Introduction

I have written this tutorial to address a question that is all too commonly asked in any channel/chat room with "hack" in the title (asked in frequency to the point of harrassment really). So since this is a question that so many people ask, then I believe that there should at least be an answer available (regardless of the morality or "lameness" of such a question). So you as the reader are most likely reading this because you want to break into somebody's email account. Well, you must understand that there is no 1-2-3 process to anything. I will give you options to consider when persuing such a task, but it will ultimately be up to you to do this. This is what you want to do, and no matter what sort of offers you throw up at anybody, nobody is going to do this for you. There is no program that is going to do all this for you. Also don't forget that nobody is going to hold your hand and lead you through this. I'm offering you as the reader suggestions for ways you can address this task, and that is about all the help you are going to get from anybody. So now that I've made all that clear, let's begin...

Things You Should Know

As I mentioned in the previous section, there is no program that will do all this for you. Almost all the crackers you see out there will not work, because services like Hotmail, Yahoo!, etc. have it set so that it will lock you from that account after a certain number of login attempts. There are some rare exceptions, like some crackers for Yahoo! that are made for cracking "illegal" accounts, but the thing you must understand about those types of crackers is that they are built to crack SPECIFICALLY "illegal" names. They can not be used to target a specific account on Yahoo!, so don't try to use them for this purpose. Another thing you must know if you ask this question in any "hacker" chat room/channel (which I highly discourage), or if you read something on this topic, and you hear that you have to email some address and in any way have to give up your password in the process, do NOT believe this. This is a con used to trick gullible people into handing over their passwords. So don't fall for this. Well that concludes this section, now lets get to what you want to know.

If You Have Physical Access

I will start off with options you have if you have physical access to the computer of the user that you are targeting, because it is a lot easier if you do. One option you have, that you will hear a lot if you ask this question, and anybody bothers to answer is to use a keylogger. A keylogger is an excellent option, and probably the easiest. There are a lot of keyloggers out there, ranging from hardware keyloggers, to software keyloggers. For this task, you won't need to buy a hardware keylogger, since the only advantage to a hardware one is that you can grab passwords that are given to access a certain local user on the operating system used. There are a lot of software keyloggers out there, and you can feel free to check out www.google.com to look at your options. I will go ahead and toss a couple of keyloggers out to try for those of you who seem allergic to search engines. One option you have that is good for a free keylogger is Perfect Keylogger (which you can find at www.blazingtools.com/bpk.html). It works just fine, and has some nice options to keep it hidden from your average end user (computer user). Another option you have, which is probably the best one you can get is Ghost Keylogger. It has a lot of options that will allow you to get the results of this program remotely (it will email you the results). However, this is not a free keylogger, so if you are wanting to get a copy you can look on the file sharing networks for a copy of the program, and the serial number for it (look on www.zeropaid.com for different file sharing clients you can try). Once you have whatever keylogger you are going to use downloaded, just install it onto the computer you are wanting to monitor, and wait till next time they login to their email account. You will then have the password for the account. Another option you have if they use Outlook to access their email account, is to copy the *.dbx files for their Outlook account onto a floppy, and extract the emails at home (the dbx file stores the files stored in each Outlook folder on a given account, meaning the received and sent emails). When you are on the computer of the user you are targeting, look in C:\Windows\ApplicationData\Identities\{ACblahblahblah}\Microsoft\ OutlookExpress\ and copy all the .dbx files onto a floppy. Then when you take the .dbx files back to your house, use DBXtract to extract the messages from these files. Check out the link below to download this program....

www.download-freeware-shareware.com/Freeware-Internet.php? Type=4171

Another option you have if you have physical access is to execute a RAT (Remote Administration Tool, you may know these programs as trojans) server on the computer. Of course, you do not have to have physical access to go this route, but it helps. What you must understand is that these tools are known threats, and the popular ones are quickly detected by antivirus software, and thusly taken care of. Even ISPs block incoming/outgoing traffic from the most popular ports used by these programs.

One newcomer in the RAT market that you should know about is Project Leviathan. This program uses already existing services to host it's service, instead of opening up an entirely new port. This allows it to hide itself from any port detection tool/software firewall that may be in place. This of course will not guarantee that it's server program will not be detected by any antivirus software used (actually, if the user has kept up with his/her signature tables, then it WILL be detected), but it will give you more of a chance of holding access. Search the engines to download Project Leviathan...

Once you have downloaded this tool, follow the instructions listed to install and use this program. However, since this RAT is a command line tool, you will still need another program set up on the user's computer in order to catch the desired password. For this, you can use Password Logger.. Google it

Once you have this downloaded, set it up on the targeted computer. The program will remain hidden, while logging any types of passwords into a .lst file in the same directory that you executed it on. Therefore, you can access this *.lst file through Project Leviathan remotely in order to retrieve the user's email password remotely. Well that pretty much concludes it for this section. At this very moment I can practically hear a lot of you thinking to yourselves "But, but I don't HAVE physical access!". No reason to worry, that's what the next section is for...

If You Don't Have Physical Access

Well of course most of you out there will say that you don't have physical access to your target's computer. That's fine, there still are ways you can gain access into the desired email account without having to have any sort of physical access. For this we are going to go back onto the RAT topic, to explain methods that can be used to fool the user into running the server portion of the RAT (again, a RAT is a trojan) of your choice. Well first we will discuss the basic "send file" technique. This is simply convincing the user of the account you want to access to execute the server portion of your RAT. To make this convincing, what you will want to do is bind the server.exe to another *.exe file in order to not raise any doubt when the program appears to do nothing when it is executed. For this you can use the tool like any exe file to bind it into another program (make it something like a small game)...

On a side note, make sure the RAT of your choice is a good choice. The program mentioned in the previous section would not be good in this case, since you do need physical access in order to set it up. You will have to find the program of your choice yourself (meaning please don't ask around for any, people consider that annoying behavior). If you don't like any of those, I'm afraid you are going to have to go to www.google.com, and look for some yourself. Search for something like "optix pro download", or any specific trojan. If you look long enough, among all the virus notification/help pages, you should come across a site with a list of RATs for you to use (you are going to eventually have to learn how to navigate a search engine, you can't depend on handouts forever). Now back to the topic at hand, you will want to send this file to the specified user through an instant messaging service. The reason why is that you need the ip address of the user in order to connect with the newly established server. Yahoo! Messenger, AOL Instant Messenger, it really doesn't matter. What you will do is send the file to the user. Now while this transfer is going on you will go to Start, then Run, type in "command", and press Enter. Once the msdos prompt is open, type in "netstat -n", and again, press enter. You will see a list of ip addresses from left to right. The address you will be looking for will be on the right, and the port it's established on will depend on the instant messaging service you are using. With MSN Messenger it will be remote port 6891, with AOL Instant Messenger it will be remote port 2153, with ICQ it will be remote port 1102, 2431, 2439, 2440, or 2476, and with Yahoo! Messenger it will be remote port 1614. So once you spot the established connection with the file transfer remote port,

then you will take note of the ip address associated with that port. So once the transfer is complete, and the user has executed the server portion of the RAT, then you can use the client portion to sniff out his/her password the next time he/she logs on to his/her account. Don't think you can get him/her to accept a file from you? Can you at least get him/her to access a certain web page? Then maybe this next technique is something you should look into. Currently Internet Explorer is quite vulnerable to an exploit that allows you to drop and execute .exe files via malicious scripting within an html document. For this what you will want to do is set up a web page, make sure to actually put something within this page so that the visitor doesn't get too entirely suspicious, and then imbed the below script into your web page so that the server portion of the RAT of your choice is dropped and executed onto the victim's computer...

While you are at it, you will also want to set up an ip logger on the web page so that you can grab the ip address of the user so that you can connect to the newly established server. Here is the source for a php ip logger you can use on your page... http://www.planet-source-code.com/vb/scripts/ShowCode.asp? txtCodeId=539&lngWId=8 Just insert this source into your page along with the exedrop script, and you are set. Just convince the user to go to this page, and wait till the next time they type in their email password. However, what do you do if you can not contact this user in any way to do any of the above tricks. Well, then you definately have your work cut out for you. It doesn't make the task impossible, but it makes it pretty damn close to it. For this we will want to try info cracking. Info cracking is the process of trying to gather enough information on the user to go through the "Forgot my Password" page, to gain access into the email account. If you happen to know the user personally, then it helps out a lot. You would then be able to get through the birthday/ zipcode questions with ease, and with a little mental backtracking, or social engineering (talking) out the information from the user be able to get past the secret question. However, what do you do if you do not have this luxury? Well in this case you will have to do a little detective work to fish out the information you need.

First off, if a profile is available for the user, look at the profile to see if you can get any information from the profile. Many times users will put information into their profile, that may help you with cracking the account through the "Forgot my Password" page (where they live, their age, their birthday if you are lucky). If no information is provided then what you will want to do is get on an account that the user does not know about, and try to strike conversation with the user. Just talk to him/her for a little while, and inconspicuously get this information out of the user (inconspicuously as in don't act like you are trying to put together a census, just make casual talk with the user and every once in a while ask questions like "When is your birthday?" and "Where do you live?", and then respond with simple, casual answers). Once you have enough information to get past the first page, fill those parts out, and go to the next page to find out what the secret question is. Once you have the secret question, you will want to keep making casual conversation with the user and SLOWLY build up to asking a question that would help you answer the secret question. Don't try to get all the information you need in one night or you will look suspicious. Patience is a virtue when info cracking. Just slowly build up to this question. For example, if the secret question is something like "What is my dog's name?", then you would keep talking with the user, and eventually ask him/her "So how many dogs do you have? ...Oh, that's nice. What are their names?". The user will most likely not even remember anything about his/her secret question, so will most likely not find such a question suspicious at all (as long as you keep it inconspicuous). So there you go, with a few choice words and a little given time, you have just gotten the user to tell you everything you need to know to break into his/her email account. The problem with this method is that once you go through the "Forgot my Password" page, the password will be changed, and the new password will be given to you. This will of course deny the original user access to his/her own account. But the point of this task is to get YOU access, so it really shouldn't matter. Anyways, that concludes it for this tutorial. Good luck...

>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>.[]

Almost every one of us has heard a friend complaining that his email account has been hacked. Or it may have happened to you. The truth is that hacking

yahoo messenger accounts or any other kind of email provider account has become quite a problem for users. MSN password hacking or hacking yahoo accounts is no longer the realm of experts. Thanks to the widespread use of the internet, any hacker can learn the required tricks to master the art of hacking yahoo ids or hotmail email password hacking. He only needs to make a basic search with keywords like hacking yahoo passwords, msn messenger hacking tools, msn hacking programs, hacking yahoo mail, hotmail hacking programs, hacking yahoo email or even something as simple as hotmail hacking guide. All of that is out there, ready to be learnt.

Can Emails Be Hacked?

Yes. As a matter of fact, almost anything can be hacked in the Internet. The problem is that email accounts are the repositories were people store their private information or even their business data. It is a quite serious condition and most of the mail providers have taken some measures for stopping it. Unfortunately, users don't take them seriously and they don't follow the precautions. There are several methods for hacking yahoo, msn or AOL email accounts. One of these methods is social engineering. Considered a revolutionary art among the hacker community, it has proven to be an interesting tool that can be exploited by anyone. Social engineering consists in the ability to trick someone in believing that he is giving information to someone who has the authority to ask for it. The most common way to do it is through the telephone or via the internet. Let's say that a user receives a call from someone who identifies himself as a system administrator of his company and that he requires some information that could be considered harmless. It's quite probable that that bit of information is the final piece that the hacker required for finishing his work. Something as innocent as when was the last time that the system asked the user to change his password could be used by him in his advantage. A quite ingenious method within social engineering was a webpage were users required to enter their mail and password for finding if someone had deleted or blocked them from their Instant Messenger (IM). Unfortunately, many fell under this scheme. Hacking yahoo messenger or any other messenger is quite easy if you find how to exploit the user's needs.

Alternatives used
Besides social engineering, hackers can obtain your password through other means, like worms, viruses or Trojans. Once a hacker is inside your computer, he will look for those files were your login names and passwords are stored. That's they reason why it isn't considered safe to store them inside your computer. Even when the provider tells you that it is safe. Remember than there isn't a more secure place for keeping your password than your mind.

Methods Used In The Past !

In the past, one of the common practices used by hacker was using programs that tried different password combinations until it found the correct one. This method was contra rested by email providers by giving a limited number of options or by placing some security measures inside their webpage. Other method was placing false web pages instead of the original ones. A hacker could make a user think that he is accessing his email at the webpage of his email provider. In reality, he was entering all his information to a webpage created by the hacker. This scheme isn't used any more since users have become a bit more careful and have acquired some concepts on internet security. They have started using secure pages for login which starts

What Are Keyloggers?

Keyloggers are specially devised programs that are installed inside a computer via a Trojan, a virus or a worm. Once inside, the keylogger will auto execute and start recording all the key strokes made by the computer user. Once a determined period of time has gone by, the keylogger will send the keystroke information to the hacker who sent this infectious software. Then the hacker will start searching key combinations that can lead him to determine the password for determined web pages. This simple and effective method is a favorite among hackers since it can provide them with lots of private information from their victims. Many computer users have more than one email account, especially if they use the messenger services from multiple providers, like Microsoft's Hotmail,

Yahoo's Email or AOL email. It doesn't matter if you have one or many email accounts, every one of them may be a victim of a hacker. Even with the security measures imposed by the companies, Yahoo password hacking or hotmail hacking still exist. And it's very improbable that will disappear. So, if you want to protect yourself from people who are hacking yahoo accounts or whose whole purpose in life is to do some MSN hacking, then increase the number of special characters in your password and try not to access your email account from a computer that is not yours. And that goes to IM's too. The ability for hacking yahoo messenger or any other IM provider it's a latent danger for all of us.

LOCALLY STORED PASSWORDS

Most browsers, including Internet Explorer and Netscape, the AOL client, and Windows Dial-Up Connections allow you the option to store passwords. These passwords are stored on the local machine and (depending upon where and how it is stored) there is usually a method of recovering these passwords. Storing any password locally is insecure and may allow the password to be recovered by anyone who has access to the local machine. While we are not currently aware of any program to recover locally stored AOL passwords, we do not recommend that these are secure. Software does exist that can recover most of the other types of locally stored passwords.

TROJAN
A Trojan is a program that is sent to a user that allows an attacker to control functions of the target computer, recover information from the target or to delete or damage files on the target. The name Trojan is given because the program will usually come attached to some other program or file that entices you to run it. There are a wide variety of Trojans any number of which can be programmed to capture passwords as they are typed and to email or transmit them to a third party. To protect yourself against Trojans, you should never execute or download software or files that are not from a trusted source. It is critical that anyone working on internet use a virus protection program (which should catch most Trojans.) Note that since a Trojan requires the password to be typed or stored in order to be recovered, this is not an effective way to recover your own password. It could explain, however, how someone could lose their password to a hacker. Sending someone a Trojan program is certainly illegal and we do not recommend or condone this activity. A Trojan is unlikely to be effective in recovering a particular account password since it requires the target to install it. However, hackers will often bulk mail Trojans to thousands of people in the hope that a small percentage will get caught. Legitimate account holders who may have been caught by a Trojan and can authenticate themselves should contact their service provider to have their account passwords res SNIFFING If two people do not share the same computer, but do share the same network, it may be possible for one to sniff the others' packets as they sign-on. The traffic between your computer and the internet site you are accessing may be able to be recorded and decrypted or "played-back." This is not a simple attack to execute, but is possible if two

people are close to one another and share a hub. Again, this is likely to be illegal and we do not condone this activity.

>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>:?>

IP HHHHAAAAAACCCCCCKKKKKKIIIIINNNNgGGGGGGGGGGGG

Learn what is IP and how to get the IP of a system Also visit contd Page

IP Hack contd..

In here I have figure out some very easy but cool ways to trace out the geographical location and various other infos like ISP details etc of a remote computer using its IP. Well I guess its one of the most important must learn manul for boys out there if you want to impress your friends particularly gals whom youll meet online in a chat room and tell them their geographical locations and ISP details and make them surprised and impressed . In the practical execution of this manual you dont have to work much as it is very simple only you have to use your brain to understand some symbols and some format of expressions and use your IQ to execute things the right way.

What is IP and how to get the IP of a remote system::

Getting the IP or Internet Protocol of a remote system is the most important and the first step of hacking into it. Probably it is the first thing a hacker do to get info for researching on a system. Well IP is a unique number assigned to each computer on a network. It is this unique address which represents the system on the network. Generally the IP of a particular system changes each time you log on to the network by dialing to your ISP and it is assigned to you by your ISP. IP of a system which is always on the network remains generally the same. Generally those kind of systems are most likely to suffer a hacking attack because of its stable IP. Using IP you can even execute system

commands on the victims computer. Lets take the example of the following IP address: 202.144.49.110 Now the first part, the numbers before the first decimal i.e. 209 is the Network number or the Network Prefix.. This means that it identifies the number of the network in which the host is. The second part i.e. 144 is the Host Number that is it identifies the number of the host within the Network. This means that in the same Network, the network number is same. In order to provide flexibility in the size of the Network, here are different classes of IP addresses:

Address Class Dotted Decimal Notation Ranges Class A ( /8 Prefixes) 1.xxx.xxx.xxx through 126.xxx.xxx.xxx Class B ( /16 Prefixes) 128.0.xxx.xxx through 191.255.xxx.xxx Class C ( /24 Prefixes) 192.0.0.xxx through 223.255.255.xxx

The various classes will be clearer after reading the next few lines.

Each Class A Network Address contains a 8 bit Network Prefix followed by a 24-bit host number. They are considered to be primitive. They are referred to as "/8''s" or just "8's" as they have an 8-bit Network prefix. In a Class B Network Address there is a 16 bit Network Prefix followed by a 16bit Host number. It is referred to as "16's".

A class C Network address contains a 24-bit Network Prefix and a 8 bit Host number. It is referred to as "24's" and is commonly used by most ISP's.

Due to the growing size of the Internet the Network Administrators faced many problems. The Internet routing tables were beginning to grow and now the administrators had to request another network number from the Internet before a new network could be installed at their site. This is where sub-netting came in.

Now if your ISP is a big one and if it provides you with dynamic IP addresses then you will most probably see that whenever you log on to the net, your IP address will have the same first 24 bits and only the last 8 bits will keep changing. This is due to the fact that when sub-netting comes in then the IP Addresses structure becomes:

xxx.xxx.zzz.yyy

where the first 2 parts are Network Prefix numbers and the zzz is the Subnet number and the yyy is the host number. So you are always connected to the same Subnet within the same Network. As a result the first 3 parts will remain the same and only the last part i.e. yyy is variable. ***********************

For Example, if say an ISP xyz is given the IP: 203.98.12.xx Network address then you can be awarded any IP, whose first three fields are 203.98.12. Get it?

So, basically this means that each ISP has a particular range in which to allocate all its subscribers. Or in other words, all subscribers or all people connected to the internet using the same ISP, will have to be in this range. This in effect would mean that all people using the same ISP are likely to have the same first three fields of their IP Addresses.

This means that if you have done a lot of (By this I really mean a lot) of research, then you could figure out which ISP a person is using by simply looking at his IP. The ISP name could then be used to figure out the city and the country of the person. Right? Let me take an example to stress as to how cumbersome but easy (once the research is done) the above method can be.

In my country, say there are three main ISPs:

ISP Name Network Address Allotted

ISP I 203.94.47.xx ISP II 202.92.12.xx ISP III 203.91.35.xx

Now, if I get to know the IP of an e-pal of mine, and it reads: 203.91.35.12, then I can pretty easily figure out that he uses ISP III to connect to the internet. Right? You might say that any idiot would be able to do this. Well, yes and no. You see, the above method of finding out the ISP of a person was successful only because we already had the ISP and Network Address Allotted list with us. So, what my point is, that the above method can be successful only after a lot of research and experimentation. And, I do think such research can be helpful sometimes.

Also, this would not work, if you take it all on in larger scale. What if the IP that you have belongs to someone living in a remote igloo in the North Pole? You could not possibly get the Network Addresses of all the ISPs in the world, could you? If yes please send it to me J.

Well now I guess you have pretty good knowledge about what an IP is and what you can do by knowing the IP of a remote system. Now lets come to the point of finding out the IP of remote system. Well you can easily figure out the IP of a remote system using the netstat utility available in the microsofts version of DOS. The netstat command shows the connections in which your system is engaged to and the ports they are using. Suppose you are checking your mail in hotmail and you want to find out the IP of msn. All you need to do is to open a dos window (command.com) and type netstat. You will see all the open connections of your system. There you will see something :

Proto Local Address Foreign Address State TCP abhisek:1031 64.4.xx.xx:80 ESTABLISHED

Now you got the IP address of hotmail ass 64.4.xx.xx . Similarly you can figure out the IP address of most http or ftp connections.

To know your own IP type the following command in a dos windows C:\netstat n [this commands converts the IP name into IP addresses] this is what you will probably see on typing the above command :

Proto Local Address Foreign Address State TCP 203.xx.251.161:1031 194.1.129.227:21 ESTABLISHED TCP 203.xx.251.161:1043 207.138.41.181:80 FIN_WAIT_2 TCP 203.xx.251.161:1053 203.94.243.71:110 TIME_WAIT TCP 203.xx.251.161:1058 194.1.129.227:20 TIME_WAIT TCP 203.xx.251.161:1069 203.94.243.71:110 TIME_WAIT TCP 203.xx.251.161:1071 194.98.93.244:80 ESTABLISHED TCP 203.xx.251.161:1078 203.94.243.71:110 TIME_WAIT

Here 203.xx.251.161 is your IP address.

Now lets clarify the format used by netstat :

Proto : It shows the type of protocol the connection with the remote system is using. Here TCP (transmission control protocol) is the protocol used by my system to

connect to other systems.

Local Address : It shows the local address ie the local IP. When the netstat command is executed without n switch then the name of the local system is displayed and when the netstat is executed with n switch then the IP of the local system is displayed. Here you can also find out the port used by the connection. xxx.yyy.zzz.aaa:1024 in this format you will see the local address. Here 1024 is the port to which the remote system is connected in your system

Foreign Address :: It shows the IP address of the remote system to which your system is connected. In this case also if the netstat command is excuted with n switch then you directly get the IP of the victim but if the netstat is executed without n switch then you will get the address of the remote system. Something like

C:\netstat Proto Local Address Foreign Address State TCP abhisek:1031 msgr.lw4.gs681.hotmail.com:80 ESTABLISHED

Here msgr.lw4.gs681.hotmail.com is the address of the foreign system . putting this address in any IP lookup program and doing a whois lookup will reveal the IP of the remote system.

Note: The port to which your system is connected can be found from this in the same way as I have shown in the case of local address. The difference is that, this is the port of the remote system to which your computer is connected to. Below I have produced a list of ports and popular services generally found to be running. 21 :: FTP port

80 :: http port 23 :: Telnet port

Note: If your execute the netstat command and find ports like 12345,27374 are open and are in use then make it sure that your sweat heart computer is infected with her boyfriend.. J J J J I mean your computer is infected with some sort of Trojan. Below I have produced a list of commonly known Trojans and the ports they use by default. So if you find these ports open then get a good virus buster and get these stupid servers of the Trojans kicked out. Well if you want to play with these Trojan by keeping them in your computer but not letting them ruin your system performance then just disble it from the system registry run and they wont be loaded to memory each time when windows starts up[This trick doesnt work for all Trojans].

Netbus :: 12345(TCP) Subseven :: 27374(TCP) Girl Friend :: 21554(TCP) Back Oriface :: 31337 (UDP)

Well guys and gals I hope you are now well familiar with the term IP and what is the utility of IP in cyber world and how to get the IP of a remote system to which you are connected. I hope you find my writings very easy to undertstand. I know I lack the capacity of explaining myself but I try my level best to make things very easy and clear for youll.

How to get the IP of a remote system while chatting through msn messenger ::

This is a tutorial on how to get IP address from MSN messenger. This is actually a really easy thing to do. It is not like going through the hard time and

reversing MSN messenger like many people think. The IP address is only given when you accept or are sending a file through MSN messenger. When you send IM's, the message is sent through the server thus hiding your victims IP and your. But when you send a file or recieve a file, it is direct connection between the two computers. To obtain the IP accept a file transfer or send a file to the victim, when the file sending is under way from the dos prompt type "netstat" without the quotation marks. You should get a table like this: Proto Local Address Foreign Address State TCP kick:1033 msgr-ns29.msgr.hotmail.com:1863 ESTABLISHED TCP kick:1040 msgr-sb36.msgr.hotmail.com:1863 ESTABLISHED TCP kick: <REMOTE HOST> ESTABLISHED The top name in the list is the server's address for IMing. There could be many of the second name in the list, as a new connection is made to the server for every room you are IMing to. You are looking for the address of the remote host in this table it may be something similar to "host63-7-102-226.ppp.cal.vsnl.com" or 203..64.90.6. without the quotation marks. All you need to do now is to put this address in you IP lookup programe and get the IP of the remote system. Well 50%of the work is done now. Now you know how to get the IP of a remote system, so its time to trace it down and find some details about the IP.

Tracing an IP is quite simple. You can do it the easy way by using some sweet softwares like Visual Trace 6.0b [ftp://ftp.visualware.com/pub/vr/vr.exe] Neotrace [http://www.neoworx.com/download/NTX325.exe] or by our way ie. Using MS DOS or any other version of DOS.

Well I suggest you to use DOS and its tracert tool for tracing the IP cause using it will give you a clear conception about the art of tracing an IP and I guarantee that you will feel much satisfied on success than using a silly software. Furthur you will know how things work and how the IP is traced down and the different networks associated in this tracing process.

Let us take a look at tracert tool provided for DOS by Microsoft. It is a very handy tool for peoples need to trace down an IP. Just open any DOS windows and type tracert.

C:\windows>tracert

Usage: tracert [-d] [-h maximum_hops] [-j host-list] [-w timeout] target_name Options: -d Do not resolve addresses to hostnames. -h maximum_hops Maximum number of hops to search for target. -j host-list Loose source route along host-list. -w timeout Wait timeout milliseconds for each reply. You will now see a description of the tracert command and the switches associated with it. Well these switches doesnt makes much difference. All you can do is to increase the timeout in milliseconds by using w switch if you are using a slow connection and the d switch if you wish not resolve address to hostnames by default. By default tracert performs a maximum of 30 hops trace. Using the h switch you can specify the number of hops to perform. Now its time for execution. Let us trace down the IP yahoo.com [216.115.108.243]

TIP: If you have done a long research (I mean a lot) then simply looking at the IP you can figure out some info from it. For example the IP 203.90.68.8 indicates that the system is in India. In India IPs generally begin with 203 and 202

C:\WINDOWS>tracert yahoo.com

Tracing route to yahoo.com [216.115.108.243] over a maximum of 30 hops:

1 308 ms 142 ms 127 ms 203.94.246.35 2 140 ms 135 ms * 203.94.246.1 3 213 ms 134 ms 132 ms 203.94.255.33 4 134 ms 130 ms 129 ms 203.200.64.29 5 122 ms 135 ms 131 ms 203.200.87.75 6 141 ms 137 ms 121 ms 203.200.87.15 7 143 ms 170 ms 154 ms vsb-delhi-stm1.Bbone.vsnl.net.in [202.54.2.241] 8 565 ms 589 ms 568 ms if-7-0.bb8.NewYork.Teleglobe.net [207.45.198.65] 9 596 ms 584 ms 600 ms if-3-0.core2.NewYork.teleglobe.net [207.45.221.66] 10 * * * Request timed out. 11 703 ms 701 ms 719 ms if-3-0.core2.PaloAlto.Teleglobe.net [64.86.83.205] 12 694 ms 683 ms 681 ms if-6-1.core1.PaloAlto.Teleglobe.net [207.45.202.33] 13 656 ms 677 ms 700 ms ix-5-0.core1.PaloAlto.Teleglobe.net [207.45.196.90] 14 667 ms 673 ms 673 ms ge-1-3-0.msr1.pao.yahoo.com [216.115.100.150] 15 653 ms 673 ms 673 ms vl20.bas1.snv.yahoo.com [216.115.100.225]

16 666 ms 676 ms 674 ms yahoo.com [216.115.108.243] Trace complete.

Note: Here I have traced yahoo.com. In place of yahoo.com you can give the IP of yahoo or any other IP you want to trace, the result will be the same.

Now carefully looking at the results you can figure out many information about yahoos server [216.115.108.243] First packets of data leave my ISP which is at 203.94.246.35 .Similarly you can find out the different routers through which the packets of data are send and received to and from the target system. Now take a look at the 13th line youll see that the router is in PaloAlto.Teleglobe.net from this you can easily figure out that the router is in Palo Alto. Now finally look at the target system ie. Yahoos server vl20.bas1.snv.yahoo.com . Now you got the address of yahoos server. Now put this address in any IP lookup programe and perform and reverse DNS lookup and you will get most of the info about this address,like the place where it is in. Well another thing you can find out using the tracert tool is that the number of hops (routers) the target system is away from you. In case of tracerouting yahoo.com we find that the target system ie yahoos server is 16 hops away from my system. This indicates that there are 16 routers between my system and yahoos server.

Apart from tracing an IP you can find out many usefull details about the target system using the tracert tool.

Firewall Detection

While tracerouting a target system, if you get * as an output then it indicates timeout error. Now if you peform another tracerout to the same taeget system at some other time with a good connection and in this way few times more and if you always get * as the output then take it for sure that the target system is running a firewall which prevents sending of data packets from the target system.

Example

Some days ago I tried to tracert hotmails server in plain and simple way using tracert without any trick.This is what I found out :

c:\windows>tracert 64.4.53.7

Tracing route to lc2.law5.hotmail.com [64.4.53.7] over a maximum of 30 hops:

1 * * * Request timed out. 2 161 ms 147 ms 85 ms 203.90.69.81 3 126 ms 261 ms 219 ms 203.90.66.9 4 121 ms 115 ms 228 ms delswp2.hclinfinet.com [203.90.66.133] 5 727 ms 725 ms 711 ms 203-195-147-250.now-india.net.in [203.195.147.250] 6 1006 ms 794 ms 952 ms core-fae-0-0.now-india.net.in [203.195.147.3] 7 826 ms 731 ms 819 ms 213.232.106.9 8 885 ms 744 ms 930 ms 213.166.3.209 9 851 ms 1020 ms 1080 ms 213.232.64.54 10 1448 ms 765 ms 1114 ms pos8-0.core2.London1.Level3.net [212.113.0.118] 11 748 ms 789 ms 750 ms ge-4-2-1.mp2.London1.Level3.net [212.187.131.146]

12 719 ms 733 ms 846 ms so-3-0-0.mp1.London2.Level3.net [212.187.128.46] 13 775 ms 890 ms 829 ms so-1-0-0.mp2.Weehawken1.Level3.net [212.187.128.138] 14 853 ms 852 ms 823 ms so-3-0-0.mp1.SanJose1.Level3.net [64.159.1.129] 15 889 ms 816 ms 803 ms so-7-0-0.gar1.SanJose1.Level3.net [64.159.1.74] 16 * * * Request timed out. 17 * * * Request timed out. 18 * * * Request timed out. 19 * * * Request timed out. 20 * * * Request timed out. 21 * * * Request timed out. 22 * * * Request timed out. 23 * * * Request timed out. 24 * * * Request timed out. 25 * * * Request timed out. 26 * * * Request timed out. 27 * * * Request timed out. 28 * * * Request timed out. 29 * * * Request timed out. 30 * * * Request timed out. Trace complete. I performed the same tracert many times a day but concluded with the same result. This indicates that the systems after the router SanJose1.Level3.net has firewalls installed which prevents the outgoing of data packets.

Detecting Traceroute Attempts on your System

You can detect that an attacker is performing a traceroute on your system, if you see the following symptoms:

1. If you observe port scans on very high UDP ports. This symptom means that the attacker has performed a traceroute on your system. However, it could also mean a simply port scan. Either way, it signifies the fact that your system is being scanned.

2. If the packet-monitoring tool installed in your network, picks up several outgoing TTL-exceeding messages, then it is yet another sign that someone is doing a traceroute on your system.

3. If in these log files, you also observer an outgoing ICMP port unreachable error message, then it means that since a traceroute was done on your system and as the target system i.e. your system, was reached, it responded with this error message.

You can also find our more information on the attacker (if he performs a traceroute on your system) by simply studying the sniffer log files. If you observer the TTL values, then we can easily figure out the following information on the attacker by making use of OS detection techniques discussed earlier in this white paper: The Operating System running on the attackers target system. Number of hops away, the attacker is from you.

OKI DOKI thats all for this article. Hope you will find this article very easy to understand and implement.

hanging your MAC on Windows XP

There are two ways two change your IP on Windows. The easy way, and the

hard way. Ill discuss how to do both of them in this tutorial. Easy Way: The first way to change it is, if your NIC (Network Interface Card) supports cloning your MAC Address. If this is the case then you go to. Start > Control Panel > Network Connections Right Click on your NIC card and goto properties. Then click the button labeled Configure. It should bring up another form. Click on the advanced tab. You should see under Property "Locally Administered Address" or "Network Address". Click the radio button next to the text box, and type in your new MAC address. (note you do not use the "-" when you enter your no MAC Address. To check and see if it worked or not go to Start > Run > and type in "cmd" When the terminal comes up issue the command. ipconfig /all ---------------------------------------------------------------------------------------------------------------------------------------------Hard Way: To change your MAC Address the hard way, you first go to Start > Run > and type in "cmd" Once the terminal comes up type in "net config rdr" It should bring up alot of things, but what you are worried about is NetBT_Tcpip_{ The Numbers Between here} Copy the numbers in between there and write it down somewhere, seeing that you will need them later. After you are done with that go to Start > Run > and type in "regedt32" That should bring up the windows registry. Once the registry is up go to

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class\ {4D36E972-E325-11CE-BFC1-08002BE10318} Click on the drop down menu and you should see the sub-categories 0000 0001 0002 and so on. Click on each one and compare the "NetCfgInstanceId" Key with the number you wrote down earlier. Once you find a match double click on the key "NetworkAddress" and change the value to your new MAC address. Hit ok and reboot your system.

There r several ways u can determine ur IP address information: IPCONFIG Start / Run / cmd IPCONFIG /ALL This opens a command window. One advantage is that u can send the information to a text file (IPCONFIG /ALL > c:\ip.txt) But sometimes the window shows show much information u need to scroll around to fine it. VIEW STATUS Control Panel / Network Connections / Double click the icons 4 ur network (If the network has an icon in the system tray u can also just double click on that icon)

Click on the Support tab Click on the Details button ::::::::::::: Make Pictures Smaller Unavailable When u try nd send pictures through e-mail, u should normally be given the option to make them smaller. If this option is not available, a DLL file may need to be registered. Start Run regsvr32 shimgvw.dll ::::::::::::: Creating a Suspend Shortcut If u would like to create an icon to suspend ur computer, Right click on the Desktop New / Shortcut Enter in rundll32.exe PowrProf.dll, SetSuspendState Give it whatever name u want Now when u click on that shortcut, ur computer will shutdown nd suspend Submitted by Gabe ::::::::::::: Changing the User Type Normally in XP Pro, through the Control Panel / User Accounts icon, u r only allowed to

create administrators or limited users. If u want to create Right click on My Computer Manage Local Users nd Groups Users Right click on the user u want to change Properties Member of tab Add button Advanced button Find Now button From here u see the full list of possibilities (e.g. Power User, Backup Operator etc.) ::::::::::::: some more Determining Which Services r Associated with SVCHOST Since so many critical services r run with each svchost, You can see which ones r being used by opening a cmd prompt nd running: tasklist /svc /fi "imagename eq svchost.exe" Note: This is available only with XP Pro ::::::::::::: Identify Faulty Device Drivers If u r having problems with lockups, blue screens, or can only get to safe mode,

often the problem is due to a faulty device driver. One way to help identify them is through the use of the Verfier program Start / Run / Verifier Keep the default of Create Standard Settings Select the type of drivers u want to confirm A list of drivers to be verified on the next boot will be shown. Reboot If ur computer stops with a blue screen, u should get an error message with the problem driver To turn off the Verifier, run verifier /reset ::::::::::::: Viewing Installed Drivers If u want to see a list of installed drivers, u can run the driverquery program There r a lot of available switches to view different types of information. On use can be to export to a CSV file 4 viewing in Excel An example would then be: Driverquery /v /fo csv > drivers.csv

>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>::::::::::::::::::::>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>