All About Computer Tips

Herewith a compendium of fact and folklore about computer hackerdom,

cunningly disguised as a test.



Scoring - Count 1 for each item that you have done, or each

question that you can answer correctly.



If you score is between: You are



0x000 and 0x010 -> Computer Illiterate

0x011 and 0x040 -> a User

0x041 and 0x080 -> an Operator

0x081 and 0x0C0 -> a Nerd

0x0C1 and 0x100 -> a Hacker

0x101 and 0x180 -> a Guru

0x181 and 0x200 -> a Wizard



Note: If you don't understand the scoring, stop here.




And now for the questions...



0001 Have you ever used a computer?

0002 ... for more than 4 hours continuously?

0003 ... more than 8 hours?

0004 ... more than 16 hours?

0005 ... more than 32 hours?



0006 Have you ever patched paper tape?



0007 Have you ever missed a class while programming?

0008 ... Missed an examination?

0009 ... Missed a wedding?

0010 ... Missed your own wedding?



0011 Have you ever programmed while intoxicated?

0012 ... Did it make sense the next day?



0013 Have you ever written a flight simulator?



0014 Have you ever voided the warranty on your equipment?



0015 Ever change the value of 4?

0016 ... Unintentionally?

0017 ... In a language other than Fortran?



0018 Do you use DWIM to make life interesting?



0019 Have you named a computer?



0020 Do you complain when a "feature" you use gets fixed?



0021 Do you eat slime-molds?



0022 Do you know how many days old you are?



0023 Have you ever wanted to download pizza?



0024 Have you ever invented a computer joke?

0025 ... Did someone not 'get' it?



0026 Can you recite Jabberwocky?

0027 ... Backwards?



0028 Have you seen "Donald Duck in Mathemagic Land"?



0029 Have you seen "Tron"?



0030 Have you seen "Wargames"?



0031 Do you know what ASCII stands for?

0032 ... EBCDIC?



0033 Can you read and write ASCII in hex or octal?

0034 Do you know the names of all the ASCII control codes?



0035 Can you read and write EBCDIC in hex?



0036 Can you convert from EBCDIC to ASCII and vice versa?



0037 Do you know what characters are the same in both ASCII and EBCDIC?



0038 Do you know maxint on your system?



0039 Ever define your own numerical type to get better precision?



0040 Can you name powers of two up to 2**16 in arbitrary order?

0041 ... up to 2**32?

0042 ... up to 2**64?



0043 Can you read a punched card, looking at the holes?

0044 ... feeling the holes?



0045 Have you ever patched binary code?

0046 ... While the program was running?



0047 Have you ever used program overlays?



0048 Have you met any IBM vice-president?

0049 Do you know Dennis, Bill, or Ken?



0050 Have you ever taken a picture of a CRT?

0051 Have you ever played a videotape on your CRT?



0052 Have you ever digitized a picture?



0053 Did you ever forget to mount a scratch monkey?



0054 Have you ever optimized an idle loop?



0055 Did you ever optimize a bubble sort?



0056 Does your terminal/computer talk to you?



0057 Have you ever talked into an acoustic modem?

0058 ... Did it answer?



0059 Can you whistle 300 baud?

0060 ... 1200 baud?



0061 Can you whistle a telephone number?



0062 Have you witnessed a disk crash?

0063 Have you made a disk drive "walk"?



0064 Can you build a puffer train?

0065 ... Do you know what it is?



0066 Can you play music on your line printer?

0067 ... Your disk drive?

0068 ... Your tape drive?



0069 Do you have a Snoopy calendar?

0070 ... Is it out-of-date?



0071 Do you have a line printer picture of...

0072 ... the Mona Lisa?

0073 ... the Enterprise?

0074 ... Einstein?

0075 ... Oliver?

0076 Have you ever made a line printer picture?



0077 Do you know what the following stand for?

0078 ... DASD

0079 ... Emacs

0080 ... ITS

0081 ... RSTS/E

0082 ... SNA

0083 ... Spool

0084 ... TCP/IP



Have you ever used

0085 ... TPU?

0086 ... TECO?

0087 ... Emacs?

0088 ... ed?

0089 ... vi?

0090 ... Xedit (in VM/CMS)?

0091 ... SOS?

0092 ... EDT?

0093 ... Wordstar?



0094 Have you ever written a CLIST?



Have you ever programmed in

0095 ... the X windowing system?

0096 ... CICS?



0097 Have you ever received a Fax or a photocopy of a floppy?



0098 Have you ever shown a novice the "any" key?

0099 ... Was it the power switch?



Have you ever attended

0100 ... Usenix?

0101 ... DECUS?

0102 ... SHARE?

0103 ... SIGGRAPH?

0104 ... NetCon?



0105 Have you ever participated in a standards group?



0106 Have you ever debugged machine code over the telephone?



0107 Have you ever seen voice mail?

0108 ... Can you read it?



0109 Do you solve word puzzles with an on-line dictionary?



0110 Have you ever taken a Turing test?

0111 ... Did you fail?



0112 Ever drop a card deck?

0113 ... Did you successfully put it back together?

0114 ... Without looking?



0115 Have you ever used IPCS?



0116 Have you ever received a case of beer with your computer?



0117 Does your computer come in 'designer' colors?



0118 Ever interrupted a UPS?



0119 Ever mask an NMI?



0120 Have you ever set off a Halon system?

0121 ... Intentionally?

0122 ... Do you still work there?



0123 Have you ever hit the emergency power switch?

0124 ... Intentionally?



0125 Do you have any defunct documentation?

0126 ... Do you still read it?



0127 Ever reverse-engineer or decompile a program?

0128 ... Did you find bugs in it?



0129 Ever help the person behind the counter with their terminal/computer?



0130 Ever tried rack mounting your telephone?



0131 Ever thrown a computer from more than two stories high?



0132 Ever patched a bug the vendor does not acknowledge?



0133 Ever fix a hardware problem in software?

0134 ... Vice versa?



0135 Ever belong to a user/support group?



0136 Ever been mentioned in Computer Recreations?



0137 Ever had your activities mentioned in the newspaper?

0138 ... Did you get away with it?



0139 Ever engage a drum brake while the drum was spinning?



0140 Ever write comments in a non-native language?



0141 Ever physically destroy equipment from software?



0142 Ever tried to improve your score on the Hacker Test?



0143 Do you take listings with you to lunch?

0144 ... To bed?



0145 Ever patch a microcode bug?

0146 ... around a microcode bug?



0147 Can you program a Turing machine?



0148 Can you convert postfix to prefix in your head?



0149 Can you convert hex to octal in your head?



0150 Do you know how to use a Kleene star?



0151 Have you ever starved while dining with philosophers?



0152 Have you solved the halting problem?

0153 ... Correctly?



0154 Ever deadlock trying eating spaghetti?



0155 Ever written a self-reproducing program?



0156 Ever swapped out the swapper?



0157 Can you read a state diagram?

0158 ... Do you need one?



0159 Ever create an unkillable program?

0160 ... Intentionally?



0161 Ever been asked for a cookie?



0162 Ever speed up a system by removing a jumper?



* Do you know...



0163 Do you know who wrote Rogue?

0164 ... Rogomatic?



0165 Do you know Gray code?



0166 Do you know what HCF means?

0167 ... Ever use it?

0168 ... Intentionally?



0169 Do you know what a lace card is?

0170 ... Ever make one?



0171 Do you know the end of the epoch?

0172 ... Have you celebrated the end of an epoch?

0173 ... Did you have to rewrite code?



0174 Do you know the difference between DTE and DCE?



0175 Do you know the RS-232C pinout?

0176 ... Can you wire a connector without looking?



* Do you have...



0177 Do you have a copy of Dec Wars?

0178 Do you have the Canonical Collection of Lightbulb Jokes?

0179 Do you have a copy of the Hacker's dictionary?

0180 ... Did you contribute to it?



0181 Do you have a flowchart template?

0182 ... Is it unused?



0183 Do you have your own fortune-cookie file?



0184 Do you have the Anarchist's Cookbook?

0185 ... Ever make anything from it?



0186 Do you own a modem?

0187 ... a terminal?

0188 ... a toy computer?

0189 ... a personal computer?

0190 ... a minicomputer?

0191 ... a mainframe?

0192 ... a supercomputer?

0193 ... a hypercube?

0194 ... a printer?

0195 ... a laser printer?

0196 ... a tape drive?

0197 ... an outmoded peripheral device?



0198 Do you have a programmable calculator?

0199 ... Is it RPN?



0200 Have you ever owned more than 1 computer?

0201 ... 4 computers?

0202 ... 16 computers?



0203 Do you have a SLIP line?

0204 ... a T1 line?



0205 Do you have a separate phone line for your terminal/computer?

0206 ... Is it legal?



0207 Do you have core memory?

0208 ... drum storage?

0209 ... bubble memory?



0210 Do you use more than 16 megabytes of disk space?

0211 ... 256 megabytes?

0212 ... 1 gigabyte?

0213 ... 16 gigabytes?

0214 ... 256 gigabytes?

0215 ... 1 terabyte?



0216 Do you have an optical disk/disk drive?



0217 Do you have a personal magnetic tape library?

0218 ... Is it unlabelled?



0219 Do you own more than 16 floppy disks?

0220 ... 64 floppy disks?

0221 ... 256 floppy disks?

0222 ... 1024 floppy disks?



0223 Do you have any 8-inch disks?



0224 Do you have an internal stack?



0225 Do you have a clock interrupt?



0226 Do you own volumes 1 to 3 of _The Art of Computer Programming_?

0227 ... Have you done all the exercises?

0228 ... Do you have a MIX simulator?

0229 ... Can you name the unwritten volumes?



0230 Can you quote from _The Mythical Man-month_?

0231 ... Did you participate in the OS/360 project?



0232 Do you have a TTL handbook?



0233 Do you have printouts more than three years old?



* Career



0234 Do you have a job?

0235 ... Have you ever had a job?

0236 ... Was it computer-related?



0237 Do you work irregular hours?



0238 Have you ever been a system administrator?



0239 Do you have more megabytes than megabucks?



0240 Have you ever downgraded your job to upgrade your processing power?



0241 Is your job secure?

0242 ... Do you have code to prove it?



0243 Have you ever had a security clearance?



* Games



0244 Have you ever played Pong?



Have you ever played

0246 ... Spacewar?

0247 ... Star Trek?

0248 ... Wumpus?

0249 ... Lunar Lander?

0250 ... Empire?



Have you ever beaten

0251 ... Moria 4.8?

0252 ... Rogue 3.6?

0253 ... Rogue 5.3?

0254 ... Larn?

0255 ... Hack 1.0.3?

0256 ... Nethack 2.4?



0257 Can you get a better score on Rogue than Rogomatic?



0258 Have you ever solved Adventure?

0259 ... Zork?



0260 Have you ever written any redcode?



0261 Have you ever written an adventure program?

0262 ... a real-time game?

0263 ... a multi-player game?

0264 ... a networked game?



0265 Can you out-doctor Eliza?



* Hardware



0266 Have you ever used a light pen?

0267 ... did you build it?



Have you ever used

0268 ... a teletype?

0269 ... a paper tape?

0270 ... a decwriter?

0271 ... a card reader/punch?

0272 ... a SOL?



Have you ever built

0273 ... an Altair?

0274 ... a Heath/Zenith computer?



Do you know how to use

0275 ... an oscilliscope?

0276 ... a voltmeter?

0277 ... a frequency counter?

0278 ... a logic probe?

0279 ... a wirewrap tool?

0280 ... a soldering iron?

0281 ... a logic analyzer?



0282 Have you ever designed an LSI chip?

0283 ... has it been fabricated?



0284 Have you ever etched a printed circuit board?



* Historical



0285 Have you ever toggled in boot code on the front panel?

0286 ... from memory?



0287 Can you program an Eniac?



0288 Ever seen a 90 column card?



* IBM



0289 Do you recite IBM part numbers in your sleep?

0290 Do you know what IBM part number 7320154 is?



0291 Do you understand 3270 data streams?



0292 Do you know what the VM privilege classes are?



0293 Have you IPLed an IBM off the tape drive?

0294 ... off a card reader?



0295 Can you sing something from the IBM Songbook?



* Languages



0296 Do you know more than 4 programming languages?

0297 ... 8 languages?

0298 ... 16 languages?

0299 ... 32 languages?



0300 Have you ever designed a programming language?



0301 Do you know what Basic stands for?

0302 ... Pascal?



0303 Can you program in Basic?

0304 ... Do you admit it?



0305 Can you program in Cobol?

0306 ... Do you deny it?



0307 Do you know Pascal?

0308 ... Modula-2?

0309 ... Oberon?

0310 ... More that two Wirth languages?

0311 ... Can you recite a Nicklaus Wirth joke?



0312 Do you know Algol-60?

0313 ... Algol-W?

0314 ... Algol-68?

0315 ... Do you understand the Algol-68 report?

0316 ... Do you like two-level grammars?



0317 Can you program in assembler on 2 different machines?

0318 ... on 4 different machines?

0319 ... on 8 different machines?



Do you know

0320 ... APL?

0321 ... Ada?

0322 ... BCPL?

0323 ... C++?

0324 ... C?

0325 ... Comal?

0326 ... Eiffel?

0327 ... Forth?

0328 ... Fortran?

0329 ... Hypertalk?

0330 ... Icon?

0331 ... Lisp?

0332 ... Logo?

0333 ... MIIS?

0334 ... MUMPS?

0335 ... PL/I?

0336 ... Pilot?

0337 ... Plato?

0338 ... Prolog?

0339 ... RPG?

0340 ... Rexx (or ARexx)?

0341 ... SETL?

0342 ... Smalltalk?

0343 ... Snobol?

0344 ... VHDL?

0345 ... any assembly language?



0346 Can you talk VT-100?

0347 ... Postscript?

0348 ... SMTP?

0349 ... UUCP?

0350 ... English?



* Micros



0351 Ever copy a copy-protected disk?

0352 Ever create a copy-protection scheme?



0353 Have you ever made a "flippy" disk?



0354 Have you ever recovered data from a damaged disk?



0355 Ever boot a naked floppy?



* Networking



0356 Have you ever been logged in to two different timezones at once?



0357 Have you memorized the UUCP map for your country?

0358 ... For any country?



0359 Have you ever found a sendmail bug?

0360 ... Was it a security hole?



0361 Have you memorized the HOSTS.TXT table?

0362 ... Are you up to date?



0363 Can you name all the top-level nameservers and their addresses?



0364 Do you know RFC-822 by heart?

0365 ... Can you recite all the errors in it?



0366 Have you written a Sendmail configuration file?

0367 ... Does it work?

0368 ... Do you mumble "defocus" in your sleep?



0369 Do you know the max packet lifetime?



* Operating systems



Can you use

0370 ... BSD Unix?

0371 ... non-BSD Unix?

0372 ... AIX

0373 ... VM/CMS?

0374 ... VMS?

0375 ... MVS?

0376 ... VSE?

0377 ... RSTS/E?

0378 ... CP/M?

0379 ... COS?

0380 ... NOS?

0381 ... CP-67?

0382 ... RT-11?

0383 ... MS-DOS?

0384 ... Finder?

0385 ... PRODOS?

0386 ... more than one OS for the TRS-80?

0387 ... Tops-10?

0388 ... Tops-20?

0389 ... OS-9?

0390 ... OS/2?

0391 ... AOS/VS?

0392 ... Multics?

0393 ... ITS?

0394 ... Vulcan?



0395 Have you ever paged or swapped off a tape drive?

0396 ... Off a card reader/punch?

0397 ... Off a teletype?

0398 ... Off a networked (non-local) disk?



0399 Have you ever found an operating system bug?

0400 ... Did you exploit it?

0401 ... Did you report it?

0402 ... Was your report ignored?



0403 Have you ever crashed a machine?

0404 ... Intentionally?



* People



0405 Do you know any people?

0406 ... more than one?

0407 ... more than two?



* Personal



0408 Are your shoelaces untied?



0409 Do you interface well with strangers?



0410 Are you able to recite phone numbers for half-a-dozen computer systems

but unable to recite your own?



0411 Do you log in before breakfast?



0412 Do you consume more than LD-50 caffeine a day?



0413 Do you answer either-or questions with "yes"?



0414 Do you own an up-to-date copy of any operating system manual?

0415 ... *every* operating system manual?



0416 Do other people have difficulty using your customized environment?



0417 Do you dream in any programming languages?



0418 Do you have difficulty focusing on three-dimensional objects?



0419 Do you ignore mice?



0420 Do you despise the CAPS LOCK key?



0421 Do you believe menus belong in restaurants?



0422 Do you have a Mandelbrot hanging on your wall?



0423 Have you ever decorated with magnetic tape or punched cards?

0424 Do you have a disk platter or a naked floppy hanging in your home?



0425 Have you ever seen the dawn?

0426 ... Twice in a row?



0427 Do you use "foobar" in daily conversation?

0428 ... "bletch"?



0429 Do you use the "P convention"?



0430 Do you automatically respond to any user question with RTFM?

0431 ... Do you know what it means?



0432 Do you think garbage collection means memory management?



0433 Do you have problems allocating horizontal space in your room/office?



0434 Do you read Scientific American in bars to pick up women?



0435 Is your license plate computer-related?



0436 Have you ever taken the Purity test?



0437 Ever have an out-of-CPU experience?



0438 Have you ever set up a blind date over the computer?



0439 Do you talk to the person next to you via computer?



* Programming



0440 Can you write a Fortran compiler?

0441 ... In TECO?



0442 Can you read a machine dump?

0443 Can you disassemble code in your head?



Have you ever written

0444 ... a compiler?

0445 ... an operating system?

0446 ... a device driver?

0447 ... a text processor?

0448 ... a display hack?

0449 ... a database system?

0450 ... an expert system?

0451 ... an edge detector?

0452 ... a real-time control system?

0453 ... an accounting package?

0454 ... a virus?

0455 ... a prophylactic?



0456 Have you ever written a biorhythm program?

0457 ... Did you sell the output?

0458 ... Was the output arbitrarily invented?



0459 Have you ever computed pi to more than a thousand decimal places?

0460 ... the number e?



0461 Ever find a prime number of more than a hundred digits?



0462 Have you ever written self-modifying code?

0463 ... Are you proud of it?



0464 Did you ever write a program that ran correctly the first time?

0465 ... Was it longer than 20 lines?

0466 ... 100 lines?

0467 ... Was it in assembly language?

0468 ... Did it work the second time?



0469 Can you solve the Towers of Hanoi recursively?

0470 ... Non-recursively?

0471 ... Using the Troff text formatter?



0472 Ever submit an entry to the Obfuscated C code contest?

0473 ... Did it win?

0474 ... Did your entry inspire a new rule?



0475 Do you know Duff's device?



0476 Do you know Jensen's device?



0477 Ever spend ten minutes trying to find a single-character error?

0478 ... More than an hour?

0479 ... More than a day?

0480 ... More than a week?

0481 ... Did the first person you show it to find it immediately?



* Unix



0482 Can you use Berkeley Unix?

0483 .. Non-Berkeley Unix?



0484 Can you distinguish between sections 4 and 5 of the Unix manual?



0485 Can you find TERMIO in the System V release 2 documentation?



0486 Have you ever mounted a tape as a Unix file system?



0487 Have you ever built Minix?



0488 Can you answer "quiz function ed-command" correctly?

0489 ... How about "quiz ed-command function"?



* Usenet



0490 Do you read news?

0491 ... More than 32 newsgroups?

0492 ... More than 256 newsgroups?

0493 ... All the newsgroups?



0494 Have you ever posted an article?

0495 ... Do you post regularly?



0496 Have you ever posted a flame?

0497 ... Ever flame a cross-posting?

0498 ... Ever flame a flame?

0499 ... Do you flame regularly?



0500 Ever have your program posted to a source newsgroup?



0501 Ever forge a posting?

0502 Ever form a new newsgroup?

0503 ... Does it still exist?



0504 Do you remember

0505 ... mod.ber?

0506 ... the Stupid People's Court?

0507 ... Bandy-grams?



* Phreaking



0508 Have you ever built a black box?



0509 Can you name all of the 'colors' of boxes?

0510 ... and their associated functions?



0511 Does your touch tone phone have 16 DTMF buttons on it?



0512 Did the breakup of MaBell create more opportunities for you?

~~~~~~~~~~~~~~~

.A.1. WHAT IS A DENIAL OF SERVICE ATTACK?
-----------------------------------------

Denial of service is about without permission knocking off
services, for example through crashing the whole system. This
kind of attacks are easy to launch and it is hard to protect
a system against them. The basic problem is that Unix
assumes that users on the system or on other systems will be
well behaved.



.A.2. WHY WOULD SOMEONE CRASH A SYSTEM?
---------------------------------------

.A.2.1. INTRODUCTION
--------------------

Why would someone crash a system? I can think of several reasons
that I have presentated more precisely in a section for each reason,
but for short:

.1. Sub-cultural status.
.2. To gain access.
.3. Revenge.
.4. Political reasons.
.5. Economical reasons.
.6. Nastiness.

I think that number one and six are the more common today, but that
number four and five will be the more common ones in the future.

.A.2.2. SUB-CULTURAL STATUS
---------------------------

After all information about syn flooding a bunch of such attacks
were launched around Sweden. The very most of these attacks were
not a part of a IP-spoof attack, it was "only" a denial of service
attack. Why?

I think that hackers attack systems as a sub-cultural pseudo career
and I think that many denial of service attacks, and here in the
example syn flooding, were performed for these reasons. I also think
that many hackers begin their carrer with denial of service attacks.

.A.2.3. TO GAIN ACCESS
----------------------

Sometimes could a denial of service attack be a part of an attack to
gain access at a system. At the moment I can think of these reasons
and specific holes:

.1. Some older X-lock versions could be crashed with a
method from the denial of service family leaving the system
open. Physical access was needed to use the work space after.

.2. Syn flooding could be a part of a IP-spoof attack method.

.3. Some program systems could have holes under the startup,
that could be used to gain root, for example SSH (secure shell).

.4. Under an attack it could be usable to crash other machines
in the network or to deny certain persons the ability to access
the system.

.5. Also could a system being booted sometimes be subverted,
especially rarp-boots. If we know which port the machine listen
to (69 could be a good guess) under the boot we can send false
packets to it and almost totally control the boot.

.A.2.4. REVENGE
---------------

A denial of service attack could be a part of a revenge against a user
or an administrator.

.A.2.5. POLITICAL REASONS
-------------------------

Sooner or later will new or old organizations understand the potential
of destroying computer systems and find tools to do it.

For example imaginate the Bank A loaning company B money to build a
factory threating the environment. The organization C therefor crash A:s
computer system, maybe with help from an employee. The attack could cost
A a great deal of money if the timing is right.

.A.2.6. ECONOMICAL REASONS
--------------------------

Imaginate the small company A moving into a business totally dominated by
company B. A and B customers make the orders by computers and depends
heavily on that the order is done in a specific time (A and B could be
stock trading companies). If A and B can't perform the order the customers
lose money and change company.

As a part of a business strategy A pays a computer expert a sum of money to
get him to crash B:s computer systems a number of times. A year later A
is the dominating company.

.A.2.7. NASTINESS
-----------------

I know a person that found a workstation where the user had forgotten to
logout. He sat down and wrote a program that made a kill -9 -1 at a
random time at least 30 minutes after the login time and placed a call to
the program from the profile file. That is nastiness.

.A.3. ARE SOME OPERATING SYSTEMS MORE SECURE?
---------------------------------------------

This is a hard question to answer and I don't think that it will
give anything to compare different Unix platforms. You can't say that
one Unix is more secure against denial of service, it is all up to the
administrator.

A comparison between Windows 95 and NT on one side and Unix on the
other could however be interesting.

Unix systems are much more complex and have hundreds of built in programs,
services... This always open up many ways to crash the system from
the inside.

In the normal Windows NT and 95 network were is few ways to crash
the system. Although were is methods that always will work.

That gives us that no big different between Microsoft and Unix can
be seen regardning the inside attacks. But there is a couple of
points left:

- Unix have much more tools and programs to discover an
attack and monitoring the users. To watch what another user
is up to under windows is very hard.

- The average Unix administrator probably also have much more
experience than the average Microsoft administrator.

The two last points gives that Unix is more secure against inside
denial of service attacks.

A comparison between Microsoft and Unix regarding outside attacks
are much more difficult. However I would like to say that the average
Microsoft system on the Internet are more secure against outside
attacks, because they normally have much less services.

.B. SOME BASIC TARGETS FOR AN ATTACK
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

.B.1. SWAP SPACE
----------------

Most systems have several hundred Mbytes of swap space to
service client requests. The swap space is typical used
for forked child processes which have a short life time.
The swap space will therefore almost never in a normal
cause be used heavily. A denial of service could be based
on a method that tries to fill up the swap space.

.B.2. BANDWIDTH
---------------

If the bandwidth is to high the network will be useless. Most
denial of service attack influence the bandwidth in some way.

.B.3. KERNEL TABLES
-------------------

It is trivial to overflow the kernel tables which will cause
serious problems on the system. Systems with write through
caches and small write buffers is especially sensitive.

Kernel memory allocation is also a target that is sensitive.
The kernel have a kernelmap limit, if the system reach this
limit it can not allocate more kernel memory and must be rebooted.
The kernel memory is not only used for RAM, CPU:s, screens and so
on, it it also used for ordinaries processes. Meaning that any system
can be crashed and with a mean (or in some sense good) algorithm pretty
fast.

For Solaris 2.X it is measured and reported with the sar command
how much kernel memory the system is using, but for SunOS 4.X there
is no such command. Meaning that under SunOS 4.X you don't even can
get a warning. If you do use Solaris you should write sar -k 1 to
get the information. netstat -k can also be used and shows how much
memory the kernel have allocated in the subpaging.

.B.4. RAM
---------

A denial of service attack that allocates a large amount of RAM
can make a great deal of problems. NFS and mail servers are
actually extremely sensitive because they do not need much
RAM and therefore often don't have much RAM. An attack at
a NFS server is trivial. The normal NFS client will do a
great deal of caching, but a NFS client can be anything
including the program you wrote yourself...

.B.5. DISKS
-----------

A classic attack is to fill up the hard disk, but an attack at
the disks can be so much more. For example can an overloaded disk
be misused in many ways.

.B.6. CACHES
-------------

A denial of service attack involving caches can be based on a method
to block the cache or to avoid the cache.

These caches are found on Solaris 2.X:

Directory name lookup cache: Associates the name of a file with a vnode.

Inode cache: Cache information read from disk in case it is needed
again.

Rnode cache: Holds information about the NFS filesystem.

Buffer cache: Cache inode indirect blocks and cylinders to realed disk
I/O.

.B.7. INETD
-----------

Well once inetd crashed all other services running through inetd no
longer will work.


.C. ATTACKING FROM THE OUTSIDE
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~


.C.1. TAKING ADVANTAGE OF FINGER
--------------------------------

Most fingerd installations support redirections to an other host.

Ex:

$finger @system.two.com@system.one.com

finger will in the example go through system.one.com and on to
system.two.com. As far as system.two.com knows it is system.one.com
who is fingering. So this method can be used for hiding, but also
for a very dirty denial of service attack. Lock at this:

$ finger @@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@host.we.attack

All those @ signs will get finger to finger host.we.attack again and
again and again... The effect on host.we.attack is powerful and
the result is high bandwidth, short free memory and a hard disk with
less free space, due to all child processes (compare with .D.5.).

The solution is to install a fingerd which don't support redirections,
for example GNU finger. You could also turn the finger service off,
but I think that is just a bit to much.

.C.2. UDP AND SUNOS 4.1.3.
--------------------------

SunOS 4.1.3. is known to boot if a packet with incorrect information
in the header is sent to it. This is the cause if the ip_options
indicate a wrong size of the packet.

The solution is to install the proper patch.

.C.3. FREEZING UP X-WINDOWS
---------------------------

If a host accepts a telnet session to the X-Windows port (generally
somewhere between 6000 and 6025. In most cases 6000) could that
be used to freeze up the X-Windows system. This can be made with
multiple telnet connections to the port or with a program which
sends multiple XOpenDisplay() to the port.

The same thing can happen to Motif or Open Windows.

The solution is to deny connections to the X-Windows port.

.C.4. MALICIOUS USE OF UDP SERVICES
-----------------------------------

It is simple to get UDP services (echo, time, daytime, chargen) to
loop, due to trivial IP-spoofing. The effect can be high bandwidth
that causes the network to become useless. In the example the header
claim that the packet came from 127.0.0.1 (loopback) and the target
is the echo port at system.we.attack. As far as system.we.attack knows
is 127.0.0.1 system.we.attack and the loop has been establish.

Ex:

from-IP=127.0.0.1
to-IP=system.we.attack
Packet type:UDP
from UDP port 7
to UDP port 7

Note that the name system.we.attack looks like a DNS-name, but the
target should always be represented by the IP-number.

Quoted from proberts@clark.net (Paul D. Robertson) comment on
comp.security.firewalls on matter of "Introduction to denial of service"

" A great deal of systems don't put loopback on the wire, and simply
emulate it. Therefore, this attack will only effect that machine
in some cases. It's much better to use the address of a different
machine on the same network. Again, the default services should
be disabled in inetd.conf. Other than some hacks for mainframe IP
stacks that don't support ICMP, the echo service isn't used by many
legitimate programs, and TCP echo should be used instead of UDP
where it is necessary. "

.C.5. ATTACKING WITH LYNX CLIENTS
---------------------------------

A World Wide Web server will fork an httpd process as a respond
to a request from a client, typical Netscape or Mosaic. The process
lasts for less than one second and the load will therefore never
show up if someone uses ps. In most causes it is therefore very
safe to launch a denial of service attack that makes use of
multiple W3 clients, typical lynx clients. But note that the netstat
command could be used to detect the attack (thanks to Paul D. Robertson).

Some httpd:s (for example http-gw) will have problems besides the normal
high bandwidth, low memory... And the attack can in those causes get
the server to loop (compare with .C.6.)

.C.6. MALICIOUS USE OF telnet
-----------------------------

Study this little script:

Ex:

while : ; do
telnet system.we.attack &
done

An attack using this script might eat some bandwidth, but it is
nothing compared to the finger method or most other methods. Well
the point is that some pretty common firewalls and httpd:s thinks
that the attack is a loop and turn them self down, until the
administrator sends kill -HUP.

This is a simple high risk vulnerability that should be checked
and if present fixed.

.C.7. MALICIOUS USE OF telnet UNDER SOLARIS 2.4
-----------------------------------------------

If the attacker makes a telnet connections to the Solaris 2.4 host and
quits using:

Ex:

Control-}
quit

then will inetd keep going "forever". Well a couple of hundred...

The solution is to install the proper patch.

.C.8. HOW TO DISABLE ACCOUNTS
-----------------------------

Some systems disable an account after N number of bad logins, or waits
N seconds. You can use this feature to lock out specific users from
the system.

.C.9. LINUX AND TCP TIME, DAYTIME
----------------------------------

Inetd under Linux is known to crash if to many SYN packets sends to
daytime (port 13) and/or time (port 37).

The solution is to install the proper patch.

.C.10. HOW TO DISABLE SERVICES
------------------------------

Most Unix systems disable a service after N sessions have been
open in a given time. Well most systems have a reasonable default
(lets say 800 - 1000), but not some SunOS systems that have the
default set to 48...

The solutions is to set the number to something reasonable.

.C.11. PARAGON OS BETA R1.4
---------------------------

If someone redirects an ICMP (Internet Control Message Protocol) packet
to a paragon OS beta R1.4 will the machine freeze up and must be
rebooted. An ICMP redirect tells the system to override routing
tables. Routers use this to tell the host that it is sending
to the wrong router.

The solution is to install the proper patch.

.C.12. NOVELLS NETWARE FTP
--------------------------

Novells Netware FTP server is known to get short of memory if multiple
ftp sessions connects to it.

.C.13. ICMP REDIRECT ATTACKS
----------------------------

Gateways uses ICMP redirect to tell the system to override routing
tables, that is telling the system to take a better way. To be able
to misuse ICMP redirection we must know an existing connection
(well we could make one for ourself, but there is not much use for that).
If we have found a connection we can send a route that
loses it connectivity or we could send false messages to the host
if the connection we have found don't use cryptation.

Ex: (false messages to send)

DESTINATION UNREACHABLE
TIME TO LIVE EXCEEDED
PARAMETER PROBLEM
PACKET TOO BIG

The effect of such messages is a reset of the connection.

The solution could be to turn ICMP redirects off, not much proper use
of the service.

.C.14. BROADCAST STORMS
-----------------------

This is a very popular method in networks there all of the hosts are
acting as gateways.

There are many versions of the attack, but the basic method is to
send a lot of packets to all hosts in the network with a destination
that don't exist. Each host will try to forward each packet so
the packets will bounce around for a long time. And if new packets
keep coming the network will soon be in trouble.

Services that can be misused as tools in this kind of attack is for
example ping, finger and sendmail. But most services can be misused
in some way or another.

.C.15. EMAIL BOMBING AND SPAMMING
---------------------------------

In a email bombing attack the attacker will repeatedly send identical
email messages to an address. The effect on the target is high bandwidth,
a hard disk with less space and so on... Email spamming is about sending
mail to all (or rather many) of the users of a system. The point of
using spamming instead of bombing is that some users will try to
send a replay and if the address is false will the mail bounce back. In
that cause have one mail transformed to three mails. The effect on the
bandwidth is obvious.

There is no way to prevent email bombing or spamming. However have
a look at CERT:s paper "Email bombing and spamming".

.C.16. TIME AND KERBEROS
------------------------

If not the the source and target machine is closely aligned will the


ticket be rejected, that means that if not the protocol that set the
time is protected it will be possible to set a kerberos server of
function.

.C.17. THE DOT DOT BUG
----------------------

Windows NT file sharing system is vulnerable to the under Windows 95
famous dot dot bug (dot dot like ..). Meaning that anyone can crash
the system. If someone sends a "DIR ..\" to the workstation will a
STOP messages appear on the screen on the Windows NT computer. Note that
it applies to version 3.50 and 3.51 for both workstation and server
version.

The solution is to install the proper patch.

.C.18. SUNOS KERNEL PANIC
-------------------------

Some SunOS systems (running TIS?) will get a kernel panic if a
getsockopt() is done after that a connection has been reset.

The solution could be to install Sun patch 100804.

.C.19. HOSTILE APPLETS
----------------------

A hostile applet is any applet that attempts to use your system
in an inappropriate manner. The problems in the java language
could be sorted in two main groups:

1) Problems due to bugs.
2) Problems due to features in the language.

In group one we have for example the java bytecode verifier bug, which
makes is possible for an applet to execute any command that the user
can execute. Meaning that all the attack methods described in .D.X.
could be executed through an applet. The java bytecode verifier bug
was discovered in late March 1996 and no patch have yet been available
(correct me if I'am wrong!!!).

Note that two other bugs could be found in group one, but they
are both fixed in Netscape 2.01 and JDK 1.0.1.

Group two are more interesting and one large problem found is the
fact that java can connect to the ports. Meaning that all the methods
described in .C.X. can be performed by an applet. More information
and examples could be found at address:

http://www.math.gatech.edu/~mladue/HostileArticle.html

If you need a high level of security you should use some sort of
firewall for protection against java. As a user you could have
java disable.

.C.20. VIRUS
------------

Computer virus is written for the purpose of spreading and
destroying systems. Virus is still the most common and famous
denial of service attack method.

It is a misunderstanding that virus writing is hard. If you know
assembly language and have source code for a couple of virus it
is easy. Several automatic toolkits for virus construction could
also be found, for example:

* Genvir.
* VCS (Virus Construction Set).
* VCL (Virus Construction Laboratory).
* PS-MPC (Phalcon/Skism - Mass Produced Code Generator).
* IVP (Instant Virus Production Kit).
* G2 (G Squared).

PS-MPC and VCL is known to be the best and can help the novice programmer
to learn how to write virus.

An automatic tool called MtE could also be found. MtE will transform
virus to a polymorphic virus. The polymorphic engine of MtE is well
known and should easily be catch by any scanner.

.C.21. ANONYMOUS FTP ABUSE
--------------------------

If an anonymous FTP archive have a writable area it could be misused
for a denial of service attack similar with with .D.3. That is we can
fill up the hard disk.

Also can a host get temporarily unusable by massive numbers of
FTP requests.

For more information on how to protect an anonymous FTP site could
CERT:s "Anonymous FTP Abuses" be a good start.

.C.22. SYN FLOODING
-------------------

Both 2600 and Phrack have posted information about the syn flooding attack.
2600 have also posted exploit code for the attack.

As we know the syn packet is used in the 3-way handshake. The syn flooding
attack is based on an incomplete handshake. That is the attacker host
will send a flood of syn packet but will not respond with an ACK packet.
The TCP/IP stack will wait a certain amount of time before dropping
the connection, a syn flooding attack will therefore keep the syn_received
connection queue of the target machine filled.

The syn flooding attack is very hot and it is easy to find more information
about it, for example:

[.1.] http://www.eecs.nwu.edu/~jmyers/bugtraq/1354.html
Article by Christopher Klaus, including a "solution".

[.2.] http://jya.com/floodd.txt
2600, Summer, 1996, pp. 6-11. FLOOD WARNING by Jason Fairlane

[.3.] http://www.fc.net/phrack/files/p48/p48-14.html
IP-spoofing Demystified by daemon9 / route / infinity
for Phrack Magazine

.C.23. PING FLOODING
--------------------

I haven't tested how big the impact of a ping flooding attack is, but
it might be quite big.

Under Unix we could try something like: ping -s host
to send 64 bytes packets.

If you have Windows 95, click the start button, select RUN, then type
in: PING -T -L 256 xxx.xxx.xxx.xx. Start about 15 sessions.

.C.24. CRASHING SYSTEMS WITH PING FROM WINDOWS 95 MACHINES
----------------------------------------------------------

If someone can ping your machine from a Windows 95 machine he or she might
reboot or freeze your machine. The attacker simply writes:

ping -l 65510 address.to.the.machine

And the machine will freeze or reboot.

Works for kernel 2.0.7 up to version 2.0.20. and 2.1.1. for Linux (crash).
AIX4, OSF, HPUX 10.1, DUnix 4.0 (crash).
OSF/1, 3.2C, Solaris 2.4 x86 (reboot).

.C.25. MALICIOUS USE OF SUBNET MASK REPLY MESSAGE
--------------------------------------------------

The subnet mask reply message is used under the reboot, but some
hosts are known to accept the message any time without any check.
If so all communication to or from the host us turned off, it's dead.

The host should not accept the message any time but under the reboot.

.C.26. FLEXlm
-------------

Any host running FLEXlm can get the FLEXlm license manager daemon
on any network to shutdown using the FLEXlm lmdown command.

# lmdown -c /etc/licence.dat
lmdown - Copyright (C) 1989, 1991 Highland Software, Inc.

Shutting down FLEXlm on nodes: xxx
Are you sure? [y/n]: y
Shut down node xxx
#

.C.27. BOOTING WITH TRIVIAL FTP
-------------------------------

To boot diskless workstations one often use trivial ftp with rarp or
bootp. If not protected an attacker can use tftp to boot the host.


.D. ATTACKING FROM THE INSIDE
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

.D.1. KERNEL PANIC UNDER SOLARIS 2.3
------------------------------------

Solaris 2.3 will get a kernel panic if this
is executed:

EX:

$ndd /dev/udp udp_status

The solution is to install the proper patch.

.D.2. CRASHING THE X-SERVER
---------------------------

If stickybit is not set in /tmp then can the file /tmp/.x11-unix/x0
be removed and the x-server will crash.

Ex:

$ rm /tmp/.x11-unix/x0

.D.3. FILLING UP THE HARD DISK
-----------------------------

If your hard disk space is not limited by a quota or if you can use
/tmp then it`s possible for you to fill up the file system.

Ex:

while : ;
mkdir .xxx
cd .xxx
done

.D.4. MALICIOUS USE OF eval
---------------------------

Some older systems will crash if eval '\!\!' is executed in the
C-shell.

Ex:

% eval '\!\!'

.D.5. MALICIOUS USE OF fork()
-----------------------------

If someone executes this C++ program the result will result in a crash
on most systems.

Ex:

#include
#include
#include

main()
{
int x;
while(x=0;x<1000000;x++)> -xxx
^C
$ ls
-xxx
$ rm -xxx
rm: illegal option -- x
rm: illegal option -- x
rm: illegal option -- x
usage: rm [-fiRr] file ...
$

Ex.II.

$ touch xxx!
$ rm xxx!
rm: remove xxx! (yes/no)? y
$ touch xxxxxxxxx!
$ rm xxxxxxxxx!
bash: !": event not found
$

(You see the size do count!)

Other well know methods is files with odd characters or spaces
in the name.

These methods could be used in combination with ".D.3 FILLING UP THE
HARDDISK". If you do want to remove these files you must use some sort
of script or a graphical interface like OpenWindow:s File
Manager. You can also try to use: rm ./. It should work for
the first example if you have a shell.

.D.7. DIRECTORY NAME LOOKUPCACHE
--------------------------------

Directory name lookupcache (DNLC) is used whenever a file is opened.
DNLC associates the name of the file to a vnode. But DNLC can only
operate on files with names that has less than N characters (for SunOS 4.x
up to 14 character, for Solaris 2.x up 30 characters). This means
that it's dead easy to launch a pretty discreet denial of service attack.

Create lets say 20 directories (for a start) and put 10 empty files in
every directory. Let every name have over 30 characters and execute a
script that makes a lot of ls -al on the directories.

If the impact is not big enough you should create more files or launch
more processes.

.D.8. CSH ATTACK
----------------

Just start this under /bin/csh (after proper modification)
and the load level will get very high (that is 100% of the cpu time)
in a very short time.

Ex:

|I /bin/csh
nodename : **************b

.D.9. CREATING FILES IN /tmp
----------------------------

Many programs creates files in /tmp, but are unable to deal with the problem
if the file already exist. In some cases this could be used for a
denial of service attack.

.D.10. USING RESOLV_HOST_CONF
-----------------------------

Some systems have a little security hole in the way they use the
RESOLV_HOST_CONF variable. That is we can put things in it and
through ping access confidential data like /etc/shadow or
crash the system. Most systems will crash if /proc/kcore is
read in the variable and access through ping.

Ex:

$ export RESOLV_HOST_CONF="/proc/kcore" ; ping asdf

.D.11. SUN 4.X AND BACKGROUND JOBS
----------------------------------

Thanks to Mr David Honig for the following:

" Put the string "a&" in a file called "a" and perform "chmod +x a".
Running "a" will quickly disable a Sun 4.x machine, even disallowing
(counter to specs) root login as the kernel process table fills."

" The cute thing is the size of the
script, and how few keystrokes it takes to bring down a Sun
as a regular user."

.D.12. CRASHING DG/UX WITH ULIMIT
---------------------------------

ulimit is used to set a limit on the system resources available to the
shell. If ulimit 0 is called before /etc/passwd, under DG/UX, will the
passwd file be set to zero.

.D.13. NETTUNE AND HP-UX
------------------------

/usr/contrib/bin/nettune is SETUID root on HP-UX meaning
that any user can reset all ICMP, IP and TCP kernel
parameters, for example the following parameters:

- arp_killcomplete
- arp_killincomplete
- arp_unicast
- arp_rebroadcast
- icmp_mask_agent
- ip_defaultttl
- ip_forwarding
- ip_intrqmax
- pmtu_defaulttime
- tcp_localsubnets
- tcp_receive
- tcp_send
- tcp_defaultttl
- tcp_keepstart
- tcp_keepfreq
- tcp_keepstop
- tcp_maxretrans
- tcp_urgent_data_ptr
- udp_cksum
- udp_defaultttl
- udp_newbcastenable
- udp_pmtu
- tcp_pmtu
- tcp_random_seq

The solution could be to set the proper permission on
/sbin/mount_union:

#chmod u-s /sbin/mount_union

.D.14. SOLARIS 2.X AND NFS
--------------------------

If a process is writing over NFS and the user goes over the disk
quota will the process go into an infinite loop.

.D.15. SYSTEM STABILITY COMPROMISE VIA MOUNT_UNION
--------------------------------------------------

By executing a sequence of mount_union commands any user
can cause a system reload on all FreeBSD version 2.X before
1996-05-18.

$ mkdir a
$ mkdir b
$ mount_union ~/a ~/b
$ mount_union -b ~/a ~/b

The solution could be to set the proper permission on
/sbin/mount_union:

#chmod u-s /sbin/mount_union

.D.16. trap_mon CAUSES KERNEL PANIC UNDER SUNOS 4.1.X
----------------------------------------------------

Executing the trap_mon instruction from user mode can cause
a kernel panic or a window underflow watchdog reset under
SunOS 4.1.x, sun4c architecture.


.E. DUMPING CORE
~~~~~~~~~~~~~~~~

.E.1. SHORT COMMENT
-------------------

The core dumps things don't really belongs in this paper but I have
put them here anyway.

.E.2. MALICIOUS USE OF NETSCAPE
-------------------------------

Under Netscape 1.1N this link will result in a segmentation fault and a
core dump.

Ex:



.E.3. CORE DUMPED UNDER WUFTPD
------------------------------

A core dumped could be created under wuftp with two different
methods:

(1) Then pasv is given (user not logged in (ftp -n)). Almost all
versions of BSD:s ftpd.
(2) More than 100 arguments is given with any executable
command. Presents in all versions of BSD:sd ftpd.

.E.4. ld UNDER SOLARIS/X86
--------------------------

Under Solaris 2.4/X86 ld dumps core if given with the -s option.


.F. HOW DO I PROTECT A SYSTEM AGAINST DENIAL OF SERVICE ATTACKS?
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

.F.1. BASIC SECURITY PROTECTION
-------------------------------

.F.1.1. INTRODUCTION
--------------------

You can not make your system totally secured against denial of service
attacks but for attacks from the outside you can do a lot. I put this
work list together and hope that it can be of some use.

.F.1.2. SECURITY PATCHES
------------------------

Always install the proper security patches. As for patch numbers
I don't want to put them out, but that doesn't matter because you
anyway want to check that you have all security patches installed,
so get a list and check! Also note that patches change over time and
that a solution suggested in security bulletins (i.e. CERT) often
is somewhat temporary.

.F.1.3. PORT SCANNING
---------------------

Check which services you have. Don't check with the manual
or some configuration file, instead scan the ports with sprobe
or some other port scanner. Actual you should do this regualy to see
that anyone don't have installed a service that you don't want on
the system (could for example be service used for a pirate site).

Disable every service that you don't need, could for example be rexd,
fingerd, systat, netstat, rusersd, sprayd, pop3, uucpd, echo, chargen,
tftp, exec, ufs, daytime, time... Any combination of echo, time, daytime
and chargen is possible to get to loop. There is however no need
to turn discard off. The discard service will just read a packet
and discard it, so if you turn off it you will get more sensitive to
denial of service and not the opposite.

Actual can services be found on many systems that can be used for
denial of service and brute force hacking without any logging. For
example Stock rexec never logs anything. Most popd:s also don't log
anything

.F.1.4. CHECK THE OUTSIDE ATTACKS DESCRIBED IN THIS PAPER
---------------------------------------------------------

Check that attacks described in this paper and look at the
solution. Some attacks you should perform yourself to see if they
apply to your system, for example:

- Freezing up X-Windows.
- Malicious use of telnet.
- How to disable services.
- SunOS kernel panic.
- Attacking with lynx clients.
- Crashing systems with ping from Windows 95 machines.

That is stress test your system with several services and look at
the effect.

Note that Solaris 2.4 and later have a limit on the number of ICMP
error messages (1 per 500 ms I think) that can cause problems then
you test your system for some of the holes described in this paper.
But you can easy solve this problem by executing this line:

$ /usr/sbin/ndd -set /dev/ip ip_icmp_err_interval 0

.F.1.5. CHECK THE INSIDE ATTACKS DESCRIBED IN THIS PAPER
--------------------------------------------------------

Check the inside attacks, although it is always possibly to crash
the system from the inside you don't want it to be to easy. Also
have several of the attacks applications besides denial of service,
for example:

- Crashing the X-Server: If stickybit is not set in /tmp
a number of attacks to gain
access can be performed.

- Using resolv_host_conf: Could be used to expose
confidential data like
/etc/shadow.

- Core dumped under wuftpd: Could be used to extract
password-strings.

If I don't have put out a solution I might have recommended son other paper.
If not I don't know of a paper with a solution I feel that I can recommend.
You should in these causes check with your company.

.F.1.6. EXTRA SECURITY SYSTEMS
------------------------------

Also think about if you should install some extra security systems.
The basic that you always should install is a logdaemon and a wrapper.
A firewall could also be very good, but expensive. Free tools that can
be found on the Internet is for example:

TYPE: NAME: URL:

LOGDAEMON NETLOG ftp://net.tamu.edu/pub/security/TAMU
WRAPPER TCP WRAPPERS ftp://cert.org/pub/tools/tcp_wrappers
FIREWALL TIS ftp://ftp.tis.com/pub/firewalls/toolkit

Note that you should be very careful if building your own firewall with
TIS or you might open up new and very bad security holes, but it is a very
good security packer if you have some basic knowledge.

It is also very good to replace services that you need, for example telnet,
rlogin, rsh or whatever, with a tool like ssh. Ssh is free and can be
found at URL:

ftp://ftp.cs.hut.fi/pub/ssh

The addresses I have put out are the central sites for distributing
and I don't think that you should use any other except for CERT.

For a long list on free general security tools I recommend:
" computer="" security="" frequently="" asked="" questions="">

.F.1.7. MONITORING SECURITY
---------------------------

Also monitor security regular, for example through examining system log
files, history files... Even in a system without any extra security systems
could several tools be found for monitoring, for example:

- uptime
- showmount
- ps
- netstat
- finger

(see the man text for more information).

.F.1.8. KEEPING UP TO DATE
--------------------------

It is very important to keep up to date with security problems. Also
understand that then, for example CERT, warns for something it has often
been dark-side public for sometime, so don't wait. The following resources
that helps you keeping up to date can for example be found on the Internet:

- CERT mailing list. Send an e-mail to cert@cert.org to be placed
on the list.

- Bugtraq mailing list. Send an e-mail to bugtraq-request@fc.net.

- WWW-security mailing list. Send an e-mail to
www-security@ns2.rutgers.edu.

.F.1.9. READ SOMETHING BIGGER AND BETTER
----------------------------------------

Let's start with papers on the Internet. I am sorry to say that it is not
very many good free papers that can be found, but here is a small collection
and I am sorry if have have over looked a paper.

(1) The Rainbow books is a long series of free books on computer security.
US citizens can get the books from:

INFOSEC AWARENESS OFFICE
National Computer Security Center
9800 Savage Road
Fort George G. Meader, MD 20755-600

We other just have to read the papers on the World Wide Web. Every
paper can not however be found on the Internet.

(2) "Improving the security of your Unix system" by Curry is also very
nice if you need the very basic things. If you don't now anything about
computer security you can't find a better start.

(3) "The WWW security FAQ" by Stein is although it deal with W3-security
the very best better on the Internet about computer security.

(4) CERT have aklso published several good papers, for example:

- Anonymous FTP Abuses.
- Email Bombing and Spamming.
- Spoofed/Forged Email.
- Protecting yourself from password file attacks.

I think however that the last paper have overlooked several things.

(5) For a long list on papers I can recommend:
"FAQ: Computer Security Frequently Asked Questions".

(6) Also see section ".G. SUGGESTED READING"

You should also get some big good commercial book, but I don't want
to recommend any.

.F.2. MONITORING PERFORMANCE
----------------------------

.F.2.1. INTRODUCTION
--------------------

There is several commands and services that can be used for
monitoring performance. And at least two good free programs can
be found on Internet.

.F.2.2. COMMANDS AND SERVICES
-----------------------------

For more information read the man text.

netstat Show network status.
nfsstat Show NFS statistics.
sar System activity reporter.
vmstat Report virtual memory statistics.
timex Time a command, report process data and system
activity.
time Time a simple command.
truss Trace system calls and signals.
uptime Show how long the system has been up.

Note that if a public netstat server can be found you might be able
to use netstat from the outside. netstat can also give information
like tcp sequence numbers and much more.

.F.2.3. PROGRAMS
----------------

Proctool: Proctool is a freely available tool for Solaris that monitors
and controls processes.
ftp://opcom.sun.ca/pub/binaries/

Top: Top might be a more simple program than Proctool, but is
good enough.

.F.2.4. ACCOUNTING
------------------

To monitor performance you have to collect information over a long
period of time. All Unix systems have some sort of accounting logs
to identify how much CPU time, memory each program uses. You should
check your manual to see how to set this up.

You could also invent your own account system by using crontab and
a script with the commands you want to run. Let crontab run the script
every day and compare the information once a week. You could for
example let the script run the following commands:

- netstat
- iostat -D
- vmstat


.G. SUGGESTED READING
~~~~~~~~~~~~~~~~~~~~~

.F.1. INFORMATION FOR DEEPER KNOWLEDGE
-------------------------------------

(1) Hedrick, C. Routing Information Protocol. RFC 1058, 1988.
(2) Mills, D.L. Exterior Gateway Protocol Formal Specification. RFC 904, 1984.
(3) Postel, J. Internet Control Message Protocol. RFC 792, 1981.
(4) Harrenstien, K. NAME/FINGER Protocol, RFC 742, 1977.
(5) Sollins, K.R. The TFTP Protocol, RFC 783, 1981.
(6) Croft, W.J. Bootstrap Protocol, RFC 951, 1985.

Many of the papers in this category was RFC-papers. A RFC-paper
is a paper that describes a protocol. The letters RCS stands for
Request For Comment. Hosts on the Internet are expected to understand
at least the common ones. If you want to learn more about a protocol
it is always good to read the proper RFC. You can find a nice sRFC
index search form at URL:

http://pubweb.nexor.co.uk/public/rfc/index/rfc.html

.F.2. KEEPING UP TO DATE INFORMATION
------------------------------------

(1) CERT mailing list. Send an e-mail to cert@cert.org to be placed
on the list.
(2) Bugtraq mailinglist. Send an e-mail to bugtraq-request@fc.net.
(3) WWW-security mailinglist. Send an e-mail to www-security@ns2.rutgers.edu.
(4) Sun Microsystems Security Bulletins.
(5) Various articles from: - comp.security.announce
- comp.security.unix
- comp.security.firewalls
(6) Varius 40Hex Issues.

.F.3. BASIC INFORMATION
-----------------------

(1) Husman, H. INTRODUKTION TILL DATASÄKERHET UNDER X-WINDOWS, 1995.
(2) Husman, H. INTRODUKTION TILL IP-SPOOFING, 1995.
(3) The following rainbow books: - Teal Green Book (Glossary of
Computer Security Terms).
- Bright Orange Book( A Guide
to Understanding Security Testing
and Test Documentation in Trusted
Systems).
- C1 Technical Report-001
(Computer Viruses: Preventation,
Detection, and Treatment).
(4) Ranum, Marcus. Firewalls, 1993.
(5) Sun Microsystems, OpenWindows V3.0.1. User Commands, 1992.
(6) Husman, H. ATT SPÅRA ODOKUMENTERADE SÄKERHETSLUCKOR, 1996.
(7) Dark OverLord, Unix Cracking Tips, 1989.
(8) Shooting Shark, Unix Nasties, 1988.
(9) LaDue, Mark.D. Hostile Applets on the Horizone, 1996.
(10) Curry, D.A. Improving the security of your unix system, 1990.
(11) Stein, L.D. The World Wide Web security FAQ, 1995.
(12) Bellovin, S.M. Security Problems in the TCP/IP Protocol, 1989.

.H. COPYRIHT
------------

This paper is Copyright (c) 1996 by Hans Husman.

Permission is hereby granted to give away free copies electronically. You
may distribute, transfer, or spread this paper electronically. You may not
pretend that you wrote it. This copyright notice must be maintained in any
copy made. If you wish to reprint the whole or any part of this paper in any
other medium excluding electronic medium, please ask the author for
permission.

.I. DISCLAIMER
--------------

The information within this paper may change without notice. Use of this
information constitutes acceptance for use in an AS IS condition. There are
NO warranties with regard to this information. In no event shall the author
be liable for any damages whatsoever arising out of or in connection with
the use or spread of this information. Any use of this information is at the
user's own risk.

A Short 'HACKERSPEAK' Glossary
-
A reference to a few of the terms used by many computer hackers.
-
(Researched and compiled by members of the Hollywood User Group)
-

arg - (argh) noun. An argument, in the mathematical sense.

automagically - adverb. Automatically, but in a way which, for some
reason (for example, because it's too complicated or too trivial) the
speaker doesn't feel like explaining.
....


bells and whistles - n. Unnecessary (but often convenient, useful,
good-looking, or amusing) features of a program or other object. Added
to a bare-bones, working program.

bit - n. 1) A unit of information obtained by asking a question (e.g.
- 'I need a few bits about Punter protocol') 2) A mental flag;
reminder that something should be done eventually.

buffer - verb. The act of saving or setting aside something to be done
later. (e.g. - 'I'm going to buffer that and go eat now').

bug - n. A problem or mistake; unwanted property or side effect.
Usually of a program, but can refer to a person. Can be very simple or
very complicated. Antonym: FEATURE.

bum - v. To improve something by rearranging or removing its parts.
Most often done to a program to increase speed or save memory space,
usually at the expense of clarity.

buzz - v. Of a program, to run without visible progress or certainty
of finishing. Resembles CATATONIA except that a buzzing loop may
eventually end.

canonical - (ki NAHN i kil) adjective. Standard, usual or ordinary way
of doing something.

catatonia - n. A condition in which something is supposed to happen,
but nothing does. (e.g. - Nothing you type will appear on the screen.
It's catatonic. Often means a CRASH has occured.)

crash - 1) n. Sudden, drastic failure. Usually refers to a complete
computer system or program. 2) v. To fail suddenly or cause to fail.
3) v. Of people, to go to sleep.

creeping featurism - n. Tendency for anything complicated to become
even more so because people keep saying, 'Hey, it would be terrific if
the program had this feature, and could do this, and...' The result is
a patchwork program, confusing to read, with a lot of 'neat' features.

crock - n. Said of a program that works, but in an extremely awkward
or cumbersome manner.

crunch - v. To process, usually in a time-consuming, complex way.
Example: Performing large, repetitive numerical computations is called
'number crunching'. 2) v. To reduce the size of a file (often in a
complicated way) to save space.

dec'ed out - (decked out) adj. Stoned, drunk (and possibly trying to
program, regardless). Uncomplimentary. Derives from the 65-- series
ML opcode DECrement, i.e.: decrease a value.

elegant - adj. Said of a piece of code that does the RIGHT THING in a
way beautiful to look at.

feature - n. An extra property or behaviour added to a program that
already does the job. May or may not be useful, necessary or
convenient.

fencepost error - n. A mathematical 'off-by-one' error. Most often
found in programs that must count loops (it will count one time too
many, or too few). Term comes from the problem: 'If you build a fence
100 feet long with posts 10 feet apart, how many posts fo you need?'
Example: Suppose you want to process an array of items x thru y. How
many are there? The correct answer is x-y+1 (not x-y, which would be
off by one).

flavor - n. variety, kind, type. (flavorful - adj. Aesthetically
pleasing).

flush - v. To scratch, delete or destroy something. Often something
superfluous or useless.

fudge - v. Perform in an incomplete, but marginally acceptable way.
'I fudged it, so it works.'

GC - (jee see) 1) v. To clean up, throw away useless things. 2) To
forget. GC is an abreviation of the term 'Garbage Collection', the
common method of freeing up memory space.

glitch - n. Sudden interruption in electrical service, common sense,
or program function. Usually happens only when you pray that it
doesn't.

grovel - v. To work interminably, examine minutely or in extreme
detail.

gun - v. To forcibly terminate a program. 'It was a boring display,
so I gunned it.'

hack - n. An appropriate application of ingenuity. It could be a
quick-and-dirty bug fix, or a time-consuming and elegant work of art.
A clever technique.

hack value - n. The motivation for expending effort and time toward a
seemingly pointless goal, the point being the resulting hack.

hack attack - n. Period of greatly increased hacking activity. Not to
be confused with a Mac-Attack.

hacker - n. 1) One who greatly enjoys learning the details of a
computer system and how to stretch their capabilities (as opposed to
REAL USERS who learn only the minimum amount necessary). 2) One who
programs enthusiastically, rather than just theorizing about it. 3)
One capable of appreciating HACK VALUE. 4) An expert of any kind 5) A
malicious or inquisitive meddler (in the case of a 'system hacker' or a
'password hacker').

inc it up - (also 'incing') v. Specifically related to studying,
reading, or learning ML. Derives from the 65-- series ML instruction
INCrement a value; i.e. increase it.

jock - n. Programmer characterized by the large, cumbersome,
brute-force programs he/she writes. The programs may work, but slowly,
inelegantly, or in an ugly way.

kludge - (kloog) 1) n. Clever programming trick, most often to fix a
bug. Efficient, but maybe unclear. 2) v. To insert a kludge into a
program (to fix a bug or add a feature).

magic - adj. Something as yet unexplained or too complex to imagine.

M&M's - n. Mental and Midget; i.e. Mental Midget. Uncomplimentary
term applied most often to 'system hackers' who intrude for disruptive
or destructive purposes (like to crash BBS's).

misfeature - n. A FEATURE that eventually turns out to be more trouble
than it was worth, possibly because it is inadequate for a new user or
situation that has evolved. Misfeatures are different from bugs or
side-effects in that they are often more basic to the program design
and, at one time, were carefully planned.

moby - 1) adj. Immense, complex, or impressive. 2) n. Total size of
a computers address space.

mode - n. A general state. Examples: DAY MODE - state a person is in
when s/he is working days and sleeping nights.

mumble - interjection. Said when the correct response is too
complicated to put into words or has not been thought out. Can
indicate a reluctance to enter a long discussion.

mumblage - n. The subject matter of one's mumbling. Replaces 'all
that stuff'.

nop around (or nopping) - v. Hanging out; not doing much; not
programming. Derives from the 65-- series ML instruction code 'NOP'
(No OPeration).

obie (or o.b.) - n. Derives from a pun with the word 'OverByte'.
Usually relates to a ML routine that doesn't work because of some
small mistake, possibly an incorrect addressing mode or even a typing
error. Most often one or two bytes wrong.

patch - 1) n. Piece of code intended as a quick-and-dirty remedy to a
BUG or MISFEATURE. 2) v. To fix something temporarily; insert a patch
into a piece of code; make the main program machine-specific.

punt - v. To give up; decide not to do.

rave - v. 1) To persist in discussing something. 2) To speak
authoritatively about that which one knows very little. 3) To
proselytize.

real user - n. A commercial user; a non-hacker who uses computer
applications only.

Real World, The - n. 1) Places where programs have only business
applications. 2) Institutions such as IBM. 3) The location of
non-programmers and non-programming activity. The first two
definitions are uncomplimentary; the third is not.

Right Thing, The - n. that which is obviously the appropriate thing to
use, do, say, etc.

rude - (rood or roo-day) adj. Programs badly written or functionally
poor.

sacred - adj. Reserved for the exclusive use of something. Usually
refers to memory location or register that shouldn't be used because
what is stored there must not change.

slurp - v. To read a large data file into memory before using or
processing data.

smart - adj. Said of a program (or something) that does THE RIGHT
THING.

SMOP - n. An acronym for a 'Small Matter Of Programming'. A piece of
code that would not at all be hard to write, but would take a very long
time because of its size. Not worth the trouble.

snail mail - n. Mail sent via Post Office, rather than electronically.

software rot - n. Hypothetical disease that causes working programs to
stop working when unused for a period of time.

tense - adj. Of programs, very clever and efficient. A tense
programmer produces tense code.

vanilla - adj. Standard, usual, or ordinary FLAVOR.

zero - v. 1) To set a bit or variable to zero. 2) To erase, or
discard all data from.

zorch - v. 1) To move quickly. 2) Influences. 3) Energy or ability.

No Text Icons

If you would like your desktop Icons to have no text underneath then try this tweak:

Right click the icon and select "Rename"



Now hold the "Alt" key and type "255" and hit Enter

NOTE : It may only work with the keypad numbers and not the number keys on top of the keyboard.

There are a lot of PC users that know little about "Spyware", "Mal-ware", "hijackers", "Dialers" & many more. This will help you avoid pop-ups, spammers and all those baddies.

What is spy-ware?
Spy-ware is Internet jargon for Advertising Supported software (Ad-ware). It is a way for shareware authors to make money from a product, other than by selling it to the users. There are several large media companies that offer them to place banner ads in their products in exchange for a portion of the revenue from banner sales. This way, you don't have to pay for the software and the developers are still getting paid. If you find the banners annoying, there is usually an option to remove them, by paying the regular licensing fee.


Known spywares
There are thousands out there, new ones are added to the list everyday. But here are a few:
Alexa, Aureate/Radiate, BargainBuddy, ClickTillUWin, Conducent Timesink, Cydoor, Comet Cursor, eZula/KaZaa Toptext, Flashpoint/Flashtrack, Flyswat, Gator, GoHip, Hotbar, ISTbar, Lions Pride Enterprises/Blazing Logic/Trek Blue, Lop (C2Media), Mattel Brodcast, Morpheus, NewDotNet, Realplayer, Songspy, Xupiter, Web3000, WebHancer, Windows Messenger Service.

How to check if a program has spyware?
The is this Little site that keeps a database of programs that are known to install spyware.

Check Here: http://www.spywareguide.com/product_search.php

If you would like to block pop-ups (IE Pop-ups).
There tons of different types out there, but these are the 2 best, i think.

Try: Google Toolbar (http://toolbar.google.com/) This program is Free
Try: AdMuncher (http://www.admuncher.com) This program is Shareware

If you want to remove the "spyware" try these.
Try: Lavasoft Ad-Aware (http://www.lavasoftusa.com/) This program is Free
Info: Ad-aware is a multi spyware removal utility, that scans your memory, registry and hard drives for known spyware components and lets you remove them. The included backup-manager lets you reinstall a backup, offers and multi language support.

Try: Spybot-S&D (http://www.safer-networking.org/) This program is Free
Info: Detects and removes spyware of different kinds (dialers, loggers, trojans, user tracks) from your computer. Blocks ActiveX downloads, tracking cookies and other threats. Over 10,000 detection files and entries. Provides detailed information about found problems.

Try: BPS Spyware and Adware Remover (http://www.bulletproofsoft.com/spyware-remover.html) This program is Shareware
Info: Adware, spyware, trackware and big brotherware removal utility with multi-language support. It scans your memory, registry and drives for known spyware and lets you remove them. Displays a list and lets you select the items you'd like to remove.

Try: Spy Sweeper v2.2 (http://www.webroot.com/wb/products/spysweeper/index.php) This program is Shareware
Info: Detects and removes spyware of different kinds (dialers, loggers, trojans, user tracks) from your computer.
The best scanner out there, and updated all the time.

Try: HijackThis 1.97.7 (http://www.spywareinfo.com/~merijn/downloads.html) This program is Freeware
Info: HijackThis is a tool, that lists all installed browser add-on, buttons, startup items and allows you to inspect them, and optionally remove selected items.


If you would like to prevent "spyware" being install.
Try: SpywareBlaster 2.6.1 (http://www.wilderssecurity.net/spywareblaster.html) This program is Free
Info: SpywareBlaster doesn`t scan and clean for so-called spyware, but prevents it from being installed in the first place. It achieves this by disabling the CLSIDs of popular spyware ActiveX controls, and also prevents the installation of any of them via a webpage.

Try: SpywareGuard 2.2 (http://www.wilderssecurity.net/spywareguard.html) This program is Free
Info: SpywareGuard provides a real-time protection solution against so-called spyware. It works similar to an anti-virus program, by scanning EXE and CAB files on access and alerting you if known spyware is detected.

Try: XP-AntiSpy (http://www.xp-antispy.org/) This program is Free
Info: XP-AntiSpy is a small utility to quickly disable some built-in update and authentication features in WindowsXP that may rise security or privacy concerns in some people.

Try: SpySites (http://camtech2000.net/Pages/SpySites_Prog...ml#SpySitesFree) This program is Free
Info: SpySites allows you to manage the Internet Explorer Restricted Zone settings and easily add entries from a database of 1500+ sites that are known to use advertising tracking methods or attempt to install third party software.

If you would like more Information about "spyware".
Check these sites.
http://www.spychecker.com/
http://www.spywareguide.com/
http://www.cexx.org/adware.htm
http://www.theinfomaniac.net/infomaniac/co...rsSpyware.shtml
http://www.thiefware.com/links/
http://simplythebest.net/info/spyware.html

Usefull tools...
Try: Stop Windows Messenger Spam 1.10 (http://www.jester2k.pwp.blueyonder.co.uk/j...r2ksoftware.htm) This program is Free
Info: "Stop Windows Messenger Spam" stops this Service from running and halts the spammers ability to send you these messages.

----------------------------------------------------------------------------
All these softwares will help remove and prevent evil spammers and spywares attacking your PC. I myself recommend getting "spyblaster" "s&d spybot" "spy sweeper" & "admuncher" to protect your PC. A weekly scan is also recommended

Free Virus Scan
Scan for spyware, malware and keyloggers in addition to viruses, worms and trojans. New threats and annoyances are created faster than any individual can keep up with.
http://defender.veloz.com// - 15k


Finding . is a Click Away at 2020Search.com
Having trouble finding what you re looking for on: .? 2020Search will instantly provide you with the result you re looking for by drawing on some of the best search engines the Internet has to offer. Your result is a click away!
http://www.2020search.com// - 43k


Download the BrowserVillage Toolbar.
Customize your Browser! Eliminate Pop-up ads before they start, Quick and easy access to the Web, and much more. Click Here to Install Now!
http://www.browservillage.com/ - 36k

Setting Up A Ftp:


Well, since many of us have always wondered this, here it is. Long and drawn out. Also, before attempting this, realize one thing; You will have to give up your time, effort, bandwidth, and security to have a quality ftp server.
That being said, here it goes. First of all, find out if your IP (Internet Protocol) is static (not changing) or dynamic (changes everytime you log on). To do this, first consider the fact if you have a dial up modem. If you do, chances are about 999 999 out of 1 000 000 that your IP is dynamic. To make it static, just go to a place like h*tp://www.myftp.org/ to register for a static ip address.



You'll then need to get your IP. This can be done by doing this:
Going to Start -> Run -> winipcfg or www.ask.com and asking 'What is my IP?'

After doing so, you'll need to download an FTP server client. Personally, I'd recommend G6 FTP Server, Serv-U FTPor Bullitproof v2.15 all three of which are extremely reliable, and the norm of the ftp world.
You can download them on this site: h*tp://www.liaokai.com/softw_en/d_index.htm

First, you'll have to set up your ftp. For this guide, I will use step-by-step instructions for G6. First, you'll have to go into 'Setup -> General'. From here, type in your port # (default is 21). I recommend something unique, or something a bit larger (ex: 3069). If you want to, check the number of max users (this sets the amount of simultaneous maximum users on your server at once performing actions - The more on at once, the slower the connection and vice versa).

The below options are then chooseable:
-Launch with windows
-Activate FTP Server on Start-up
-Put into tray on startup
-Allow multiple instances
-Show "Loading..." status at startup
-Scan drive(s) at startup
-Confirm exit

You can do what you want with these, as they are pretty self explanatory. The scan drive feature is nice, as is the 2nd and the last option. From here, click the 'options' text on the left column.

To protect your server, you should check 'login check' and 'password check', 'Show relative path (a must!)', and any other options you feel you'll need. After doing so, click the 'advanced' text in the left column. You should then leave the buffer size on the default (unless of course you know what you're doing ), and then allow the type of ftp you want.

Uploading and downloading is usually good, but it's up to you if you want to allow uploads and/or downloads. For the server priority, that will determine how much conventional memory will be used and how much 'effort' will go into making your server run smoothly.

Anti-hammering is also good, as it prevents people from slowing down your speed. From here, click 'Log Options' from the left column. If you would like to see and record every single command and clutter up your screen, leave the defaults.

But, if you would like to see what is going on with the lowest possible space taken, click 'Screen' in the top column. You should then check off 'Log successful logins', and all of the options in the client directry, except 'Log directory changes'. After doing so, click 'Ok' in the bottom left corner.

You will then have to go into 'Setup -> User Accounts' (or ctrl & u). From here, you should click on the right most column, and right click. Choose 'Add', and choose the username(s) you would like people to have access to.

After giving a name (ex: themoonlanding), you will have to give them a set password in the bottom column (ex: wasfaked). For the 'Home IP' directory, (if you registered with a static server, check 'All IP Homes'. If your IP is static by default, choose your IP from the list. You will then have to right click in the very center column, and choose 'Add'.

From here, you will have to set the directory you want the people to have access to. After choosing the directory, I suggest you choose the options 'Read', 'List', and 'Subdirs', unless of course you know what you're doing . After doing so, make an 'upload' folder in the directory, and choose to 'add' this folder seperately to the center column. Choose 'write', 'append', 'make', 'list', and 'subdirs'. This will allow them to upload only to specific folders (your upload folder).

Now click on 'Miscellaneous' from the left column. Choose 'enable account', your time-out (how long it takes for people to remain idle before you automatically kick them off), the maximum number of users for this name, the maximum number of connections allowed simultaneously for one ip address, show relative path (a must!), and any other things at the bottom you'd like to have. Now click 'Ok'.
**Requested**


From this main menu, click the little boxing glove icon in the top corner, and right click and unchoose the hit-o-meter for both uploads and downloads (with this you can monitor IP activity). Now click the lightning bolt, and your server is now up and running.

Post your ftp info, like this:

213.10.93.141 (or something else, such as: 'f*p://example.getmyip.com')

User: *** (The username of the client)

Pass: *** (The password)

Port: *** (The port number you chose)

So make a FTP and join the FTP section


Listing The Contents Of A Ftp:

Listing the content of a FTP is very simple.
You will need FTP Content Maker, which can be downloaded from here:
ht*p://www.etplanet.com/download/application/FTP%20Content%20Maker%201.02.zip

1. Put in the IP of the server. Do not put "ftp://" or a "/" because it will not work if you do so.
2. Put in the port. If the port is the default number, 21, you do not have to enter it.
3. Put in the username and password in the appropriate fields. If the login is anonymous, you do not have to enter it.
4. If you want to list a specific directory of the FTP, place it in the directory field. Otherwise, do not enter anything in the directory field.
5. Click "Take the List!"
6. After the list has been taken, click the UBB output tab, and copy and paste to wherever you want it.


If FTP Content Maker is not working, it is probably because the server does not utilize Serv-U Software.

If you get this error message:
StatusCode = 550
LastResponse was : 'Unable to open local file test-ftp'
Error = 550 (Unable to open local file test-ftp)
Error = Unable to open local file test-ftp = 550
Close and restart FTP Content Maker, then try again.




error messages:

110 Restart marker reply. In this case, the text is exact and not left to the particular implementation; it must read: MARK yyyy = mmmm Where yyyy is User-process data stream marker, and mmmm server's equivalent marker (note the spaces between markers and "=").
120 Service ready in nnn minutes.
125 Data connection already open; transfer starting.
150 File status okay; about to open data connection.
200 Command okay.
202 Command not implemented, superfluous at this site.
211 System status, or system help reply.
212 Directory status.
213 File status.
214 Help message. On how to use the server or the meaning of a particular non-standard command. This reply is useful only to the human user.
215 NAME system type. Where NAME is an official system name from the list in the Assigned Numbers document.
220 Service ready for new user.
221 Service closing control connection. Logged out if appropriate.
225 Data connection open; no transfer in progress.
226 Closing data connection. Requested file action successful (for example, file transfer or file abort).
227 Entering Passive Mode (h1,h2,h3,h4,p1,p2).
230 User logged in, proceed.
250 Requested file action okay, completed.
257 "PATHNAME" created.
331 User name okay, need password.
332 Need account for login.
350 Requested file action pending further information.
421 Too many users logged to the same account
425 Can't open data connection.
426 Connection closed; transfer aborted.
450 Requested file action not taken. File unavailable (e.g., file busy).
451 Requested action aborted: local error in processing.
452 Requested action not taken. Insufficient storage space in system.
500 Syntax error, command unrecognized. This may include errors such as command line too long.
501 Syntax error in parameters or arguments.
502 Command not implemented.
503 Bad sequence of commands.
504 Command not implemented for that parameter.
530 Not logged in.
532 Need account for storing files.
550 Requested action not taken. File unavailable (e.g., file not found, no access).
551 Requested action aborted: page type unknown.
552 Requested file action aborted. Exceeded storage allocation (for current directory or dataset).
553 Requested action not taken. File name not allowed.


Active FTP vs. Passive FTP, a Definitive Explanation

Introduction
One of the most commonly seen questions when dealing with firewalls and other Internet connectivity issues is the difference between active and passive FTP and how best to support either or both of them. Hopefully the following text will help to clear up some of the confusion over how to support FTP in a firewalled environment.

This may not be the definitive explanation, as the title claims, however, I've heard enough good feedback and seen this document linked in enough places to know that quite a few people have found it to be useful. I am always looking for ways to improve things though, and if you find something that is not quite clear or needs more explanation, please let me know! Recent additions to this document include the examples of both active and passive command line FTP sessions. These session examples should help make things a bit clearer. They also provide a nice picture into what goes on behind the scenes during an FTP session. Now, on to the information...



The Basics
FTP is a TCP based service exclusively. There is no UDP component to FTP. FTP is an unusual service in that it utilizes two ports, a 'data' port and a 'command' port (also known as the control port). Traditionally these are port 21 for the command port and port 20 for the data port. The confusion begins however, when we find that depending on the mode, the data port is not always on port 20.



Active FTP
In active mode FTP the client connects from a random unprivileged port (N > 1024) to the FTP server's command port, port 21. Then, the client starts listening to port N+1 and sends the FTP command PORT N+1 to the FTP server. The server will then connect back to the client's specified data port from its local data port, which is port 20.

From the server-side firewall's standpoint, to support active mode FTP the following communication channels need to be opened:

FTP server's port 21 from anywhere (Client initiates connection)
FTP server's port 21 to ports > 1024 (Server responds to client's control port)
FTP server's port 20 to ports > 1024 (Server initiates data connection to client's data port)
FTP server's port 20 from ports > 1024 (Client sends ACKs to server's data port)


In step 1, the client's command port contacts the server's command port and sends the command PORT 1027. The server then sends an ACK back to the client's command port in step 2. In step 3 the server initiates a connection on its local data port to the data port the client specified earlier. Finally, the client sends an ACK back as shown in step 4.

The main problem with active mode FTP actually falls on the client side. The FTP client doesn't make the actual connection to the data port of the server--it simply tells the server what port it is listening on and the server connects back to the specified port on the client. From the client side firewall this appears to be an outside system initiating a connection to an internal client--something that is usually blocked.



Active FTP Example
Below is an actual example of an active FTP session. The only things that have been changed are the server names, IP addresses, and user names. In this example an FTP session is initiated from testbox1.slacksite.com (192.168.150.80), a linux box running the standard FTP command line client, to testbox2.slacksite.com (192.168.150.90), a linux box running ProFTPd 1.2.2RC2. The debugging (-d) flag is used with the FTP client to show what is going on behind the scenes. Everything in red is the debugging output which shows the actual FTP commands being sent to the server and the responses generated from those commands. Normal server output is shown in black, and user input is in bold.

There are a few interesting things to consider about this dialog. Notice that when the PORT command is issued, it specifies a port on the client (192.168.150.80) system, rather than the server. We will see the opposite behavior when we use passive FTP. While we are on the subject, a quick note about the format of the PORT command. As you can see in the example below it is formatted as a series of six numbers separated by commas. The first four octets are the IP address while the second two octets comprise the port that will be used for the data connection. To find the actual port multiply the fifth octet by 256 and then add the sixth octet to the total. Thus in the example below the port number is ( (14*256) + 178), or 3762. A quick check with netstat should confirm this information.

testbox1: {/home/p-t/slacker/public_html} % ftp -d testbox2
Connected to testbox2.slacksite.com.
220 testbox2.slacksite.com FTP server ready.
Name (testbox2:slacker): slacker
---> USER slacker
331 Password required for slacker.
Password: TmpPass
---> PASS XXXX
230 User slacker logged in.
---> SYST
215 UNIX Type: L8
Remote system type is UNIX.
Using binary mode to transfer files.
ftp> ls
ftp: setsockopt (ignored): Permission denied
---> PORT 192,168,150,80,14,178
200 PORT command successful.
---> LIST
150 Opening ASCII mode data connection for file list.
drwx------ 3 slacker users 104 Jul 27 01:45 public_html
226 Transfer complete.
ftp> quit
---> QUIT
221 Goodbye.


Passive FTP
In order to resolve the issue of the server initiating the connection to the client a different method for FTP connections was developed. This was known as passive mode, or PASV, after the command used by the client to tell the server it is in passive mode.

In passive mode FTP the client initiates both connections to the server, solving the problem of firewalls filtering the incoming data port connection to the client from the server. When opening an FTP connection, the client opens two random unprivileged ports locally (N > 1024 and N+1). The first port contacts the server on port 21, but instead of then issuing a PORT command and allowing the server to connect back to its data port, the client will issue the PASV command. The result of this is that the server then opens a random unprivileged port (P > 1024) and sends the PORT P command back to the client. The client then initiates the connection from port N+1 to port P on the server to transfer data.

From the server-side firewall's standpoint, to support passive mode FTP the following communication channels need to be opened:

FTP server's port 21 from anywhere (Client initiates connection)
FTP server's port 21 to ports > 1024 (Server responds to client's control port)
FTP server's ports > 1024 from anywhere (Client initiates data connection to random port specified by server)
FTP server's ports > 1024 to remote ports > 1024 (Server sends ACKs (and data) to client's data port)



In step 1, the client contacts the server on the command port and issues the PASV command. The server then replies in step 2 with PORT 2024, telling the client which port it is listening to for the data connection. In step 3 the client then initiates the data connection from its data port to the specified server data port. Finally, the server sends back an ACK in step 4 to the client's data port.

While passive mode FTP solves many of the problems from the client side, it opens up a whole range of problems on the server side. The biggest issue is the need to allow any remote connection to high numbered ports on the server. Fortunately, many FTP daemons, including the popular WU-FTPD allow the administrator to specify a range of ports which the FTP server will use. See Appendix 1 for more information.

The second issue involves supporting and troubleshooting clients which do (or do not) support passive mode. As an example, the command line FTP utility provided with Solaris does not support passive mode, necessitating a third-party FTP client, such as ncftp.

With the massive popularity of the World Wide Web, many people prefer to use their web browser as an FTP client. Most browsers only support passive mode when accessing ftp:// URLs. This can either be good or bad depending on what the servers and firewalls are configured to support.



Passive FTP Example
Below is an actual example of a passive FTP session. The only things that have been changed are the server names, IP addresses, and user names. In this example an FTP session is initiated from testbox1.slacksite.com (192.168.150.80), a linux box running the standard FTP command line client, to testbox2.slacksite.com (192.168.150.90), a linux box running ProFTPd 1.2.2RC2. The debugging (-d) flag is used with the FTP client to show what is going on behind the scenes. Everything in red is the debugging output which shows the actual FTP commands being sent to the server and the responses generated from those commands. Normal server output is shown in black, and user input is in bold.

Notice the difference in the PORT command in this example as opposed to the active FTP example. Here, we see a port being opened on the server (192.168.150.90) system, rather than the client. See the discussion about the format of the PORT command above, in the Active FTP Example section.

testbox1: {/home/p-t/slacker/public_html} % ftp -d testbox2
Connected to testbox2.slacksite.com.
220 testbox2.slacksite.com FTP server ready.
Name (testbox2:slacker): slacker
---> USER slacker
331 Password required for slacker.
Password: TmpPass
---> PASS XXXX
230 User slacker logged in.
---> SYST
215 UNIX Type: L8
Remote system type is UNIX.
Using binary mode to transfer files.
ftp> passive
Passive mode on.
ftp> ls
ftp: setsockopt (ignored): Permission denied
---> PASV
227 Entering Passive Mode (192,168,150,90,195,149).
---> LIST
150 Opening ASCII mode data connection for file list
drwx------ 3 slacker users 104 Jul 27 01:45 public_html
226 Transfer complete.
ftp> quit
---> QUIT
221 Goodbye.


Summary
The following chart should help admins remember how each FTP mode works:

Active FTP :
command : client >1024 -> server 21
data : client >1024 <- server 20

Passive FTP :
command : client >1024 -> server 21
data : client >1024 -> server >1024

A quick summary of the pros and cons of active vs. passive FTP is also in order:

Active FTP is beneficial to the FTP server admin, but detrimental to the client side admin. The FTP server attempts to make connections to random high ports on the client, which would almost certainly be blocked by a firewall on the client side. Passive FTP is beneficial to the client, but detrimental to the FTP server admin. The client will make both connections to the server, but one of them will be to a random high port, which would almost certainly be blocked by a firewall on the server side.

Luckily, there is somewhat of a compromise. Since admins running FTP servers will need to make their servers accessible to the greatest number of clients, they will almost certainly need to support passive FTP. The exposure of high level ports on the server can be minimized by specifying a limited port range for the FTP server to use. Thus, everything except for this range of ports can be firewalled on the server side. While this doesn't eliminate all risk to the server, it decreases it tremendously.