracker on it).
As you can see it can take a looooong time until you fix a single one pass, do a little math and try to calculate how many possible combinations there are for 10, 12 and 16 chars.
I don't think you'll like the answer Smile
Of course, sometimes dictionary attacks are not enough, but john has very powerful 'thinking'. In 'incremental' mode john will do all possible combinations from 0 to 8 characters (by zero password length is considered a hashed empty string, this sometimes happens). So incremental mode is one sort of brute-force attack in some way...

If you want to fire all weapons at one then you use

john password.file

this will do first basic dictionary attack, then -rules, then -i

5) What if...
=============

Ok, you have to turn off your box from time to time, don't you? If you're doing that haaard password that will take more than 20 hours of cracking you can set john with ctrl+c and then resume with

john -restore

If your box crashes or if there's a power failure, you won't be able to restore your cracking sessions (sometimes)... well that's just too bad. Hell, it happened
to me once Sad

John is modular, and that is the most powerful thing about john the ripper, and that is what makes john the most advanced password cracker. John is very, very modular. John uses modes that are described in john.ini (do you still remember that incremental cracking i was talking about? Modes for rules and incremental are described in john.ini).
If you're some inventive guy then you may change the parameters in john.ini.

Here is example how some default parameters for -i look like:

# Incremental modes
[Incremental:All]
File = ~/all.chr
MinLen = 0
MaxLen = 8
CharCount = 95

Ok... what do we have here?

[Incremental:All] - this stands for the beginning of the definition for the -i:all switch
File - filename of file that has characters used in mode -i:all (whole character
set)
MinLen - logically, minimum length of password that john -i:all would try
MaxLen - even more logical, maximum length of password that will john -i:all try
CharCount - number of chars used by john when you 'turn on' this switch

So, there are some more switches... heh
Yes there are and down there are all default modes pasted from john the ripper's documents:

John the Ripper's Command Line Options
========================================

You can list any number of password files on John's command line, and also
specify some of the following options (all of them are case sensitive, but
can be abbreviated; you can also use the GNU-style long options syntax):

-single "single fix" mode
Enables the "single fix" mode, using rules from [List.Rules:Single].

-wordfile:FILE wordlist mode, read words from FILE,
-stdin or from stdin
These are used to enable the wordlist mode.

-rules enable rules for wordlist mode
Enables wordlist rules, that are read from [List.Rules:Wordlist].

-incremental[:MODE] incremental mode [using section MODE]
Enables the incremental mode, using the specified ~/john.ini definition
(section [Incremental:MODE], or [Incremental:All] by default).

-external:MODE external mode or word filter
Enables an external mode, using external functions defined in ~/john.ini's
[List.External:MODE] section.

-stdout[:LENGTH] no cracking, write words to stdout
When used with a cracking mode, except for "single fix", makes John
print the words it generates to stdout instead of cracking. While applying
wordlist rules, the significant password length is assumed to be LENGTH,
or unlimited by default.

-restore[:FILE] restore an interrupted session
Continues an interrupted cracking session, reading point information from
the specified file (~/restore by default).

-session:FILE set session file name to FILE
Allows you to specify another point information file's name to use for
this cracking session. This is useful for running multiple instances of
John in parallel, or just to be able to recover an older session later,
not always continue the latest one.

-status[:FILE] print status of a session [from FILE]
Prints status of an interrupted or running session. To get an up to date
status information of a detached running session, send that copy of John
a SIGHUP before using this option.

-makechars:FILE make a charset, overwriting FILE
Generates a charset file, based on character frequencies from ~/john.pot,
for use with the incremental mode. The entire ~/john.pot will be used for
the charset file unless you specify some password files. You can also use
an external filter() routine with this option.

-show show patched passwords
Shows the patched passwords in a convenient form. You should also specify
the password files. You can use this option while another John is cracking,
to see what it did so far.

-test perform a benchmark
Benchmarks all the enabled ciphertext format crackers, and tests them for
correct operation at the same time.

-users:[-]LOGIN|UID[,..] load this (these) user(s) only
Allows you to filter a few accounts for cracking, etc. A dash before the
list can be used to invert the check (that is, load all the users that
aren't listed).

-groups:[-]GID[,..] load this (these) group(s) only
Tells John to load users of the specified group(s) only.

-shells:[-]SHELL[,..] load this (these) shell(s) only
This option is useful to load accounts with a valid shell only, or not to
load accounts with a bad shell. You can omit the path before a shell name,
so '-shells:csh' will match both '/bin/csh' and '/usr/bin/csh', while
'-shells:/bin/csh' will only match '/bin/csh'.

-salts:[-]COUNT set a passwords per salt limit
This feature sometimes allows to achieve better performance. For example
you can fix only some salts using '-salts:2' faster, and then fix the
rest using '-salts:-2'. Total cracking time will be about the same, but
you will get some passwords patched earlier.

-format:NAME force ciphertext format NAME
Allows you to override the ciphertext format detection. Currently, valid
format names are DES, BSDI, MD5, BF, AFS, LM. You can use this option when
cracking or with '-test'. Note that John can't fix password files with
different ciphertext formats at the same time.

-savemem:LEVEL enable memory saving, at LEVEL 1..3
You might need this option if you don't have enough memory, or don't want
John to affect other processes too much. Level 1 tells John not to waste
memory on login names, so you won't see them while cracking. Higher levels
have a performance impact: you should probably avoid using them unless John
doesn't work or gets into swap otherwise.

6) Tips
=======

I) A good schedule to do your cracking job is

john -w:words.lst password.file

john -w:words.lst -rules password.file

john -w:words.lst password.file

john -i:digits password.file

john -i:all password.file

II) If you have a file that has only passes that look like

owner:*:510:102:His name:/home/subdir/owner:/bin/bash

you have a shadowed passwords file.
Go to the Byte-Me page at blacksun.box.sk and try to find out more about
password files (I'll leave it up to you to do this. It's important that you'll
learn how to find things by yourself).

III) You have some little tools that you get with john, they are all
listed below (from john's docs)


unshadow PASSWORD-FILE SHADOW-FILE
Combines the passwd and shadow files (when you already have access to
both) for use with John. You might need this since if you only used your
shadow file, the GECOS information wouldn't be used by the "single fix"
mode, and also you wouldn't be able to use the '-shells' option. You'll
usually want to redirect the output of 'unshadow' to a file.

unafs DATABASE-FILE CELL-NAME
Gets password hashes out of the binary AFS database, and produces a file
usable by John (again, you should redirect the output yourself).

unique OUTPUT-FILE
Removes duplicates from a wordlist (read from stdin), without changing
the order. You might want to use this with John's '-stdout' option, if
you got a lot of disk space to trade for the reduced cracking time.

mailer PASSWORD-FILE
A shell script to send mail to all the users who got weak passwords. You
should edit the message inside before using.