anonymous ftp at */ /* sunsite.unc.edu */ /* /pub/Linux/system/Network/management/ */ SGI Irix nfswatch /* Available via anonymous ftp */ Etherman tcpdump /* Available via anonymous ftp */ Solaris snoop tcpdump SunOS etherfind nfswatch /* Available via anonymous ftp */ tcpdump /* Available via anonymous ftp */ DOS ETHLOAD /* Available via anonymous ftp as */ /* ethld104.zip */ The Gobbler /* Available via anonymous ftp */ LanPatrol LanWatch Netmon Netwatch Netzhack /* Available via anonymous ftp at */ /* mistress.informatik.unibw-muenchen.de */ /* /pub/netzhack.mac */ Macintosh Etherpeek Here is source code for a sample ethernet sniffer: /* Esniff.c */ #include <stdio.h> #include <ctype.h> #include <string.h> #include <sys/time.h> #include <sys/file.h> #include <sys/stropts.h> #include <sys/signal.h> #include <sys/types.h> #include <sys/socket.h> #include <sys/ioctl.h> #include <net/if.h> #include <net/nit_if.h> #include <net/nit_buf.h> #include <net/if_arp.h> #include <netinet/in.h> #include <netinet/if_ether.h> #include <netinet/in_systm.h> #include <netinet/ip.h> #include <netinet/udp.h> #include <netinet/ip_var.h> #include <netinet/udp_var.h> #include <netinet/in_systm.h> #include <netinet/tcp.h> #include <netinet/ip_icmp.h> #include <netdb.h> #include <arpa/inet.h> #define ERR stderr char *malloc(); char *device, *ProgName, *LogName; FILE *LOG; int debug=0; #define NIT_DEV "/dev/nit" #define CHUNKSIZE 4096 /* device buffer size */ int if_fd = -1; int Packet[CHUNKSIZE+32]; void Pexit(err,msg) int err; char *msg; { perror(msg); exit(err); } void Zexit(err,msg) int err; char *msg; { fprintf(ERR,msg); exit(err); } #define IP ((struct ip *)Packet) #define IP_OFFSET (0x1FFF) #define SZETH (sizeof(struct ether_header)) #define IPLEN (ntohs(ip->ip_len)) #define IPHLEN (ip->ip_hl) #define TCPOFF (tcph->th_off) #define IPS (ip->ip_src) #define IPD (ip->ip_dst) #define TCPS (tcph->th_sport) #define TCPD (tcph->th_dport) #define IPeq(s,t) ((s).s_addr == (t).s_addr) #define TCPFL(FLAGS) (tcph->th_flags & (FLAGS)) #define MAXBUFLEN (128) time_t LastTIME = 0; struct CREC { struct CREC *Next, *Last; time_t Time; /* start time */ struct in_addr SRCip, DSTip; u_int SRCport, /* src/dst ports */ DSTport; u_char Data[MAXBUFLEN+2]; /* important stuff :-) */ u_int Length; /* current data length */ u_int PKcnt; /* # pkts */ u_long LASTseq; }; struct CREC *CLroot = NULL; char *Symaddr(ip) register struct in_addr ip; { register struct hostent *he = gethostbyaddr((char *)&ip.s_addr, sizeof(struct in_addr),AF_INET); return( (he)?(he->h_name):(inet_ntoa(ip)) ); } char *TCPflags(flgs) register u_char flgs; { static char iobuf[8]; #define SFL(P,THF,C) iobuf[P]=((flgs & THF)?C:'-') SFL(0,TH_FIN, 'F'); SFL(1,TH_SYN, 'S'); SFL(2,TH_RST, 'R'); SFL(3,TH_PUSH,'P'); SFL(4,TH_ACK, 'A'); SFL(5,TH_URG, 'U'); iobuf[6]=0; return(iobuf); } char *SERVp(port) register u_int port; { static char buf[10]; register char *p; switch(port) { case IPPORT_LOGINSERVER: p="rlogin"; break; case IPPORT_TELNET: p="telnet"; break; case IPPORT_SMTP: p="smtp"; break; case IPPORT_FTP: p="ftp"; break; default: sprintf(buf,"%u",port); p=buf; break; } return(p); } char *Ptm(t) register time_t *t; { register char *p = ctime(t); p[strlen(p)-6]=0; /* strip " YYYY\n" */ return(p); } char *NOWtm() { time_t tm; time(&tm); return( Ptm(&tm) ); } #define MAX(a,b) (((a)>(b))?(a):(b)) #define MIN(a,b) (((a)<(b))?(a):(b)) /* add an item */ #define ADD_NODE(SIP,DIP,SPORT,DPORT,DATA,LEN) { \ register struct CREC *CLtmp = \ (struct CREC *)malloc(sizeof(struct CREC)); \ time( &(CLtmp->Time) ); \ CLtmp->SRCip.s_addr = SIP.s_addr; \ CLtmp->DSTip.s_addr = DIP.s_addr; \ CLtmp->SRCport = SPORT; \ CLtmp->DSTport = DPORT; \ CLtmp->Length = MIN(LEN,MAXBUFLEN); \ bcopy( (u_char *)DATA, (u_char *)CLtmp->Data, CLtmp->Length); \ CLtmp->PKcnt = 1; \ CLtmp->Next = CLroot; \ CLtmp->Last = NULL; \ CLroot = CLtmp; \ } register struct CREC *GET_NODE(Sip,SP,Dip,DP) register struct in_addr Sip,Dip; register u_int SP,DP; { register struct CREC *CLr = CLroot; while(CLr != NULL) { if( (CLr->SRCport == SP) && (CLr->DSTport == DP) && IPeq(CLr->SRCip,Sip) && IPeq(CLr->DSTip,Dip) ) break; CLr = CLr->Next; } return(CLr); } #define ADDDATA_NODE(CL,DATA,LEN) { \ bcopy((u_char *)DATA, (u_char *)&CL->Data[CL->Length],LEN); \ CL->Length += LEN; \ } #define PR_DATA(dp,ln) { \ register u_char lastc=0; \ while(ln-- >0) { \ if(*dp < 32) { \ switch(*dp) { \ case '\0': if((lastc=='\r') || (lastc=='\n') || lastc=='\0') \ break; \ case '\r': \ case '\n': fprintf(LOG,"\n : "); \ break; \ default : fprintf(LOG,"^%c", (*dp + 64)); \ break; \ } \ } else { \ if(isprint(*dp)) fputc(*dp,LOG); \ else fprintf(LOG,"(%d)",*dp); \ } \ lastc = *dp++; \ } \ fflush(LOG); \ } void END_NODE(CLe,d,dl,msg) register struct CREC *CLe; register u_char *d; register int dl; register char *msg; { fprintf(LOG,"\n-- TCP/IP LOG -- TM: %s --\n", Ptm(&CLe->Time)); fprintf(LOG," PATH: %s(%s) =>", Symaddr(CLe->SRCip),SERVp(CLe->SRCport)); fprintf(LOG," %s(%s)\n", Symaddr(CLe->DSTip),SERVp(CLe->DSTport)); fprintf(LOG," STAT: %s, %d pkts, %d bytes [%s]\n", NOWtm(),CLe->PKcnt,(CLe->Length+dl),msg); fprintf(LOG," DATA: "); { register u_int i = CLe->Length; register u_char *p = CLe->Data; PR_DATA(p,i); PR_DATA(d,dl); } fprintf(LOG,"\n-- \n"); fflush(LOG); if(CLe->Next != NULL) CLe->Next->Last = CLe->Last; if(CLe->Last != NULL) CLe->Last->Next = CLe->Next; else CLroot = CLe->Next; free(CLe); } /* 30 mins (x 60 seconds) */ #define IDLE_TIMEOUT 1800 #define IDLE_NODE() { \ time_t tm; \ time(&tm); \ if(LastTIME<tm) { \ register struct CREC *CLe,*CLt = CLroot; \ LastTIME=(tm+IDLE_TIMEOUT); tm-=IDLE_TIMEOUT; \ while(CLe=CLt) { \ CLt=CLe->Next; \ if(CLe->Time <tm) \ END_NODE(CLe,(u_char *)NULL,0,"IDLE TIMEOUT"); \ } \ } \ } void filter(cp, pktlen) register char *cp; register u_int pktlen; { register struct ip *ip; register struct tcphdr *tcph; { register u_short EtherType=ntohs(((struct ether_header *)cp)->ether_type); if(EtherType < 0x600) { EtherType = *(u_short *)(cp + SZETH + 6); cp+=8; pktlen-=8; } if(EtherType != ETHERTYPE_IP) /* chuk it if its not IP */ return; } /* ugh, gotta do an alignment :-( */ bcopy(cp + SZETH, (char *)Packet,(int)(pktlen - SZETH)); ip = (struct ip *)Packet; if( ip->ip_p != IPPROTO_TCP) /* chuk non tcp pkts */ return; tcph = (struct tcphdr *)(Packet + IPHLEN); if(!( (TCPD == IPPORT_TELNET) || (TCPD == IPPORT_LOGINSERVER) || (TCPD == IPPORT_FTP) )) return; { register struct CREC *CLm; register int length = ((IPLEN - (IPHLEN * 4)) - (TCPOFF * 4)); register u_char *p = (u_char *)Packet; p += ((IPHLEN * 4) + (TCPOFF * 4)); if(debug) { fprintf(LOG,"PKT: (%s %04X) ", TCPflags(tcph->th_flags),length); fprintf(LOG,"%s[%s] => ", inet_ntoa(IPS),SERVp(TCPS)); fprintf(LOG,"%s[%s]\n", inet_ntoa(IPD),SERVp(TCPD)); } if( CLm = GET_NODE(IPS, TCPS, IPD, TCPD) ) { CLm->PKcnt++; if(length>0) if( (CLm->Length + length) < MAXBUFLEN ) { ADDDATA_NODE( CLm, p,length); } else { END_NODE( CLm, p,length, "DATA LIMIT"); } if(TCPFL(TH_FIN|TH_RST)) { END_NODE( CLm, (u_char *)NULL,0,TCPFL(TH_FIN)?"TH_FIN":"TH_RST" ); } } else { if(TCPFL(TH_SYN)) { ADD_NODE(IPS,IPD,TCPS,TCPD,p,length); } } IDLE_NODE(); } } /* signal handler */ void death() { register struct CREC *CLe; while(CLe=CLroot) END_NODE( CLe, (u_char *)NULL,0, "SIGNAL"); fprintf(LOG,"\nLog ended at => %s\n",NOWtm()); fflush(LOG); if(LOG != stdout) fclose(LOG); exit(1); } /* opens network interface, performs ioctls and reads from it, * passing data to filter function */ void do_it() { int cc; char *buf; u_short sp_ts_len; if(!(buf=malloc(CHUNKSIZE))) Pexit(1,"Eth: malloc"); /* this /dev/nit initialization code pinched from etherfind */ { struct strioctl si; struct ifreq ifr; struct timeval timeout; u_int chunksize = CHUNKSIZE; u_long if_flags = NI_PROMISC; if((if_fd = open(NIT_DEV, O_RDONLY)) < 0) Pexit(1,"Eth: nit open"); if(ioctl(if_fd, I_SRDOPT, (char *)RMSGD) < 0) Pexit(1,"Eth: ioctl (I_SRDOPT)"); si.ic_timout = INFTIM; if(ioctl(if_fd, I_PUSH, "nbuf") < 0) Pexit(1,"Eth: ioctl (I_PUSH \"nbuf\")"); timeout.tv_sec = 1; timeout.tv_usec = 0; si.ic_cmd = NIOCSTIME; si.ic_len = sizeof(timeout); si.ic_dp = (char *)&timeout; if(ioctl(if_fd, I_STR, (char *)&si) < 0) Pexit(1,"Eth: ioctl (I_STR: NIOCSTIME)"); si.ic_cmd = NIOCSCHUNK; si.ic_len = sizeof(chunksize); si.ic_dp = (char *)&chunksize; if(ioctl(if_fd, I_STR, (char *)&si) < 0) Pexit(1,"Eth: ioctl (I_STR: NIOCSCHUNK)"); strncpy(ifr.ifr_name, device, sizeof(ifr.ifr_name)); ifr.ifr_name[sizeof(ifr.ifr_name) - 1] = '\0'; si.ic_cmd = NIOCBIND; si.ic_len = sizeof(ifr); si.ic_dp = (char *)𝔦 if(ioctl(if_fd, I_STR, (char *)&si) < 0) Pexit(1,"Eth: ioctl (I_STR: NIOCBIND)"); si.ic_cmd = NIOCSFLAGS; si.ic_len = sizeof(if_flags); si.ic_dp = (char *)&if_flags; if(ioctl(if_fd, I_STR, (char *)&si) < 0) Pexit(1,"Eth: ioctl (I_STR: NIOCSFLAGS)"); if(ioctl(if_fd, I_FLUSH, (char *)FLUSHR) < 0) Pexit(1,"Eth: ioctl (I_FLUSH)"); } while ((cc = read(if_fd, buf, CHUNKSIZE)) >= 0) { register char *bp = buf, *bufstop = (buf + cc); while (bp < bufstop) { register char *cp = bp; register struct nit_bufhdr *hdrp; hdrp = (struct nit_bufhdr *)cp; cp += sizeof(struct nit_bufhdr); bp += hdrp->nhb_totlen; filter(cp, (u_long)hdrp->nhb_msglen); } } Pexit((-1),"Eth: read"); } /* Authorize your program, generate your own password and uncomment here */ /* #define AUTHPASSWD "EloiZgZejWyms" */ void getauth() { char *buf,*getpass(),*crypt(); char pwd[21],prmpt[81]; strcpy(pwd,AUTHPASSWD); sprintf(prmpt,"(%s)UP? ",ProgName); buf=getpass(prmpt); if(strcmp(pwd,crypt(buf,pwd))) exit(1); } */ void main(argc, argv) int argc; char **argv; { char cbuf[BUFSIZ]; struct ifconf ifc; int s, ac=1, backg=0; ProgName=argv[0]; /* getauth(); */ LOG=NULL; device=NULL; while((ac<argc) && (argv[ac][0] == '-')) { register char ch = argv[ac++][1]; switch(toupper(ch)) { case 'I': device=argv[ac++]; break; case 'F': if(!(LOG=fopen((LogName=argv[ac++]),"a"))) Zexit(1,"Output file cant be opened\n"); break; case 'B': backg=1; break; case 'D': debug=1; break; default : fprintf(ERR, "Usage: %s [-b] [-d] [-i interface] [-f file]\n", ProgName); exit(1); } } if(!device) { if((s=socket(AF_INET, SOCK_DGRAM, 0)) < 0) Pexit(1,"Eth: socket"); ifc.ifc_len = sizeof(cbuf); ifc.ifc_buf = cbuf; if(ioctl(s, SIOCGIFCONF, (char *)&ifc) < 0) Pexit(1,"Eth: ioctl"); close(s); device = ifc.ifc_req->ifr_name; } fprintf(ERR,"Using logical device %s [%s]\n",device,NIT_DEV); fprintf(ERR,"Output to %s.%s%s",(LOG)?LogName:"stdout", (debug)?" (debug)":"",(backg)?" Backgrounding ":"\n"); if(!LOG) LOG=stdout; signal(SIGINT, death); signal(SIGTERM,death); signal(SIGKILL,death); signal(SIGQUIT,death); if(backg && debug) { fprintf(ERR,"[Cannot bg with debug on]\n"); backg=0; } if(backg) { register int s; if((s=fork())>0) { fprintf(ERR,"[pid %d]\n",s); exit(0); } else if(s<0) Pexit(1,"fork"); if( (s=open("/dev/tty",O_RDWR))>0 ) { ioctl(s,TIOCNOTTY,(char *)NULL); close(s); } } fprintf(LOG,"\nLog started at => %s [pid %d]\n",NOWtm(),getpid()); fflush(LOG); do_it(); } 20. What is an Internet Outdial? An Internet outdial is a modem connected to the Internet than you can use to dial out. Normal outdials will only call local numbers. A GOD (Global OutDial) is capable of calling long distance. Outdials are an inexpensive method of calling long distance BBS's. 21. What are some Internet Outdials? This FAQ answer is excerpted from CoTNo #5: Internet Outdial List v3.0 by Cavalier and DisordeR Introduction ------------ There are several lists of Internet outdials floating around the net these days. The following is a compilation of other lists, as well as v2.0 by DeadKat(CoTNo issue 2, article 4). Unlike other lists where the author just ripped other people and released it, we have sat down and tested each one of these. Some of them we have gotten "Connection Refused" or it timed out while trying to connect...these have been labeled dead. Working Outdials ---------------- as of 12/29/94 NPA IP Address Instructions --- ---------- ------------ 215 isn.upenn.edu modem 217 dialout.cecer.army.mil atdt x,xxxXXXXX 218 modem.d.umn.edu atdt9,xxxXXXX 303 yuma.acns.colostate.edu 3020 412 myriad.pc.cc.cmu.edu 2600 Press D at the prompt 412 gate.cis.pitt.edu tn3270, connect dialout.pitt.edu, atdtxxxXXXX 413 dialout2400.smith.edu Ctrl } gets ENTER NUMBER: xxxxxxx 502 outdial.louisville.edu 502 uknet.uky.edu connect kecnet @ dial: "outdial2400 or out" 602 acssdial.inre.asu.edu atdt8,,,,,[x][yyy]xxxyyyy 614 ns2400.acs.ohio-state.edu 614 ns9600.acs.ohio-state.edu 713 128.249.27.153 atdt x,xxxXXXX 714 modem.nts.uci.edu atdt[area]0[phone] 804 ublan.virginia.edu connect hayes, 9,,xxx-xxxx 804 ublan2.acc.virginia.edu connect telnet connect hayes Need Password ------------- 206 rexair.cac.washington.edu This is an unbroken password 303 yuma.ACNS.ColoState.EDU login: modem 404 128.140.1.239 .modem8|CR 415 annex132-1.EECS.Berkeley.EDU "dial1" or "dial2" or "dialer1" 514 cartier.CC.UMontreal.CA externe,9+number 703 wal-3000.cns.vt.edu dial2400 -aa Dead/No Connect --------------- 201 idsnet 202 modem.aidt.edu 204 dial.cc.umanitoba.ca 204 umnet.cc.manitoba.ca "dial12" or "dial24" 206 dialout24.cac.washington.edu 207 modem-o.caps.maine.edu 212 B719-7e.NYU.EDU dial3/dial12/dial24 212 B719-7f.NYU.EDU dial3/dial12/dial24 212 DIALOUT-1.NYU.EDU dial3/dial12/dial24 212 FREE-138-229.NYU.EDU dial3/dial12/dial24 212 UP19-4b.NYU.EDU dial3/dial12/dial24 215 wiseowl.ocis.temple.edu "atz" "atdt 9xxxyyyy" 218 aa28.d.umn.edu "cli" "rlogin modem" at "login:" type "modem" 218 modem.d.umn.edu Hayes 9,XXX-XXXX 301 dial9600.umd.edu 305 alcat.library.nova.edu 305 office.cis.ufl.edu 307 modem.uwyo.edu Hayes 0,XXX-XXXX 313 35.1.1.6 dial2400-aa or dial1200-aa or dialout 402 dialin.creighton.edu 402 modem.criegthon.edu 404 broadband.cc.emory.edu ".modem8" or ".dialout" 408 dialout.scu.edu 408 dialout1200.scu.edu 408 dialout2400.scu.edu 408 dialout9600.scu.edu 413 dialout.smith.edu 414 modems.uwp.edu 416 annex132.berkely.edu atdt 9,,,,, xxx-xxxx 416 pacx.utcs.utoronto.ca modem 503 dialout.uvm.edu 513 dialout24.afit.af.mil 513 r596adi1.uc.edu 514 pacx.CC.UMontreal.CA externe#9 9xxx-xxxx 517 engdial.cl.msu.edu 602 dial9600.telcom.arizona.edu 603 dialout1200.unh.edu 604 dial24-nc00.net.ubc.ca 604 dial24-nc01.net.ubc.ca 604 dial96-np65.net.ubc.ca 604 gmodem.capcollege.bc.ca 604 hmodem.capcollege.bc.ca 609 128.119.131.11X (X= 1 - 4) Hayes 609 129.119.131.11x (x = 1 to 4) 609 wright-modem-1.rutgers.edu 609 wright-modem-2.rutgers.edu 612 modem_out12e7.atk.com 612 modem_out24n8.atk.com 614 ns2400.ircc.ohio-state.edu "dial" 615 dca.utk.edu dial2400 D 99k # 615 MATHSUN23.MATH.UTK.EDU dial 2400 d 99Kxxxxxxx 616 modem.calvin.edu 617 128.52.30.3 2400baud 617 dialout.lcs.mit.edu 617 dialout1.princeton.edu 617 isdn3.Princeton.EDU 617 jadwingymkip0.Princeton.EDU 617 lord-stanley.Princeton.EDU 617 mpanus.Princeton.EDU 617 mrmodem.wellesley.edu 617 old-dialout.Princeton.EDU 617 stagger.Princeton.EDU 617 sunshine-02.lcs.mit.edu 617 waddle.Princeton.EDU 619 128.54.30.1 atdt [area][phone] 619 dialin.ucsd.edu "dialout" 703 modem_pool.runet.edu 703 wal-3000.cns.vt.edu 713 128.249.27.154 "c modem96" "atdt 9xxx-xxxx" or "Hayes" 713 modem12.bcm.tmc.edu 713 modem24.bcm.tmc.edu 713 modem24.bcm.tmc.edu 714 mdmsrv7.sdsu.edu atdt 8xxx-xxxx 714 modem24.nts.uci.edu 714 pub-gopher.cwis.uci.edu 801 dswitch.byu.edu "C Modem" 808 irmodem.ifa.hawaii.edu 902 star.ccs.tuns.ca "dialout" 916 129.137.33.72 916 cc-dnet.ucdavis.edu connect hayes/dialout 916 engr-dnet1.engr.ucdavis.edu UCDNET <ret> C KEYCLUB <ret> ??? 128.119.131.11X (1 - 4) ??? 128.200.142.5 ??? 128.54.30.1 nue, X to discontinue, ? for Help ??? 128.6.1.41 ??? 128.6.1.42 ??? 129.137.33.72 ??? 129.180.1.57 ??? 140.112.3.2 ntu <none> ??? annexdial.rz.uni-duesseldorf.de ??? dial96.ncl.ac.uk ??? dialout.plk.af.mil ??? ee21.ee.ncu.edu.tw cs8005 ??? im.mgt.ncu.edu.tw guest <none> ??? modem.cis.uflu.edu ??? modem.ireq.hydro.qc.ca ??? modems.csuohio.edu ??? sparc20.ncu.edu.tw u349633 ??? sun2cc.nccu.edu.tw ? ??? ts-modem.une.oz.au ??? twncu865.ncu.edu.tw guest <none> ??? vtnet1.cns.ut.edu "CALL" or "call" Conclusion ---------- If you find any of the outdials to have gone dead, changed commands, or require password, please let us know so we can keep this list as accurate as possible. If you would like to add to the list, feel free to mail us and it will be included in future versions of this list, with your name beside it. Have fun... [Editors note: Updates have been made to this document after the original publication] 22. What is this system? AIX ~~~ IBM AIX Version 3 for RISC System/6000 (C) Copyrights by IBM and by others 1982, 1990. login: [You will know an AIX system because it is the only Unix system that] [clears the screen and issues a login prompt near the bottom of the] [screen] AS/400 ~~~~~~ UserID? Password? Once in, type GO MAIN CDC Cyber ~~~~~~~~~ WELCOME TO THE NOS SOFTWARE SYSTEM. COPYRIGHT CONTROL DATA 1978, 1987. 88/02/16. 02.36.53. N265100 CSUS CYBER 170-730. NOS 2.5.2-678/3. FAMILY: You would normally just hit return at the family prompt. Next prompt is: USER NAME: CISCO Router ~~~~~~~~~~~~ FIRST BANK OF TNO 95-866 TNO VirtualBank REMOTE Router - TN043R1 Console Port SN - 00000866 TN043R1> DECserver ~~~~~~~~~ DECserver 700-08 Communications Server V1.1 (BL44G-11A) - LAT V5.1 DPS502-DS700 (c) Copyright 1992, Digital Equipment Corporation - All Rights Reserved Please type HELP if you need assistance Enter username> TNO Local> Hewlett Packard MPE-XL ~~~~~~~~~~~~~~~~~~~~~~ MPE XL: EXPECTED A :HELLO COMMAND. (CIERR 6057) MPE XL: EXPECTED [SESSION NAME,] USER.ACCT [,GROUP] (CIERR 1424) MPE XL: GTN ~~~ WELCOME TO CITIBANK. PLEASE SIGN ON. XXXXXXXX @ PASSWORD = @ =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-= PLEASE ENTER YOUR ID:-1-> PLEASE ENTER YOUR PASSWORD:-2-> CITICORP (CITY NAME). KEY GHELP FOR HELP. XXX.XXX PLEASE SELECT SERVICE REQUIRED.-3-> Lantronix Terminal Server ~~~~~~~~~~~~~~~~~~~~~~~~~ Lantronix ETS16 Version V3.1/1(940623) Type HELP at the 'Local_15> ' prompt for assistance. Login password> Meridian Mail (Northern Telecom Phone/Voice Mail System) ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ MMM MMMERIDIAN MMMMM MMMMM MMMMMM MMMMMM MMM MMMMM MMM MMMMM MMMMM MMM MMM MMM MMMMMM MMMMMM MMM MMM MMM MMM MMM MMM MMM MMM MMM MMMMM MMM MMM MMM MMM MMM MMM MMM MMM MMM MMM MMM MMM MMM MMM MMM MMM MMM MMM MMM MMM MMM MMM MMM MMM MMM MMM Copyright (c) Northern Telecom, 1991 Novell ONLAN ~~~~~~~~~~~~ <Control-A aka smiley face>N [To access the systems it is best to own a copy of ONLAN/PC] PC-Anywhere ~~~~~~~~~~~ <Control-A aka smiley face>P [To access the systems it is best to own a copy of PCAnywhere Remote] PRIMOS ~~~~~~ PRIMENET 19.2.7F PPOA1 <any text> ER! =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-= CONNECT Primenet V 2.3 (system) LOGIN (you) User id? (system) SAPB5 (you) Password? (system) DROWSAP (you) OK, (system) ROLM CBX II ~~~~~~~~~~~ ROLM CBXII RELEASE 9004.2.34 RB295 9000D IBMHO27568 BIND DATE: 7/APR/93 COPYRIGHT 1980, 1993 ROLM COMPANY. ALL RIGHTS RESERVED. ROLM IS A REGISTERED TRADEMARK AND CBX IS A TRADEMARK OF ROLM COMPANY. YOU HAVE ENTERED CPU 1 12:38:47 ON WEDNESDAY 2/15/1995 USERNAME: op PASSWORD: INVALID USERNAME-PASSWORD PAIR ROLM-OSL ~~~~~~~~ MARAUDER10292 01/09/85(^G) 1 03/10/87 00:29:47 RELEASE 8003 OSL, PLEASE. ? System75 ~~~~~~~~ Login: root INCORRECT LOGIN Login: browse Password: Software Version: G3s.b16.2.2 Terminal Type (513, 4410, 4425): [513] Tops-10 ~~~~~~~ NIH Timesharing NIH Tri-SMP 7.02-FF 16:30:04 TTY11 system 1378/1381/1453 Connected to Node Happy(40) Line # 12 Please LOGIN . VM/370 ~~~~~~ VM/370 ! VM/ESA ~~~~~~ VM/ESA ONLINE TBVM2 VM/ESA Rel 1.1 PUT 9200 Fill in your USERID and PASSWORD and press ENTER (Your password will not appear when you type it) USERID ===> PASSWORD ===> COMMAND ===> Xylogics Annex Communications Server ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Annex Command Line Interpreter * Copyright 1991 Xylogics, Inc. Checking authorization, Please wait... - Annex username: TNO - Optional security check Annex password: - Not always present Permission granted annex: 23. What are the default accounts for XXX? AIX ~~~ guest guest AS/400 ~~~~~~ qsecofr qsecofr /* master security officer */ qsysopr qsysopr /* system operator */ qpgmr qpgmr /* default programmer */ also ibm password ibm 2222 ibm service qsecofr 1111111 qsecofr 2222222 qserv qserv qsvr qsvr secofr secofr qsrv ibmce1 DECserver ~~~~~~~~~ ACCESS SYSTEM Dynix (The library software, not the UnixOS) ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ (Type 'later' to exit to the login prompt) setup <no password> library <no password> circ <Social Security Number> Hewlett Packard MPE-XL ~~~~~~~~~~~~~~~~~~~~~~ HELLO MANAGER.SYS HELLO MGR.SYS HELLO FIELD.SUPPORT HPUNSUP or SUPPORT or HP HELLO OP.OPERATOR MGR CAROLIAN MGR CCC MGR CNAS MGR CONV MGR COGNOS OPERATOR COGNOS MANAGER COGNOS OPERATOR DISC MGR HPDESK MGR HPWORD FIELD HPWORD MGR HPOFFICE SPOOLMAN HPOFFICE ADVMAIL HPOFFICE MAIL HPOFFICE WP HPOFFICE MANAGER HPOFFICE MGR HPONLY FIELD HPP187 MGR HPP187 MGR HPP189 MGR HPP196 MGR INTX3 MGR ITF3000 MANAGER ITF3000 MAIL MAIL MGR NETBASE MGR REGO MGR RJE MGR ROBELLE MANAGER SECURITY MGR SECURITY FIELD SERVICE MANAGER SYS MGR SYS PCUSER SYS RSBCMON SYS OPERATOR SYS OPERATOR SYSTEM FIELD SUPPORT OPERATOR SUPPORT MANAGER TCH MAIL TELESUP MANAGER TELESUP MGR TELESUP SYS TELESUP MGE VESOFT MGE VESOFT MGR WORD MGR XLSERVER Common jobs are Pub, Sys, Data Common passwords are HPOnly, TeleSup, HP, MPE, Manager, MGR, Remote Major BBS ~~~~~~~~~ Sysop Sysop Mitel PBX ~~~~~~~~~ SYSTEM NeXTSTEP ~~~~~~~~ root NeXT signa signa me <null> (Rumored to be correct, not checked) Nomadic Computing Environment (NCE) on the Tadpole Technologies SPARCBook3 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ fax <no password> PICK O/S ~~~~~~~~ DSA # Desquetop System Administrator DS DESQUETOP PHANTOM Prolog ~~~~~~ PBX PBX NETWORK NETWORK NETOP <null> Radio Shack Screen Savers ~~~~~~~~~~~~~~~~~~~~~~~~~ RS<STORE_ID_NUMBER> Rolm ~~~~ CBX Defaults op op op operator su super admin pwp eng engineer PhoneMail Defaults sysadmin sysadmin tech tech poll tech RSX ~~~ SYSTEM/SYSTEM (Username SYSTEM, Password SYSTEM) 1,1/system (Directory [1,1] Password SYSTEM) BATCH/BATCH SYSTEM/MANAGER USER/USER Default accounts for Micro/RSX: MICRO/RSX Alternately you can hit <CTRL-Z> when the boot sequence asks you for the date and create an account using: RUN ACNT or RUN $ACNT (Numbers below 10 {oct} are privileged) Reboot and wait for the date/time question. Type ^C and at the MCR prompt, type "abo at." You must include the . dot! If this works, type "acs lb0:/blks=1000" to get some swap space so the new step won't wedge. type " run $acnt" and change the password of any account with a group number of 7 or less. You may find that the ^C does not work. Try ^Z and ESC as well. Also try all 3 as terminators to valid and invalid times. If none of the above work, use the halt switch to halt the system, just after a invalid date-time. Look for a user mode PSW 1[4-7]xxxx. then deposit 177777 into R6, cross your fingers, write protect the drive and continue the system. This will hopefully result in indirect blowing up... And hopefully the system has not been fully secured. SGI Irix ~~~~~~~~ 4DGifts <no password> guest <no password> demos <no password> lp <no password> nuucp <no password> tour <no password> tutor <no password> System 75 ~~~~~~~~~ bcim bcimpw bciim bciimpw bcms bcmspw, bcms bcnas bcnspw blue bluepw browse looker, browsepw craft crftpw, craftpw, crack cust custpw enquiry enquirypw field support inads indspw, inadspw, inads init initpw kraft kraftpw locate locatepw maint maintpw, rwmaint nms nmspw rcust rcustpw support supportpw tech field Taco Bell ~~~~~~~~~ rgm rollout tacobell <null> Verifone Junior 2.05 ~~~~~~~~~~~~~~~~~~~~ Default password: 166816 VMS ~~~ field service systest utep XON / XON Junior ~~~~~~~~~~~~~~~~ Default password: 166831 24. What port is XXX on? The file /etc/services on most Unix machines lists the port assignments for that machine. For a complete list of port assignments, read RFC (Request For Comments) 1700 "Assigned Numbers" 25. What is a trojan/worm/virus/logic bomb? This FAQ answer was written by Theora: Trojan: Remember the Trojan Horse? Bad guys hid inside it until they could get into the city to do their evil deed. A trojan computer program is similar. It is a program which does an unauthorized function, hidden inside an authorized program. It does something other than what it claims to do, usually something malicious (although not necessarily!), and it is intended by the author to do whatever it does. If it's not intentional, its called a 'bug' or, in some cases, a feature :) Some virus scanning programs detect some trojans. Some virus scanning programs don't detect any trojans. No virus scanners detect all trojans. Virus: A virus is an independent program which reproduces itself. It may attach to other programs, it may create copies of itself (as in companion viruses). It may damage or corrupt data, change data, or degrade the performance of your system by utilizing resources such as memory or disk space. Some virus scanners detect some viruses. No virus scanners detect all viruses. No virus scanner can protect against "any and all viruses, known and unknown, now and forevermore". Worm: Made famous by Robert Morris, Jr. , worms are programs which reproduce by copying themselves over and over, system to system, using up resources and sometimes slowing down the systems. They are self contained and use the networks to spread, in much the same way viruses use files to spread. Some people say the solution to viruses and worms is to just not have any files or networks. They are probably correct. We would include computers. Logic Bomb: Code which will trigger a particular form of 'attack' when a designated condition is met. For instance, a logic bomb could delete all files on Dec. 5th. Unlike a virus, a logic bomb does not make copies of itself. 26. How can I protect myself from viruses and such? This FAQ answer was written by Theora: The most common viruses are boot sector infectors. You can help protect yourself against those by write protecting all disks which you do not need write access to. Definitely keep a set of write protected floppy system disks. If you get a virus, it will make things much simpler. And, they are good for coasters. Only kidding. Scan all incoming files with a recent copy of a good virus scanner. Among the best are F-Prot, Dr. Solomon's Anti-virus Toolkit, and Thunderbyte Anti-Virus. AVP is also a good program. Using more than one scanner could be helpful. You may get those one or two viruses that the other guy happened to miss this month. New viruses come out at the rate of about 8 per day now. NO scanner can keep up with them all, but the four mentioned here do the best job of keeping current. Any _good_ scanner will detect the majority of common viruses. No virus scanner will detect all viruses. Right now there are about 5600 known viruses. New ones are written all the time. If you use a scanner for virus detection, you need to make sure you get frequent updates. If you rely on behavior blockers, you should know that such programs can be bypassed easily by a technique known as tunnelling. You may want to use integrity checkers as well as scanners. Keep in mind that while these can supply added protection, they are not foolproof. You may want to use a particular kind of scanner, called resident scanners. Those are programs which stay resident in the computer memory and constantly monitor program execution (and sometimes even access to the files containing programs). If you try to execute a program, the resident scanner receives control and scans it first for known viruses. Only if no such viruses are found, the program is allowed to execute. Most virus scanners will not protect you against many kinds of trojans, any sort of logic bombs, or worms. Theoretically, they _could_ protect you against logic bombs and/or worms, by addition of scanning strings; however, this is rarely done. The best, actually only way, to protect yourself is to know what you have on your system and make sure what you have there is authorized by you. Make frequent backups of all important files. Keep your DOS system files write protected. Write protect all disks that you do not need to write to. If you do get a virus, don't panic. Call the support department of the company who supplies your anti-virus product if you aren't sure of what you are doing. If the company you got your anti-virus software from does not have a good technical support department, change companies. The best way to make sure viruses are not spread is not to spread them. Some people do this intentionally. We discourage this. Viruses aren't cool. 27. Where can I get more information about viruses? This FAQ answer was written by Theora: Assembly language programming books illustrate the (boring) aspect of replication and have for a long time. The most exciting/interesting thing about viruses is all the controversy around them. Free speech, legality, and cute payloads are a lot more interesting than "find first, find next" calls. You can get information about the technical aspects of viruses, as well as help if you should happen to get a virus, from the virus-l FAQ, posted on comp. virus every so often. You can also pick up on the various debates there. There are alt.virus type newsgroups, but the level of technical expertise is minimal, and so far at least there has not been a lot of real "help" for people who want to get -rid- of a virus. There are a lot of virus experts. To become one, just call yourself one. Only Kidding. Understanding viruses involves understanding programming, operating systems, and their interaction. Understanding all of the 'Cult of Virus' business requires a lot of discernment. There are a number of good papers available on viruses, and the Cult of Virus; you can get information on them from just about anyone listed in the virus-l FAQ. The FTP site ftp.informatik.uni-hamburg.de is a pretty reliable site for programs and text. 28. What is Cryptoxxxxxxx? This FAQ answer is excerpted from: Computer Security Basics by Deborah Russell and G.T. Gengemi Sr. A message is called either plaintext or cleartext. The process of disguising a message in such a way as to hide its substance is called encryption. An encrypted message is called ciphertext. The process of turning ciphertext back into plaintext is called decryption. The art and science of keeping messages secure is called cryptography, and it is practiced by cryptographers. Cryptanalysts are practitioners of cryptanalysis, the art and science of breaking ciphertext, i.e. seeing through the disguise. The branch of mathematics embodying both cryptography and cryptanalysis is called cryptology, and it's practitioners are called cryptologists. 29. What is PGP? This FAQ answer is excerpted from: PGP(tm) User's Guide Volume I: Essential Topics by Philip Zimmermann PGP(tm) uses public-key encryption to protect E-mail and data files. Communicate securely with people you've never met, with no secure channels needed for prior exchange of keys. PGP is well featured and fast, with sophisticated key management, digital signatures, data compression, and good ergonomic design. Pretty Good(tm) Privacy (PGP), from Phil's Pretty Good Software, is a high security cryptographic software application for MS-DOS, Unix, VAX/VMS, and other computers. PGP allows people to exchange files or messages with privacy, authentication, and convenience. Privacy means that only those intended to receive a message can read it. Authentication means that messages that appear to be from a particular person can only have originated from that person. Convenience means that privacy and authentication are provided without the hassles of managing keys associated with conventional cryptographic software. No secure channels are needed to exchange keys between users, which makes PGP much easier to use. This is because PGP is based on a powerful new technology called "public key" cryptography. PGP combines the convenience of the Rivest-Shamir-Adleman (RSA) public key cryptosystem with the speed of conventional cryptography, message digests for digital signatures, data compression before encryption, good ergonomic design, and sophisticated key management. And PGP performs the public-key functions faster than most other software implementations. PGP is public key cryptography for the masses. 30. What is Tempest? Tempest stands for Transient Electromagnetic Pulse Surveillance Technology. Computers and other electronic equipment release interference to their surrounding environment. You may observe this by placing two video monitors close together. The pictures will behave erratically until you space them apart. What is important for a