The queen of hacker commands is telnet. To get Windows help for
telnet, in the cmd.exe window give the command:
C:\>telnet /?
Here's what you will get:
telnet [-a][-e escape char][-f log file][-l user][-t term][host
[port]]
-a Attempt automatic logon. Same as -l option except uses
the currently logged on user's name.
-e Escape character to enter telnet client prompt.
-f File name for client side logging
-l Specifies the user name to log in with on the remote system.
Requires that the remote system support the TELNET ENVIRON
option.
-t Specifies terminal type.
Supported term types are vt100, vt52, ansi and vtnt only.
host Specifies the hostname or IP address of the remote computer
to connect to.
port Specifies a port number or service name.
Newbie note: what is a port on a computer? A computer port is sort of like a seaport. It's where things can go in and/or out of a computer. Some ports are easy to understand, like keyboard, monitor, printer and modem. Other ports are virtual, meaning that they are created by software. When that modem port of yours (or LAN or ISDN or DSL) is connected to the Internet, your computer has the ability to open or close any of over 65,000 different virtual ports, and has the ability to connect to any of these on another computer - if it is running that port, and if a firewall doesn?t block it.
****************
****************
Newbie note: How do you address a computer over the Internet? There are two ways: by number or by name.
****************
The simplest use of telnet is to log into a remote computer. Give the
command:
C:/>telnet targetcomputer.com (substituting the name of the computer you want to telnet into for targetcomputer.com)
If this computer is set up to let people log into accounts, you may
get the message:
login:
Type your user name here, making sure to be exact. You can't swap between lower case and capital letters. For example, user name Guest is not the same as guest.
****************
Newbie note: Lots of people email me asking how to learn what their user name and password are. Stop laughing, darn it, they really do. If you don't know your user name and password, that means whoever runs that computer didn't give you an account and doesn't want you to log on.
****************
Then comes the message:
Password:
Again, be exact in typing in your password.
What if this doesn't work?
Every day people write to me complaining they can't telnet. That is
usually because they try to telnet into a computer, or a port on a
computer that is set up to refuse telnet connections. Here's what it
might look like when a computer refuses a telnet connection:
C:\ >telnet 10.0.0.3
Connecting To 10.0.0.3...Could not open connection to the host, on port 23. A connection attempt failed because the connected party did not properly respond after a period of time, or established connection failed because connected host has failed to respond.
Or you might see:
C:\ >telnet techbroker.com
Connecting To techbroker.com...Could not open connection to the host, on port 23.
No connection could be made because the target machine actively
refused it.
If you just give the telnet command without giving a port number, it
will automatically try to connect on port 23, which sometimes runs a
telnet server.
**************
Newbie note: your Windows computer has a telnet client program,
meaning it will let you telnet out of it. However you have to install
a telnet server before anyone can telnet into port 23 on your
computer.
*************
If telnet failed to connect, possibly the computer you were trying to
telnet into was down or just plain no longer in existence. Maybe the
people who run that computer don't want you to telnet into it.
How to Telnet into a Shell Account
Even though you can't telnet into an account inside some computer, often you can get some information back or get that computer to do something interesting for you. Yes, you can get a telnet connection to succeed -without doing anything illegal --against almost any computer, even if you don't have permission to log in. There are many legal things you can do to many randomly chosen computers with telnet. For example:
C:/telnet freeshell.org 22
SSH-1.99-OpenSSH_3.4p1
That tells us the target computer is running an SSH server, which enables encrypted connections between computers. If you want to SSH into an account there, you can get a shell account for free at
One reason most hackers have shell accounts on Internet servers is because you can meet the real hackers there. When you've logged in, give the command w or who. That gives a list of user names. You can talk to other users with tht talk command. Another fun thing, if your shell account allows it, is to give the command
ps -auxww
It might tell you what commands and processes other users are running. Ask other users what they are doing and they might teach you something. Just be careful not to be a pest!
***************
You can get punched in the nose warning: Your online provider might kick you off for making telnet probes of other computers. The solution is to get a local online provider and make friends with the people who run it, and convince them you are just doing harmless, legal explorations.
*************
Sometimes a port is running an interesting program, but a firewall won't let you in. For example, 10.0.0.3, a computer on my local area network, runs an email sending program, (sendmail working together with Postfix, and using Kmail to compose emails). I can use it from an account inside 10.0.0.3 to send emails with headers that hide from where I send things.
If I try to telnet to this email program from outside this computer,
here's what happens:
C:\>telnet 10.0.0.3 25
Connecting To 10.0.0.3...Could not open connection to the host, on
port 25.
No connection could be made because the target machine actively
refused it.
However, if I log into an account on 10.0.0.3 and then telnet from
inside to port 25, here's what I get:
Last login: Fri Oct 18 13:56:58 2002 from 10.0.0.1
Have a lot of fun...
cmeinel@test-box:~> telnet localhost 25
Trying ::1...
telnet: connect to address ::1: Connection refused
Trying 127.0.0.1... [Carolyn's note: 127.0.0.1 is the numerical
address meaning localhost, the same computer you are logged into]
Connected to localhost.
Escape character is '^]'.
220 test-box.local ESMTP Postfix
The reason I keep this port 25 hidden behind a firewall is to keep
people from using it to try to break in or to forge email. Now the
ubergeniuses reading this will start to make fun of me because no
Internet address that begins with 10. is reachable from the Internet.
However, sometimes I place this "test-box" computer online with a
static Internet address, meaning whenever it is on the Internet, it
always has the same numerical address. I'm not going to tell you what its Internet address is because I don't want anyone messing with it. I just want to mess with other people's computers with it, muhahaha. That's also why I always keep my Internet address from showing up in the headers of my emails.
***************
Newbie note: What is all this about headers? It's stuff at the
beginning of an email that may - or may not - tell you a lot about
where it came from and when. To see full headers, in Outlook click
view -> full headers. In Eudora, click the "Blah blah blah" icon.
****************
Hacking XP Part 2
Hacking XP Part 1
Part I: The Magic of DOS
In this guide you will learn how to telnet
nslookup
So you have the newest, glitziest, "Fisher Price" version of Windows: XP. How can you use XP in a way that sets you apart from the boring millions of ordinary users?
****************
Luser Alert: Anyone who thinks this GTMHH will reveal how to blow up people's TV sets and steal Sandra Bullock's email is going to find out that I won't tell them how.
****************
The key to doing amazing things with XP is as simple as D O S. Yes, that's right, DOS as in MS-DOS, as in MicroSoft Disk Operating System. Windows XP (as well as NT and 2000) comes with two versions of DOS. Command.com is an old DOS version. Various versions of command.com come with Windows 95, 98, SE, ME, Window 3, and DOS only operating systems.
The other DOS, which comes only with the XP, 2000 and NT operating systems, is cmd.exe. Usually cmd.exe is better than command.com because it is easier to use, has more commands, and in some ways resembles the bash shell in Linux and other Unix-type operating systems. For example, you can repeat a command by using the up arrow until you back up to the desired command. Unlike bash, however, your DOS command history is erased whenever you shut down cmd.exe. The reason XP has both versions of DOS is that sometimes a program that won?t run right in cmd.exe will work in command.com
****************
Flame Alert: Some readers are throwing fits because I dared to compare DOS to bash. I can compare cmd.exe to bash if I want to. Nanny nanny nah nah.
****************
DOS is your number one Windows gateway to the Internet, and the open sesame to local area networks. From DOS, without needing to download a single hacker program, you can do amazingly sophisticated explorations and even break into poorly defended computers.
****************
You can go to jail warning: Breaking into computers is against the law if you do not have permission to do so from the owner of that computer. For example, if your friend gives you permission to break into her Hotmail account, that won't protect you because Microsoft owns Hotmail and they will never give you permission.
****************
****************
You can get expelled warning: Some kids have been kicked out of school just for bringing up a DOS prompt on a computer. Be sure to get a teacher's WRITTEN permission before demonstrating that you can hack on a school computer.
****************
So how do you turn on DOS?
Click All Programs -> Accessories -> Command Prompt
That runs cmd.exe. You should see a black screen with white text on it, saying something like this:
Microsoft Windows XP [Version 5.1.2600]
(C) Copyright 1985-2001 Microsoft Corp.
C:\>
Your first step is to find out what commands you can run in DOS. If you type "help" at the DOS prompt, it gives you a long list of commands. However, this list leaves out all the commands hackers love to use. Here are some of those left out hacker commands.
TCP/IP commands:
telnet
netstat
nslookup
tracert
ping
ftp
NetBIOS commands (just some examples):
nbtstat
net use
net view
net localgroup
TCP/IP stands for transmission control protocol/Internet protocol. As you can guess by the name, TCP/IP is the protocol under which the Internet runs. along with user datagram protocol (UDP). So when you are connected to the Internet, you can try these commands against other Internet computers. Most local area networks also use TCP/IP.
NetBIOS (Net Basic Input/Output System) protocol is another way to communicate between computers. This is often used by Windows computers, and by Unix/Linux type computers running Samba. You can often use NetBIOS commands over the Internet (being carried inside of, so to speak, TCP/IP). In many cases, however, NetBIOS commands will be blocked by firewalls. Also, not many Internet computers run NetBIOS because it is so easy to break in using them. We will cover NetBIOS commands in the next Guide to XP Hacking.
Hacking Pasword Protected site
There are many ways to defeat java-script protected web
sites. S ome are very simplistic, such as hitting ctl-alt-del
when the password box is displayed, to simply turning off
java capability, which will dump you into t he default page.
You can try manually searching for other directories, by
typing the directory name into the url address box of your
browser, ie: you w ant access to www.target.com . Try typing
www.target.com/images .(almost ever y web site has an images
directory) This will put you into the images directo ry,
and give you a text list of all the images located there.
Often, the t itle of an image will give you a clue to the
name of another directory. ie: in www.target.com/images,
there is a .gif named gamestitle.gif . There is a g ood
chance then, that there is a 'games' directory on the site,
so you wou ld then type in www.target.com/games, and if it is
a valid directory, you aga in get a text listing of all thefiles available there.
For a more automated a pproach, use a program like WEB SNAKE
from anawave, or Web Wacker. These pro grams will create a
mirror image of an entire web site, showing all director ies,
or even mirror a complete server. They are indispensable for
locating hidden files and directories.
What do you do if you can't get past an openin g "Password
Required" box? First do an WHOIS Lookup for the site. In our
example, www.target.com . We find it's hosted by www.host.com
at 100.100.100. 1. We then go to 100.100.100.1, and then launch \
Web Snake, and mirror the e ntire server. Set Web Snake to NOT
download anything over about 20K. (not ma ny HTML pages are
bigger than this) This speeds things up some, and keeps yo u
from getting a lot of files and images you don't care about.
This can take a long time, so consider running it right before bed time.
Once you have an image of the entire server, you look through
the directories listed, and find /target. When we open that
directory, we find its contents, and all of i ts sub-directories listed.
Let's say we find /target/games/zip/zipindex.html . This would be the index
page that would be displayed had you gone through the
password procedure, and allowed it to redirect you here.
By simply typ ing in the url
www.target.com/games/zip/zipindex.html you will be on
the index page and ready to follow the links for downloading.
A Novice's Guide To Hacking
The word "hacking" is here used the way the non-hacking public
thinks it is used, to mean breaking into somebody else's computer. Its
purpose is to expand and clarify the information about the TOPS-20 operating
system, which runs on DECsystem-20 mainframes. The Mentor basically lumped
this system in with TOPS-10 and didn't note important differences between the
two. I will here reproduce in full what The Mentor had to say about TOPS-10
and about VMS, which are the parent and the offspring of TOPS-20.
VMS- The VAX computer is made by Digital Equipment Corporation (DEC),
and runs the VMS (Virtual Memory System) operating system.
VMS is characterized by the 'Username:' prompt. It will not tell
you if you've entered a valid username or not, and will disconnect
you after three bad login attempts. It also keeps track of all
failed login attempts and informs the owner
of the account next time
s/he logs in how many bad login attempts were made on the account.
It is one of the most secure operating systems around from the
outside, but once you're in there are many things that you can do
to circumvent system security. The VAX also has the best set of
help files in the world. Just type HELP and read to your heart's
content.
Common Accounts/Defaults: [username: password [[,password]] ]
SYSTEM: OPERATOR or MANAGER or SYSTEM or SYSLIB
OPERATOR: OPERATOR
SYSTEST: UETP
SYSMAINT: SYSMAINT or SERVICE or DIGITAL
FIELD: FIELD or SERVICE
GUEST: GUEST or unpassworded
DEMO: DEMO or unpassworded
DECNET: DECNET
DEC-10- An earlier line of DEC computer equipment, running the TOPS-10
operating system. These machines are recognized by their
'.' prompt. The DEC-10/20 series are remarkably hacker-friendly,
allowing you to enter several important commands without ever
logging into the system. Accounts are in the format [xxx,yyy] where
xxx and yyy are integers. You can get a listing of the accounts and
the process names of everyone on the system before logging in with
the command .systat (for SYstem STATus). If you seen an account
that reads [234,1001] BOB JONES, it might be wise to try BOB or
JONES or both for a password on this account. To login, you type
.login xxx,yyy and then type the password when prompted for it.
The system will allow you unlimited tries at an account, and does
not keep records of bad login attempts. It will also inform you
if the UIC you're trying (UIC = User Identification Code, 1,2 for
example) is bad.
Common Accounts/Defaults:
1,2: SYSLIB or OPERATOR or MANAGER
2,7: MAINTAIN
5,30: GAMES
**** note: I'm remembering this stuff from several years ago, and in some
cases my memory may be foggy or stuff may be outdated.
TOPS-20, once you are inside, resembles VMS much more than it resembles
TOPS-10, as far as I know (I'm not really familiar with VMS). From the
outside, it's more like TOPS-10, except that the prompt is a @ instead of a
period. You can enter many commands without logging in, including SYSTAT and
probably FINGER. (Sometimes you can even use the mail program without
logging in.) It is very helpful. Not only does the command HELP lead to
lots of useful information, but anywhere in typing a command you can press ?
and it will tell you what the format of the command expects. For instance,
if you type ? by itself, it will tell you all the words that a command can
begin with. If you type S?, it will tell you all the commands that start
with the letter S. If you type SYSTAT ?, it will tell you the options
available on the systat command. You can use this at any point in any
command. Furthermore, if there is only one possibility (you have typed a
unique abbreviation), you can press Escape and it will finish the word for
you. I'm not sure, but I think TOPS-20 was the system that first introduced
filename completion as well --turning a uniquely abbreviated filename into a
complete name when you press escape, beeping if the abbreviation is not
unique. With command keywords you can leave the abbreviation un-expanded,
with filenames you have to expand it (or type it all in) for it to work.
Use the "Login" command to log in, followed by a username. It will prompt
for a password. Note that a password can be something like 39 characters
long, as can the username itself. TOPS-20 does NOT use numbers like 317,043
for user IDs. (Note that these numbers in TOPS-10 are octal, not decimal.)
Furthermore, the password can contain spaces. So, if somebody wants to make
his password difficult to guess, he can easily do so.
(But sometimes they might get overconfident. I remember a story from
Stanford... Someone asked the large cheese if he would let him know what the
operator password was, and he said "The operator password is currently
unavailable." So the guy tried "currently unavailable" as a password, and
got in. (Which reminds me of the time they got a real bug in the system
there... a head crash caused by an ant on the disk platter.))
In general, TOPS-20 does not limit the number of login attempts, nor does it
keep a record of bad tries. However, it is not difficult for the local
management to add such measures, or others such as a delay of several seconds
after each attempt. And unlike Unix, it is difficult to evade these even
once you're in. Without heavy in-depth knowledge, you can't test a username-
password combination except through a system call, which will enforce delays
and limited failures and such against password-trying programs.
So, TOPS-20 is easy to defend against the "database hack", in which you try
many different common passwords with many different usernames. (Unix is
much more vulnerable to this.) But any particular system, especially a lax
one like a college machine (DEC is always popular in academia), might have
little defense here. But you might not know how much defense until too late.
Do try the GUEST username.
But TOPS-20 can be very vulnerable to trojan horses. See, there's this thing
called the Wheel bit. A username that has the Wheel property can do anything
the system operator can do, such as ignore file protection masks, edit the
disks at the track/sector level, change any area of memory... On Unix, only
one user, the superuser, can read and write protected files. On TOPS-20, any
user can do these things from any terminal, if the Wheel attribute is set in
his user data. Some campus computers tend to accumulate excess trusted users
with wheel bits, and have to periodically prune away the unnecessary ones.
The thing is that a wheel can do these things without knowing that he has
done them. Normally the privileged commands are deactivated. But a program
run by a wheel can activate the privileges, do anything it wants, cover its
tracks, and deactivate them without the user ever being the wiser. So if you
can get any wheel user to run any program you wrote, such as a game or small
utility... there's no limit to what you can do. In particular, you can
create a new username, and make it a wheel. Or you can simply ask the system
outright for someone's password, if I'm not mistaken. (All this requires
access to TOPS-20 programming manuals, but some of the necessary material
should be available on line.) You cannot actually conceal this creation, as
far as I know... but maybe with sophisticated enough knowledge you could
make it not immediately apparent... Anyway, once you get that far in, you can
probably keep one step ahead of them for a while... If they erase your new
accounts, you can use the passwords to old ones... They can change all of
the wheel passwords, but a lot of the regular users won't change for some
time... You could even lock the operators out of their own system by
changing all their passwords for them, if you were crazy enough, perhaps
forcing them to shut the machine down to regain control of it. They might
even have to restore stuff from tape backup.
Even if you don't wedge your way into secret stuff, a TOPS-20 system can be
fun to explore. It's much more novice-friendly than most systems, and much
more hacker-friendly as well. I think the ascendency of Unix as the least-
common-denominator OS that everybody can agree on is a definite loss,
compared to TOPS-20.
HACKING ANGELFIRE ACCOUNTS
THIS TEXT FILE IS FOR EDUCATIONAL PURPOSES ONLY!! WITH THIS KNOWLEDGE I IN NO WAY ENCOURAGE U
TO GO ON A HACKING SPREE!! JUST KNOWING HOW SHOULD BE ENOUGH!!!
This text file may be
redistributed freely. But, it may NOT be changed in any way without permission from HotWired. So spread the knowledge!!!!!
================================================================
To Whom It May Concern,
My name is DJ and my web page is located at http://www.angelfire.com/ky/LydianSociety/welcome.html. This weekend I left for a trip to NY, and when I got back I decided to edit my homepage. Except when I entered my password it did not work. I am fairly sure I have the right one but am not 100% certain. I would have used the web based password retrieving system form your site but I have changed my E-Mail addresses as well, so the old ones are no longer available. My new address is XLydeX@hotmail.com
If you would please send me my account information again so I can finally edit my page again, I would be greatful. Thank you.
Lyde
==============
The Angelfire Hack!
==============
Enough with the legal shit! Let's get to the hack! Ok... You know this lamer on the net and u
want to get him back and he's got a page on Angelfire! What do u do? You hack his page of
course! For those of you who don't know what Angelfire is it's a free web page service. The
basic things u will need to hack an Angelfire account are:
/\/\/\/\ STEP 1 /\/\/\/\
The full url of this dood's page. Like http://www.angelfire.com/ca/lamer/index.html
or what ever the url is... Basically what the url says is his page is at angelfire.com
in the State of California in a directory called lamer. Index is just the name of the
specific page. It could be different, but it usually defaults to index.html for their
main page if they didn't change it.
/\/\/\/\ STEP 2 /\/\/\/\
I know what ur saying... How could i hack an account with just the url!! Keep reading! On
to step 2! Next up you need to find out this person's old email addy. Usually it's on their
front page. Write it down!
/\/\/\/\ STEP 3 /\/\/\/\
Now you've got their full url and their email address. Now you have to find their name on their
page. Usually they fill u in on what their real names are so find it and write it down. This
isn't necessary, but it makes the letter a lot more genuine...
/\/\/\/\ STEP 4 /\/\/\/\
With all this information write a letter to Angelfire sayin how unhappy u r! Angelfire's help
mail is mail@angelfire.com. Make the letter sound like a REAL scenario. That's the trick to
this hack. A little social engineering goes a long way in getting u what u want. Say something
in your letter like you went on vacation and forgot ur dam password! Say that you changed your
email address and your old addy is no longer available so the password retrievable form won't
work because it's sending to an unavailable address. So you give them a new address to send
the password to!! Check ur mail the next day and wallah!!! INSTANT ACCESS!!!
-released by-
\\\\\\\\\ HotWired /////////
oO keeping the scene alive! Oo
