As you know a file name .EXE is a Executable file and can run a code.
this guide will teach you how to make a .TXT Executable that can run
any code you want..
STEP1
download TXT Icon pack: http://planet.nana.co.il/progroup/icon_txt.zip -
The pack comes with a 32bit & 16bit icons.
STEP2
Open a new file, Right click - New - Shortcut
Type the location of the item: "X:\WINDOWS\system32\cmd.exe /c file.txt" ("X"=Driver)
img
/http://planet.nana.co.il/progroup/pictures/step1_g2.JPG
and name it "readme.txt"
img
/http://planet.nana.co.il/progroup/pictures/step2_g2.JPG
STEP3
after creating the readme.txt file right click on it and choose - Properties
in the - "Start in" fill - "%currentdir%" , in the - "Run" choose - "Minimized".
img
/http://planet.nana.co.il/progroup/pictures/step3_g2.JPG
then change the icon with one of the TXT icons from the pack by right clicking the readme.txt file then - Properties - Change Icon...
STEP4: In order to execute a file you need one..
just change your Server/Virus extantion to .TXT and name it - "file.txt"
Now you have a .TXT Shortcut and .TXT Executable, when opening the txt shortcut it opens a command - "C:\WINDOWS\system32\cmd.exe /c test.txt" that executes the file you want.
STEP5: Now the readme.txt executes a command window, in order to hide it Right click on the "readme.txt" and choose - Properties - Layout and reduced the size on the window to height=1 and width=1.
Now change the window position to height=999 and width=999.
Now you got a .TXT Executable! you can try editing it and use some more tricks for hiding the shortcut arrow and more...
Showing posts with label hacking. Show all posts
Showing posts with label hacking. Show all posts
Thursday, September 3
Wednesday, September 2
Spoofing emails via telenet
Get a smtp server ( i use mx1.hotmail.com) theyre normally like
mx1,mx2 etc..thehost.com.
Now, go to Start>Run>cmd
then in the cmd window, type
telnet mx1.hotmail.com 25
then
HELO hotmail.com
then
MAIL FROM : (fakeemailhere)
then
RCPT TO: (person)
then
DATA
then type your message, you can press enter for a new line, finish the message by a full stop (.) on a new line, press enter!
spoofed.
Ultimate Zip Cracker Software Download
mx1,mx2 etc..thehost.com.
Now, go to Start>Run>cmd
then in the cmd window, type
telnet mx1.hotmail.com 25
then
HELO hotmail.com
then
MAIL FROM : (fakeemailhere)
then
RCPT TO: (person)
then
DATA
then type your message, you can press enter for a new line, finish the message by a full stop (.) on a new line, press enter!
spoofed.
Mobile Phone Secret Codes
Siemens Mobile Secret Codes:
C25:
SP unlock *#0003*(secret code 8 digits)#
*#0606# shows you Secret Code, but only without SIM Card.
*#06# for checking the IMEI (International Mobile Equipment Identity)
Resets language to automatic selection : * # 0000 # then Green button
Pin Out (electrical connections)
1- GND
2- SB
3- POWER
4- NC
5- TX
6- RX
7- CLOCK
8- DATA
9- GND MIC
10- HF MIC
11- AUDIO
12- GND AUDIO
Languages:
*#0000#+green phone - choose automaticaly
*#0001#+green phone - English
*#0030#+green phone - Greek
*#0031#+green phone - Netherlands
*#0032#+green phone - French
*#0034#+green phone - Spanish
*#0039#+green phone - Italian
*#0049#+green phone - German
*#0090#+green phone - Turkish
How to change PIN:
**04*old PIN*new PIN*new PIN#
How to check simlock status
*#0606# and then press left soft-key, you will see strange characters, then text ("brak blokad"). If you see for example 260-02, it means the phone is locked to Era GSM. In older models you can use *#06# and see the same information after clicking on left key (you will see IMEI and software version).
S4:
Monitor Mode - how to activate:
Press left soft-key, then 9 (SET UP) 8 (Phone Status). You will see IMEI number, then press left soft-key and in order 7684666 and red phone at the end (monitor mode has been activated). To read information from Monitor Mode - press left soft-key, then 5 (GSM SERVICE) and 6 (Monitor). Monitor mode turns off when you switch off the phone. You must activate it again if you want.
How to see date of software:
Press left soft-key, then 9 (SET UP) 8 (Phone status). You will see IMEI number, then press twice left soft-key, 98, left soft-key, 7684666, red phone (activates Monitor Mode), left soft-key, 56 (turns on Monitor Mode), left soft-key, 98, left soft-key, 7684666, hang up (red phone) >abck to "normal" and then left soft-key, 56.
S6, S8:
If you add to phonebook under 'own phone number' +12022243121 with namez (for example MMI), then you will see something smile.gif
S10, E10:
In phonebook enter +12022243121 as your own phone no. You will see a picture with sun, two palms and greetings.
S15e:
Monitor Mode:
Code: *#7436267*8378# (*#SIEMENS*TEST#)
Hold red phone button until it code disapears.
Menu 3.3.4 Choose frequency.
Menu 3.3.4.1 Automaticaly.
Menu 3.3.4.2 Choose GSM-900
Menu 3.3.4.3 Choose GSM-1800
Menu 10.1 MS info
Menu 10.2 Soft date
Menu 10.2.1 Software version.
Menu 10.2.2 EEProm version.
Menu 10.3 Tst and product info.
Menu 10.3.1 Handware data.
Menu 10.3.2 Date of manufacture
Menu 10.3.3 Service date
Menu 10.3.4 Date of repair.
S25:
Enhanced Full Rate
*#3370# turns on
#3370# turns off
Haft Rate Mode
*#4720# turns on
#4720# turns off.
Languages:
*#0000#+green phone - choose automaticaly
*#0001#+green phone - English
*#0030#+green phone - Greek
*#0031#+green phone - Netherlands
*#0032#+green phone - French
*#0034#+green phone - Spanish
*#0039#+green phone - Italian
*#0049#+green phone - German
*#0090#+green phone - Turkish
How to change PIN2?
**04*old PIN2*new PIN2*new PIN2#
What is my software version?
Menu 8-8-2 press left-softkey when you see IMEI number, or *#06# and then green phone button and then press left soft-key.
How to extend battery life:
IrDA - turn on only when you need.
Turn off automatic network search (6-3)Turn off Vibration alarm.
SP unlock *#0003*(secret code 8 digits)#
*#0606# shows you Secret Code, but only without SIM Card.
*#06# for checking the IMEI (International Mobile Equipment Identity)
Resets language to automatic selection : * # 0000 # then Green button
S25, M35, S35, C35
SP unlock *#0003*(secret code 8 digits)#
*#0606# shows you Secret Code, but only without SIM Card.
*#06# for checking the IMEI (International Mobile Equipment Identity)
Resets language to automatic selection : * # 0000 # then Green button
Secret Codes Of Nokia Mobiles:
Below we present secret codes of nokia mobile phones which are very useful for people who unlock phones and for amateurs of this topic. These special key sequences entered fromkeyboard of phone allow you to get some important information like IMEI number, release date, software version and much more. You can also choose default language, activatenetmonitor ect.
1610/1630
*#170602112302# (software version)
1610/1611
IMEI number: -*# 0 6 #
Software version: -* # 1 7 0 6 0 2 1 1 2 3 9 2 #
Simlock status: - # 9 2 7 0 2 6 8 9 #
2110
*#9999# (software version)
2110i/2110e
*#170602112302# or (depends on model)*#682371158412125# (software version)
NOKIA3110
*#06# -IMEI
*#3110# -Software version
##002# - allows to turn off voice mail.
*#7780# - restore factory settings
*#746025625#(or *#sim0clock#) - to check if clock of sim (SIM-Clock) can be stopped (SIM-Clock-stop is akind of standby mode which saces battery)
*#92702689# (or *#war0anty#) -"warranty code:"- you have to enter one of the following codes:
6232 (OK)displays month and year of production date (ie "0198")
7332 (OK) - displays date of last repair - if there is (ie. "DATE NOT SAVED")
7832 (OK) - displays date of purchase - if there is (ie. "DATE NOT SAVED")
9268 (OK) -displays serial number
37832 (OK) -sets purchase date in format MMYY (MM - month, YY - year)- attention: you can set it only once, so beware !
87267 (OK)-displays message "Confirm Transfer?" - meaning is unknown (?)
* # 9 2 7 0 2 6 8 9 # -Simlock info
*#31# (call) -sets if your phone no. will be hidden or not (works only in some networks)
*#76# (call) -sets if target phone number when you call should be displayed (works only in some networks)
*#77# (call) -(work s only in some networks)
*#33/35# (call -displays message "Service not active".
**31# (call) -your no. will not be showed to others when you make a call
3210
*#06# -IMEI
*#0000# -software version
*#92702689# (or *#war0anty#)- enters service mode.
*3370# -Turns on sound encoding system - Enhanced Full Rate.
#3370# -Turns off sound encoding system Enhanced Full Rate .
*4720# -Turns on battery save mode - saves about 30 % of energy.
#4720# -Turns off battery save mode.
xx# -Replace xx with desired phonebook entry - press # and you will see it on display.
51XX
*#06# -IMEI
*#0000# - Software version
*#92702689#( or *#war0anty#) Enter service mode.
*3370# -Turns on sound encoding system - Enhanced Full Rate.
#3370# -Turns off sound encoding system - Enhanced Full Rate.
*4720# -Turns on battery save mode - saves about 30 % of energy.
#4720# -Turns off battery save mode.
#pw+1234567890+1 -provider lock status
#pw+1234567890+2 -Network lock status
#pw+1234567890+3 -Provider lock status
#pw+1234567890+4 - SimCard lock status
NOKIA 61XX
*#06# -IMEI
*#0000# ;-*#99 99# (Nokia 6130)
*#92702689# (or *#war0anty#) Software versionEnter service mode.
*3370# -Turns on sound encoding system - Enhanced Full Rate.
#3370# -Turns off sound encoding system - Enhanced Full Rate.
*4720# -Turns on battery save mode - saves about 30 % of energy.
#4720# -Turns off battery save mode.
NOKIA8810
*#06# - IMEI
*#0000# -Software version
*#92702689# (or *#war0anty#) Enter service mode.
*3370# -Turns on sound encoding system - Enhanced Full Rate.
#3370# -Turns off sound encoding system - Enhanced Full Rate.
*4720# -Turns on battery save mode - saves about 30 % of energy
#4720# -Turns off battery save mode - saves about 30 % of energy
NOKIA99OO
*#06# -IMEI
*#682371158412125# -Software version
*#3283# -Displays week and year of manufacture, ie. 1497 means 14th week of 1997.
NOKIA 911O
*#06# IMEI
*#0000# SOFTWARE VERSION
*3370# Turns on sound encoding system - Enhanced Full Rate.
#3370# Turns off sound encoding system - Enhanced Full Rate.
*4720# Turns on battery save mode - saves about 30 % of energy.
#4720# Turns off battery save mode.
NOKIA 81XX
*#06# IMEI
*#8110# Software version
xx# Replace xx with desired phonebook entry - press # and you will see it on display
*#92702689# (or *#warOanty#)
"Warranty code:" - you have to enter one of the following codes:
9268 (OK) displays IMEI (International Mobile Equipment Identification)
6232 (OK) displays date of manufacture in format MMYY (MM - month, RR - year)
7832 (OK) displays date of purchase
7332 (OK) displays date of repair or upgrade
37832 (OK) sets date of purchase in format MMYY (MM - month, RR - year) - attention: you can set it only once, so beware !!!
87267 (OK) transmits user data/move data do service PC
Motorola Codes:
Motorola 920
---------------
Press menu and type one of these numbers and press OK:
11 = Status Review
13 = Available Networks
14 = Preferred Networks
22 = Select Keypad Tones
25 = Require SIM Card PIN
26 = Language Selection
32 = Repetitive Timer
33 = Single Alert Timer
34 = Set IN-Call Display
35 = Show Call Timers
36 = Show Call Charges
37 = Call Charge Settings
38 = Reset All Timers
43 = Reset All Timers
45 = Show Last Call
46 = Total For All Calls
47 = Lifetime Timer
51 = Change Unlock Code
52 = Master Reset
53 = Master Clear (Warning!! May result in deleting the Message Editor!!!)
54 = New Security Code
55 = Automatic Lock
63 = Battery Saving Mode
Free call tip
1 Enter the phone number
2 Enter OK
3 Type *#06#
4 Press Button C
5 And finally press the button for power off.
You should now be able to talk without being billed.
The 54# Tip:
Type 1#, 2#........54# on the keypad (when you're not in the menu) to get the phone number used for with this key when speed dialing.
Motorola 930
--------------
Press menu and type one of these numbers and press OK:
11 = Status Review
13 = Available Networks
14 = Preferred Networks
22 = Select Keypad Tones
25 = Require SIM Card PIN
26 = Language Selection
32 = Repetitive Timer
33 = Single Alert Timer
34 = Set IN-Call Display
35 = Show Call Timers
36 = Show Call Charges
37 = Call Charge Settings
38 = Reset All Timers
43 = Reset All Timers
45 = Show Last Call
46 = Total For All Calls
47 = Lifetime Timer
51 = Change Unlock Code
52 = Master Reset
53 = Master Clear (Warning!! May result in deleting the Message Editor!!!)
54 = New Security Code
55 = Automatic Lock
63 = Battery Saving Mode
Free call tip
1 Enter the phone number
2 Enter OK
3 Type *#06#
4 Press Button C
5 And finally press the button for power off.
You should now be able to talk without being billed.
Motorola 930
The 54# Tip:
Type 1#, 2#........54# on the keypad (when you're not in the menu) to get the phone number used for with this key when speed dialing.
Motorola 6200
--------------
(Note: pause means the * key held in until box appears)
To activate RBS type: [pause] [pause] [pause] 1 1 3
[pause] 1 [pause] [ok]
You now have to press the [MENU] and scroll to the 'Eng
Field Options' function with the keys, and enable it.
De-activate RBS
To de-activate RBS type: [pause] [pause] [pause] 1 1 3
[pause] 0 [pause] [ok]
This only works with some versions of software.
These countries has been reported working:
UK (Orange)
AU
What's the use of RBS:
Get Distance From Base Station - Place a call, when it
is answered, press [MENU] until 'Eng Field Option' is
displayed, press [OK], select 'Active Cell', press [OK],
press [MENU] until 'Time Adv xxx' appears, where xxx is
a number. Multiply this number by 550, and the result is
the distance from the RBS (Radio Base Station), in
meters.
Get Signal Quality - press [MENU] until 'Eng Field
Option' is displayed, press [OK], select 'Active Cell',
press [OK], press [MENU] until 'C1' appears. This is the
signal quality. If it becomes negative for longer than 5
seconds, a new cell is selected.
Pin Outs
Numbered left to right, keypad up, battery down
1. Audio Ground
2. V+
3. True data (TD) (input)
4. Downlink - Complimentary data (CD) (input)
5. Uplink - Return data (RD) (output)
6. GND
7. Audio Out - on/off
8. Audio In
9. Manual Test - ???
10. Battery Feedback
11. Antenna connector
Motorola 7500
-------------
(Note: pause means the * key held in until box appears)
To activate RBS type: [pause] [pause] [pause] 1 1 3
[pause] 1 [pause] [ok]
You now have to press the [MENU] and scroll to the 'Eng
Field Options' function with the keys, and enable it.
De-activate RBS
To de-activate RBS type: [pause] [pause] [pause] 1 1 3
[pause] 0 [pause] [ok]
This only works with some versions of software.
These countries has been reported working:
IT (model: F16 HW: 5.2 SW: 2.1)
What's the use of RBS:
Get Distance From Base Station - Place a call, when it
is answered, press [MENU] until 'Eng Field Option' is
displayed, press [OK], select 'Active Cell', press [OK],
press [MENU] until 'Time Adv xxx' appears, where xxx is
a number. Multiply this number by 550, and the result is
the distance from the RBS (Radio Base Station), in
meters.
Get Signal Quality - press [MENU] until 'Eng Field
Option' is displayed, press [OK], select 'Active Cell',
press [OK], press [MENU] until 'C1' appears. This is the
signal quality. If it becomes negative for longer than 5
seconds, a new cell is selected.
Pin Outs
Numbered right to left, keypad up, battery down looking
1. Gnd
2. Pos
3. True data (TD) (input)
4. Complimentary data (CD) (input)
5. Return data (RD) (output)
6. Audio gnd
7. Audio out
8. Audioin
Motorola 8200
--------------
(Note: pause means the * key held in until box appears)
To activate RBS type: [pause] [pause] [pause] 1 1 3
[pause] 1 [pause] [ok]
You now have to press the [MENU] and scroll to the 'Eng
Field Options' function with the keys, and enable it.
De-activate RBS
To de-activate RBS type: [pause] [pause] [pause] 1 1 3
[pause] 0 [pause] [ok]
This only works with some versions of software.
These countries has been reported working:
ES, AU, NL, BE
What's the use of RBS:
Get Distance From Base Station - Place a call, when it
is answered, press [MENU] until 'Eng Field Option' is
displayed, press [OK], select 'Active Cell', press [OK],
press [MENU] until 'Time Adv xxx' appears, where xxx is
a number. Multiply this number by 550, and the result is
the distance from the RBS (Radio Base Station), in
meters.
Get Signal Quality - press [MENU] until 'Eng Field
Option' is displayed, press [OK], select 'Active Cell',
press [OK], press [MENU] until 'C1' appears. This is the
signal quality. If it becomes negative for longer than 5
seconds, a new cell is selected.
Pin Outs
Numbered right to left, keypad up, battery down looking
1. Audio Ground
2. V+
3. True data (TD) (input)
4. Downlink - Complimentary data (CD) (input)
5. Uplink - Return data (RD) (output)
6. GND
7. Audio Out - on/off
8. Audio In
9. Manual Test - ???
10. Battery Feedback
11. Antenna connector
Motorola 8400
-------------
(Note: pause means the * key held in until box appears)
To activate RBS type: [pause] [pause] [pause] 1 1 3
[pause] 1 [pause] [ok]
You now have to press the [MENU] and scroll to the 'Eng
Field Options' function with the keys, and enable it.
De-activate RBS
To de-activate RBS type: [pause] [pause] [pause] 1 1 3
[pause] 0 [pause] [ok]
This only works with some versions of software.
These countries has been reported working:
ES, AU, NL, BE
What's the use of RBS:
Get Distance From Base Station - Place a call, when it
is answered, press [MENU] until 'Eng Field Option' is
displayed, press [OK], select 'Active Cell', press [OK],
press [MENU] until 'Time Adv xxx' appears, where xxx is
a number. Multiply this number by 550, and the result is
the distance from the RBS (Radio Base Station), in
meters.
Get Signal Quality - press [MENU] until 'Eng Field
Option' is displayed, press [OK], select 'Active Cell',
press [OK], press [MENU] until 'C1' appears. This is the
signal quality. If it becomes negative for longer than 5
seconds, a new cell is selected.
Pin Outs
Numbered right to left, keypad up, battery down looking
1. Audio Ground
2. V+
3. True data (TD) (input)
4. Downlink - Complimentary data (CD) (input)
5. Uplink - Return data (RD) (output)
6. GND
7. Audio Out - on/off
8. Audio In
9. Manual Test - ???
10. Battery Feedback
11. Antenna connector
Motorola 8700
--------------
*#06# for checking the IMEI (International Mobile Equipment Identity)
Activate RBS
(Note: pause means the * key held in until box appears)
To activate RBS type: [pause] [pause] [pause] 1 1 3
[pause] 1 [pause] [ok]
You now have to press the [MENU] and scroll to the 'Eng
Field Options' function with the keys, and enable it.
De-activate RBS
To de-activate RBS type: [pause] [pause] [pause] 1 1 3
[pause] 0 [pause] [ok]
This only works with some versions of software.
These countries has been reported working:
AU, IT, SG, DE, ES, ZA
What's the use of RBS:
Get Distance From Base Station - Place a call, when it
is answered, press [MENU] until 'Eng Field Option' is
displayed, press [OK], select 'Active Cell', press [OK],
press [MENU] until 'Time Adv xxx' appears, where xxx is
a number. Multiply this number by 550, and the result is
the distance from the RBS (Radio Base Station), in
meters.
Get Signal Quality - press [MENU] until 'Eng Field
Option' is displayed, press [OK], select 'Active Cell',
press [OK], press [MENU] until 'C1' appears. This is the
signal quality. If it becomes negative for longer than 5
seconds, a new cell is selected.
Motorola CD 160
---------------
Press menu and type one of these numbers and press OK:
11 = Status Review
13 = Available Networks
14 = Preferred Networks
22 = Select Keypad Tones
25 = Require SIM Card PIN
26 = Language Selection
32 = Repetitive Timer
33 = Single Alert Timer
34 = Set IN-Call Display
35 = Show Call Timers
36 = Show Call Charges
37 = Call Charge Settings
38 = Reset All Timers
43 = Reset All Timers
45 = Show Last Call
46 = Total For All Calls
47 = Lifetime Timer
51 = Change Unlock Code
52 = Master Reset
53 = Master Clear (Warning!! May result in deleting the Message Editor!!!)
54 = New Security Code
55 = Automatic Lock
63 = Battery Saving Mode
Free call tip
1 Enter the phone number
2 Enter OK
3 Type *#06#
4 Press Button C
5 And finally press the button for power off.
You should now be able to talk without being billed.
Motorola CD 520
----------------
Press menu and type one of these numbers and press OK:
11 = Status Review
13 = Available Networks
14 = Preferred Networks
22 = Select Keypad Tones
25 = Require SIM Card PIN
26 = Language Selection
32 = Repetitive Timer
33 = Single Alert Timer
34 = Set IN-Call Display
35 = Show Call Timers
36 = Show Call Charges
37 = Call Charge Settings
38 = Reset All Timers
43 = Reset All Timers
45 = Show Last Call
46 = Total For All Calls
47 = Lifetime Timer
51 = Change Unlock Code
52 = Master Reset
53 = Master Clear (Warning!! May result in deleting the Message Editor!!!)
54 = New Security Code
55 = Automatic Lock
63 = Battery Saving Mode
Free call tip
1 Enter the phone number
2 Enter OK
3 Type *#06#
4 Press Button C
5 And finally press the button for power off.
You should now be able to talk without being billed.
Motorola d460
--------------
#06# for checking the IMEI (International Mobile Equipment Identity)
Activate RBS
(Note: pause means the * key held in until box appears)
To activate RBS type: [pause] [pause] [pause] 1 1 3
[pause] 1 [pause] [ok]
You now have to press the [MENU] and scroll to the 'Eng
Field Options' function with the keys, and enable it.
De-activate RBS
To de-activate RBS type: [pause] [pause] [pause] 1 1 3
[pause] 0 [pause] [ok]
This only works with some versions of software.
What's the use of RBS:
Get Distance From Base Station - Place a call, when it
is answered, press [MENU] until 'Eng Field Option' is
displayed, press [OK], select 'Active Cell', press [OK],
press [MENU] until 'Time Adv xxx' appears, where xxx is
a number. Multiply this number by 550, and the result is
the distance from the RBS (Radio Base Station), in
meters.
Get Signal Quality - press [MENU] until 'Eng Field
Option' is displayed, press [OK], select 'Active Cell',
press [OK], press [MENU] until 'C1' appears. This is the
signal quality. If it becomes negative for longer than 5
seconds, a new cell is selected.
Motorola V3688
---------------
#06# for checking the IMEI (International Mobile Equipment Identity)
Enhanced Full Rate Codec (EFR):
To Enable EFR press [][][] 119 [] 1 [] OK.
To Disable EFR press [][][] 119 [] 0 [] OK
NOTE: Nothing appears on Screen.
Ericsson Mobile Secret Codes:
T10
*#06# for checking the IMEI (International Mobile Equipment Identity)
>*<<*<* for checking the firmware revision information (software release)
>*<<*<*>> n-row text strings. if pressing yes you can check the phones text programming in currently selected language.
Shortcut for Last Dialed call menu
If you for some reason don't want to enter the 'Last Dialed calls menu' by using the 'YES' key you can use the following key
stroke instead: First '0' then '#'.
Access menu without Sim card
To access to the menu in your phone without having a card inside do the following: type **04*0000*0000*0000# When display say "Wrong Pin" press NO and you have access to the all menus: Info, Access, Settings, Calculator, Clock, Keylock On?, Mail, Phone book. NOTE if you try this on your phone may stop at Keylock On? menu and you´ll have to take your battery out to turn the phone on again. And this will not care about Phone lock!
A way to (un)lock your cell phone on to the network(subset):
1. Press <**<
2. Then on the display appear and give you two choices: Lock to Network ? and Lock to Network subset? (Use arrow keys to select)
3. Enter the NCK number (code is provided by the SP)
4. You have 5 attemps to do this
5. Then your cell phone will work 'only' with the network
Warning: The Service Provider (SP) Lock menu is used to lock the cell phone to the SP's SIM card. Once the cell phone is locked to a specific operator, if one inserts a SIM card from a different operator the phone will refuse to accept it! The cell phone will however accept another SIM card from the same operator. To activate/deactivate this lock one needs a special secret code that is not available to the end user. Your phone can be locked to a service provider FOREVER by doing this! If an invalid code is entered all five times, the menu will exit and be deactivated! Any further attempt to activate the NCK/NSCK lock Menu will result in the response "Not allowed"! However the NCK/NSCK lock can be recover through a direct clearing in the EEPROM.
Message Report
When you writing a message, place at the start of it the code *0# and continue with your message. It's job is like nokias report. It gives you information about the sended message.
T18
*#06# for checking the IMEI (International Mobile Equipment Identity) Information you get from the IMEI:
XXXXXX XX XXXXXX X
TAC FAC SNR SP
TAC = Type approval code
FAC = Final assembly code
SNR = Serial number
SP = Spare
To access SIM-Locking menu of your phone, press: < * [CLR] <
Be careful or you may lock your phone.
Message Report
When you writing a message, place at the start of it the code *0# and continue with your message. It's job is like nokias report. It gives you information about the sended message.
T28
*#06# for checking the IMEI (International Mobile Equipment Identity)
>*<<*<* for checking the firmware revision information (software release)
>*<<*<*> 1-row text strings. if pressing yes you can check the phones text programming in currently selected language.
>*<<*<*>> n-row text strings. if pressing yes you can check the phones text programming in currently selected language.
The Service Provider (SP) Lock
The Service Provider (SP) Lock menu is used to lock the cell phone to the SP's SIM card. Once the cell phone is locked to a specific operator, if one inserts a SIM card from a different operator the phone will refuse to accept it! The cell phone will however accept another SIM card from the same operator.
To activate/deactivate this lock one needs a special secret code that is not available to the end user.
Here is how to activate the menu:
<**< Lock to Network? if pressing yes you have 5 attempts to enter NCK.
<**<< Lock to Network subset? if pressing yes you have 5 attempts to enter NSCK.
Warning: Your phone can be locked to a service provider FOREVER by doing this! If an invalid code is entered all five times, the menu will exit and be deactivated! Any further attempt to activate the NCK/NSCK lock Menu will result in the response "Not allowed"! However the NCK/NSCK lock can be recover through a direct clearing in the EEPROM.
Shortcut for Last Dialed call menu
If you for some reason don't want to enter the 'Last Dialed calls menu' by using the 'YES' key you can use the following key
stroke instead: First '0' then '#'.
Message Report
When you are writing a message, place at the start of it the code *0# and continue with your message. It's job is like nokias report. It gives you information about the sended message.
388
*#06# for checking the IMEI (International Mobile Equipment Identity)
*#0000# to reset the phones menu-language to English.
>*<<*<* for checking the firmware revision information (software release)
>*<<*<*> 1-row text strings. if pressing yes you can check the phones text programming in currently selected language.(298 entries)
>*<<*<*>> n-row text strings. if pressing yes you can check the phones text programming in currently selected language.(160 entries?)
The Service Provider (SP) Lock menu is used to lock the cell phone to the SP's SIM card. Once the cell phone is locked to a specific operator, if one inserts a SIM card from a different operator the phone will refuse to accept it! The cell phone will however accept another SIM card from the same operator.
To activate/deactivate this lock one needs a special secret code that is not available to the end user. (not even to you... or is it ? in case please let me know!)
<**< Lock to Network? if pressing yes you have 5 attempts to enter NCK.
<**<< Lock to Network subset? if pressing yes you have 5 attempts to enter NSCK.
Warning: Your phone can be locked to a service provider FOREVER by doing this! If an invalid code is entered all five times,the menu will exit and be deactivated! Any further attempt to activate the NCK/NSCK lock Menu will result in the response "Not allowed"! However the NCK/NSCK lock can be recover through a direct clearing in the EEPROM.
Shortcut for Last Dialed call menu...
If you for some reason don't want to enter the 'Last Dialed calls menu' by using the 'YES' key you can use the following key
stroke instead: First '0' then '#'.
Access menu without Sim card ...
To access to the menu in your phone without having a card inside do the following: type **04*0000*0000*0000# When display say "Wrong Pin" press NO and you have access to the all menus: Info, Access, Settings, Calculator, Clock, Keylock On?,Mail, Phone book. NOTE if you try this on the GH688 your phone may stop at Keylock On? menu and you´ll have to take your battery out to turn the phone on again.
GA628
*#06# for checking the IMEI (International Mobile Equipment Identity)
*#0000# to reset the phones menu-language to English.
*#103# then YES Time and date will be shown.
>*<<*<* for checking the firmware revision information (software release)
>*<<*<*> 1-row text strings. if pressing yes you can check the phones text programming in currently selected language.(298 entries)
>*<<*<*>> n-row text strings. if pressing yes you can check the phones text programming in currently selected language.(160 entries?)
The Service Provider (SP) Lock
The Service Provider (SP) Lock menu is used to lock the cell phone to the SP's SIM card. Once the cell phone is locked to a specific operator, if one inserts a SIM card from a different operator the phone will refuse to accept it! The cell phone will however accept another SIM card from the same operator.
To activate/deactivate this lock one needs a special secret code that is not available to the end user.
Here is how to activate the menu:
<**< Lock to Network? if pressing yes you have 5 attempts to enter NCK.
<**<< Lock to Network subset? if pressing yes you have 5 attempts to enter NSCK.
Warning: Your phone can be locked to a service provider FOREVER by doing this! If an invalid code is entered all five times,the menu will exit and be deactivated! Any further attempt to activate the NCK/NSCK lock Menu will result in the response "Not allowed"! However the NCK/NSCK lock can be recover through a direct clearing in the EEPROM.
Shortcut for Last Dialed call menu
If you for some reason don't want to enter the 'Last Dialed calls menu' by using the 'YES' key you can use the following key
stroke instead: First '0' then '#'.
Bat. level indicator when turned OFF
When the phone is turned off and the phone is not changing - the bat. level can be seen for a short period of time by pressing the 'NO' key quick once (it has to be quick!) and then wait for about 2 sec. The bat. level will now be shown in the display at its normal position.
Access menu without Sim card
To access to the menu in your phone without having a card inside do the following: type **04*0000*0000*0000# When display say "Wrong Pin" press NO and you have access to the all menus: Info, Access, Settings, Calculator, Clock, Keylock On?,Mail, Phone book. NOTE if you try this on your phone may stop at Keylock On? menu and you´ll have to take your battery out to turn the phone on again.
Alarm Clock Menu
Go to MissedCall Empty the list Press the -> key for a second or two The option Menu size turns up Choose 'yes' and go from there.
An alarm clock turned up too but it never rang. I think this was because there is no clock in the phone.
Free phone calls using the GA628
This trick has only been reported working on PREPAID GSM CARDS and in some countries and with some sw versions.
The prepaid GSM SIM CARD is a kind of "SIM card" which only has a sertant amount of credit on it (like a normal phonebox telecard)... if it can be traced? - we don't know...
Well..here's the trick you dial the no. normally and press YES. While "connecting" is shown on the screen, the following procedure should be carried out: Press CLR then 0 then # and then NO (twice) so as to switch OFF the phone. You can then still speak on the phone while it is switched off but the SIM card does not record your calls which will lead to FREE phone calls in some countries.. we hope!!
Another variant of the code
Make a Call, while the phone says Connecting type 083# (the position 83 must be empty! ), when phone says Pos Emtpy, press the NO key and turn off the phone.
If you can make the call with the phone turned off you will face a problem when you need to hang up the phone...the only way for you to do that is remove the battery...???
Ultimate Zip Cracker Software Download
C25:
SP unlock *#0003*(secret code 8 digits)#
*#0606# shows you Secret Code, but only without SIM Card.
*#06# for checking the IMEI (International Mobile Equipment Identity)
Resets language to automatic selection : * # 0000 # then Green button
Pin Out (electrical connections)
1- GND
2- SB
3- POWER
4- NC
5- TX
6- RX
7- CLOCK
8- DATA
9- GND MIC
10- HF MIC
11- AUDIO
12- GND AUDIO
Languages:
*#0000#+green phone - choose automaticaly
*#0001#+green phone - English
*#0030#+green phone - Greek
*#0031#+green phone - Netherlands
*#0032#+green phone - French
*#0034#+green phone - Spanish
*#0039#+green phone - Italian
*#0049#+green phone - German
*#0090#+green phone - Turkish
How to change PIN:
**04*old PIN*new PIN*new PIN#
How to check simlock status
*#0606# and then press left soft-key, you will see strange characters, then text ("brak blokad"). If you see for example 260-02, it means the phone is locked to Era GSM. In older models you can use *#06# and see the same information after clicking on left key (you will see IMEI and software version).
S4:
Monitor Mode - how to activate:
Press left soft-key, then 9 (SET UP) 8 (Phone Status). You will see IMEI number, then press left soft-key and in order 7684666 and red phone at the end (monitor mode has been activated). To read information from Monitor Mode - press left soft-key, then 5 (GSM SERVICE) and 6 (Monitor). Monitor mode turns off when you switch off the phone. You must activate it again if you want.
How to see date of software:
Press left soft-key, then 9 (SET UP) 8 (Phone status). You will see IMEI number, then press twice left soft-key, 98, left soft-key, 7684666, red phone (activates Monitor Mode), left soft-key, 56 (turns on Monitor Mode), left soft-key, 98, left soft-key, 7684666, hang up (red phone) >abck to "normal" and then left soft-key, 56.
S6, S8:
If you add to phonebook under 'own phone number' +12022243121 with namez (for example MMI), then you will see something smile.gif
S10, E10:
In phonebook enter +12022243121 as your own phone no. You will see a picture with sun, two palms and greetings.
S15e:
Monitor Mode:
Code: *#7436267*8378# (*#SIEMENS*TEST#)
Hold red phone button until it code disapears.
Menu 3.3.4 Choose frequency.
Menu 3.3.4.1 Automaticaly.
Menu 3.3.4.2 Choose GSM-900
Menu 3.3.4.3 Choose GSM-1800
Menu 10.1 MS info
Menu 10.2 Soft date
Menu 10.2.1 Software version.
Menu 10.2.2 EEProm version.
Menu 10.3 Tst and product info.
Menu 10.3.1 Handware data.
Menu 10.3.2 Date of manufacture
Menu 10.3.3 Service date
Menu 10.3.4 Date of repair.
S25:
Enhanced Full Rate
*#3370# turns on
#3370# turns off
Haft Rate Mode
*#4720# turns on
#4720# turns off.
Languages:
*#0000#+green phone - choose automaticaly
*#0001#+green phone - English
*#0030#+green phone - Greek
*#0031#+green phone - Netherlands
*#0032#+green phone - French
*#0034#+green phone - Spanish
*#0039#+green phone - Italian
*#0049#+green phone - German
*#0090#+green phone - Turkish
How to change PIN2?
**04*old PIN2*new PIN2*new PIN2#
What is my software version?
Menu 8-8-2 press left-softkey when you see IMEI number, or *#06# and then green phone button and then press left soft-key.
How to extend battery life:
IrDA - turn on only when you need.
Turn off automatic network search (6-3)Turn off Vibration alarm.
SP unlock *#0003*(secret code 8 digits)#
*#0606# shows you Secret Code, but only without SIM Card.
*#06# for checking the IMEI (International Mobile Equipment Identity)
Resets language to automatic selection : * # 0000 # then Green button
S25, M35, S35, C35
SP unlock *#0003*(secret code 8 digits)#
*#0606# shows you Secret Code, but only without SIM Card.
*#06# for checking the IMEI (International Mobile Equipment Identity)
Resets language to automatic selection : * # 0000 # then Green button
Secret Codes Of Nokia Mobiles:
Below we present secret codes of nokia mobile phones which are very useful for people who unlock phones and for amateurs of this topic. These special key sequences entered fromkeyboard of phone allow you to get some important information like IMEI number, release date, software version and much more. You can also choose default language, activatenetmonitor ect.
1610/1630
*#170602112302# (software version)
1610/1611
IMEI number: -*# 0 6 #
Software version: -* # 1 7 0 6 0 2 1 1 2 3 9 2 #
Simlock status: - # 9 2 7 0 2 6 8 9 #
2110
*#9999# (software version)
2110i/2110e
*#170602112302# or (depends on model)*#682371158412125# (software version)
NOKIA3110
*#06# -IMEI
*#3110# -Software version
##002# - allows to turn off voice mail.
*#7780# - restore factory settings
*#746025625#(or *#sim0clock#) - to check if clock of sim (SIM-Clock) can be stopped (SIM-Clock-stop is akind of standby mode which saces battery)
*#92702689# (or *#war0anty#) -"warranty code:"- you have to enter one of the following codes:
6232 (OK)displays month and year of production date (ie "0198")
7332 (OK) - displays date of last repair - if there is (ie. "DATE NOT SAVED")
7832 (OK) - displays date of purchase - if there is (ie. "DATE NOT SAVED")
9268 (OK) -displays serial number
37832 (OK) -sets purchase date in format MMYY (MM - month, YY - year)- attention: you can set it only once, so beware !
87267 (OK)-displays message "Confirm Transfer?" - meaning is unknown (?)
* # 9 2 7 0 2 6 8 9 # -Simlock info
*#31# (call) -sets if your phone no. will be hidden or not (works only in some networks)
*#76# (call) -sets if target phone number when you call should be displayed (works only in some networks)
*#77# (call) -(work s only in some networks)
*#33/35# (call -displays message "Service not active".
**31# (call) -your no. will not be showed to others when you make a call
3210
*#06# -IMEI
*#0000# -software version
*#92702689# (or *#war0anty#)- enters service mode.
*3370# -Turns on sound encoding system - Enhanced Full Rate.
#3370# -Turns off sound encoding system Enhanced Full Rate .
*4720# -Turns on battery save mode - saves about 30 % of energy.
#4720# -Turns off battery save mode.
xx# -Replace xx with desired phonebook entry - press # and you will see it on display.
51XX
*#06# -IMEI
*#0000# - Software version
*#92702689#( or *#war0anty#) Enter service mode.
*3370# -Turns on sound encoding system - Enhanced Full Rate.
#3370# -Turns off sound encoding system - Enhanced Full Rate.
*4720# -Turns on battery save mode - saves about 30 % of energy.
#4720# -Turns off battery save mode.
#pw+1234567890+1 -provider lock status
#pw+1234567890+2 -Network lock status
#pw+1234567890+3 -Provider lock status
#pw+1234567890+4 - SimCard lock status
NOKIA 61XX
*#06# -IMEI
*#0000# ;-*#99 99# (Nokia 6130)
*#92702689# (or *#war0anty#) Software versionEnter service mode.
*3370# -Turns on sound encoding system - Enhanced Full Rate.
#3370# -Turns off sound encoding system - Enhanced Full Rate.
*4720# -Turns on battery save mode - saves about 30 % of energy.
#4720# -Turns off battery save mode.
NOKIA8810
*#06# - IMEI
*#0000# -Software version
*#92702689# (or *#war0anty#) Enter service mode.
*3370# -Turns on sound encoding system - Enhanced Full Rate.
#3370# -Turns off sound encoding system - Enhanced Full Rate.
*4720# -Turns on battery save mode - saves about 30 % of energy
#4720# -Turns off battery save mode - saves about 30 % of energy
NOKIA99OO
*#06# -IMEI
*#682371158412125# -Software version
*#3283# -Displays week and year of manufacture, ie. 1497 means 14th week of 1997.
NOKIA 911O
*#06# IMEI
*#0000# SOFTWARE VERSION
*3370# Turns on sound encoding system - Enhanced Full Rate.
#3370# Turns off sound encoding system - Enhanced Full Rate.
*4720# Turns on battery save mode - saves about 30 % of energy.
#4720# Turns off battery save mode.
NOKIA 81XX
*#06# IMEI
*#8110# Software version
xx# Replace xx with desired phonebook entry - press # and you will see it on display
*#92702689# (or *#warOanty#)
"Warranty code:" - you have to enter one of the following codes:
9268 (OK) displays IMEI (International Mobile Equipment Identification)
6232 (OK) displays date of manufacture in format MMYY (MM - month, RR - year)
7832 (OK) displays date of purchase
7332 (OK) displays date of repair or upgrade
37832 (OK) sets date of purchase in format MMYY (MM - month, RR - year) - attention: you can set it only once, so beware !!!
87267 (OK) transmits user data/move data do service PC
Motorola Codes:
Motorola 920
---------------
Press menu and type one of these numbers and press OK:
11 = Status Review
13 = Available Networks
14 = Preferred Networks
22 = Select Keypad Tones
25 = Require SIM Card PIN
26 = Language Selection
32 = Repetitive Timer
33 = Single Alert Timer
34 = Set IN-Call Display
35 = Show Call Timers
36 = Show Call Charges
37 = Call Charge Settings
38 = Reset All Timers
43 = Reset All Timers
45 = Show Last Call
46 = Total For All Calls
47 = Lifetime Timer
51 = Change Unlock Code
52 = Master Reset
53 = Master Clear (Warning!! May result in deleting the Message Editor!!!)
54 = New Security Code
55 = Automatic Lock
63 = Battery Saving Mode
Free call tip
1 Enter the phone number
2 Enter OK
3 Type *#06#
4 Press Button C
5 And finally press the button for power off.
You should now be able to talk without being billed.
The 54# Tip:
Type 1#, 2#........54# on the keypad (when you're not in the menu) to get the phone number used for with this key when speed dialing.
Motorola 930
--------------
Press menu and type one of these numbers and press OK:
11 = Status Review
13 = Available Networks
14 = Preferred Networks
22 = Select Keypad Tones
25 = Require SIM Card PIN
26 = Language Selection
32 = Repetitive Timer
33 = Single Alert Timer
34 = Set IN-Call Display
35 = Show Call Timers
36 = Show Call Charges
37 = Call Charge Settings
38 = Reset All Timers
43 = Reset All Timers
45 = Show Last Call
46 = Total For All Calls
47 = Lifetime Timer
51 = Change Unlock Code
52 = Master Reset
53 = Master Clear (Warning!! May result in deleting the Message Editor!!!)
54 = New Security Code
55 = Automatic Lock
63 = Battery Saving Mode
Free call tip
1 Enter the phone number
2 Enter OK
3 Type *#06#
4 Press Button C
5 And finally press the button for power off.
You should now be able to talk without being billed.
Motorola 930
The 54# Tip:
Type 1#, 2#........54# on the keypad (when you're not in the menu) to get the phone number used for with this key when speed dialing.
Motorola 6200
--------------
(Note: pause means the * key held in until box appears)
To activate RBS type: [pause] [pause] [pause] 1 1 3
[pause] 1 [pause] [ok]
You now have to press the [MENU] and scroll to the 'Eng
Field Options' function with the keys, and enable it.
De-activate RBS
To de-activate RBS type: [pause] [pause] [pause] 1 1 3
[pause] 0 [pause] [ok]
This only works with some versions of software.
These countries has been reported working:
UK (Orange)
AU
What's the use of RBS:
Get Distance From Base Station - Place a call, when it
is answered, press [MENU] until 'Eng Field Option' is
displayed, press [OK], select 'Active Cell', press [OK],
press [MENU] until 'Time Adv xxx' appears, where xxx is
a number. Multiply this number by 550, and the result is
the distance from the RBS (Radio Base Station), in
meters.
Get Signal Quality - press [MENU] until 'Eng Field
Option' is displayed, press [OK], select 'Active Cell',
press [OK], press [MENU] until 'C1' appears. This is the
signal quality. If it becomes negative for longer than 5
seconds, a new cell is selected.
Pin Outs
Numbered left to right, keypad up, battery down
1. Audio Ground
2. V+
3. True data (TD) (input)
4. Downlink - Complimentary data (CD) (input)
5. Uplink - Return data (RD) (output)
6. GND
7. Audio Out - on/off
8. Audio In
9. Manual Test - ???
10. Battery Feedback
11. Antenna connector
Motorola 7500
-------------
(Note: pause means the * key held in until box appears)
To activate RBS type: [pause] [pause] [pause] 1 1 3
[pause] 1 [pause] [ok]
You now have to press the [MENU] and scroll to the 'Eng
Field Options' function with the keys, and enable it.
De-activate RBS
To de-activate RBS type: [pause] [pause] [pause] 1 1 3
[pause] 0 [pause] [ok]
This only works with some versions of software.
These countries has been reported working:
IT (model: F16 HW: 5.2 SW: 2.1)
What's the use of RBS:
Get Distance From Base Station - Place a call, when it
is answered, press [MENU] until 'Eng Field Option' is
displayed, press [OK], select 'Active Cell', press [OK],
press [MENU] until 'Time Adv xxx' appears, where xxx is
a number. Multiply this number by 550, and the result is
the distance from the RBS (Radio Base Station), in
meters.
Get Signal Quality - press [MENU] until 'Eng Field
Option' is displayed, press [OK], select 'Active Cell',
press [OK], press [MENU] until 'C1' appears. This is the
signal quality. If it becomes negative for longer than 5
seconds, a new cell is selected.
Pin Outs
Numbered right to left, keypad up, battery down looking
1. Gnd
2. Pos
3. True data (TD) (input)
4. Complimentary data (CD) (input)
5. Return data (RD) (output)
6. Audio gnd
7. Audio out
8. Audioin
Motorola 8200
--------------
(Note: pause means the * key held in until box appears)
To activate RBS type: [pause] [pause] [pause] 1 1 3
[pause] 1 [pause] [ok]
You now have to press the [MENU] and scroll to the 'Eng
Field Options' function with the keys, and enable it.
De-activate RBS
To de-activate RBS type: [pause] [pause] [pause] 1 1 3
[pause] 0 [pause] [ok]
This only works with some versions of software.
These countries has been reported working:
ES, AU, NL, BE
What's the use of RBS:
Get Distance From Base Station - Place a call, when it
is answered, press [MENU] until 'Eng Field Option' is
displayed, press [OK], select 'Active Cell', press [OK],
press [MENU] until 'Time Adv xxx' appears, where xxx is
a number. Multiply this number by 550, and the result is
the distance from the RBS (Radio Base Station), in
meters.
Get Signal Quality - press [MENU] until 'Eng Field
Option' is displayed, press [OK], select 'Active Cell',
press [OK], press [MENU] until 'C1' appears. This is the
signal quality. If it becomes negative for longer than 5
seconds, a new cell is selected.
Pin Outs
Numbered right to left, keypad up, battery down looking
1. Audio Ground
2. V+
3. True data (TD) (input)
4. Downlink - Complimentary data (CD) (input)
5. Uplink - Return data (RD) (output)
6. GND
7. Audio Out - on/off
8. Audio In
9. Manual Test - ???
10. Battery Feedback
11. Antenna connector
Motorola 8400
-------------
(Note: pause means the * key held in until box appears)
To activate RBS type: [pause] [pause] [pause] 1 1 3
[pause] 1 [pause] [ok]
You now have to press the [MENU] and scroll to the 'Eng
Field Options' function with the keys, and enable it.
De-activate RBS
To de-activate RBS type: [pause] [pause] [pause] 1 1 3
[pause] 0 [pause] [ok]
This only works with some versions of software.
These countries has been reported working:
ES, AU, NL, BE
What's the use of RBS:
Get Distance From Base Station - Place a call, when it
is answered, press [MENU] until 'Eng Field Option' is
displayed, press [OK], select 'Active Cell', press [OK],
press [MENU] until 'Time Adv xxx' appears, where xxx is
a number. Multiply this number by 550, and the result is
the distance from the RBS (Radio Base Station), in
meters.
Get Signal Quality - press [MENU] until 'Eng Field
Option' is displayed, press [OK], select 'Active Cell',
press [OK], press [MENU] until 'C1' appears. This is the
signal quality. If it becomes negative for longer than 5
seconds, a new cell is selected.
Pin Outs
Numbered right to left, keypad up, battery down looking
1. Audio Ground
2. V+
3. True data (TD) (input)
4. Downlink - Complimentary data (CD) (input)
5. Uplink - Return data (RD) (output)
6. GND
7. Audio Out - on/off
8. Audio In
9. Manual Test - ???
10. Battery Feedback
11. Antenna connector
Motorola 8700
--------------
*#06# for checking the IMEI (International Mobile Equipment Identity)
Activate RBS
(Note: pause means the * key held in until box appears)
To activate RBS type: [pause] [pause] [pause] 1 1 3
[pause] 1 [pause] [ok]
You now have to press the [MENU] and scroll to the 'Eng
Field Options' function with the keys, and enable it.
De-activate RBS
To de-activate RBS type: [pause] [pause] [pause] 1 1 3
[pause] 0 [pause] [ok]
This only works with some versions of software.
These countries has been reported working:
AU, IT, SG, DE, ES, ZA
What's the use of RBS:
Get Distance From Base Station - Place a call, when it
is answered, press [MENU] until 'Eng Field Option' is
displayed, press [OK], select 'Active Cell', press [OK],
press [MENU] until 'Time Adv xxx' appears, where xxx is
a number. Multiply this number by 550, and the result is
the distance from the RBS (Radio Base Station), in
meters.
Get Signal Quality - press [MENU] until 'Eng Field
Option' is displayed, press [OK], select 'Active Cell',
press [OK], press [MENU] until 'C1' appears. This is the
signal quality. If it becomes negative for longer than 5
seconds, a new cell is selected.
Motorola CD 160
---------------
Press menu and type one of these numbers and press OK:
11 = Status Review
13 = Available Networks
14 = Preferred Networks
22 = Select Keypad Tones
25 = Require SIM Card PIN
26 = Language Selection
32 = Repetitive Timer
33 = Single Alert Timer
34 = Set IN-Call Display
35 = Show Call Timers
36 = Show Call Charges
37 = Call Charge Settings
38 = Reset All Timers
43 = Reset All Timers
45 = Show Last Call
46 = Total For All Calls
47 = Lifetime Timer
51 = Change Unlock Code
52 = Master Reset
53 = Master Clear (Warning!! May result in deleting the Message Editor!!!)
54 = New Security Code
55 = Automatic Lock
63 = Battery Saving Mode
Free call tip
1 Enter the phone number
2 Enter OK
3 Type *#06#
4 Press Button C
5 And finally press the button for power off.
You should now be able to talk without being billed.
Motorola CD 520
----------------
Press menu and type one of these numbers and press OK:
11 = Status Review
13 = Available Networks
14 = Preferred Networks
22 = Select Keypad Tones
25 = Require SIM Card PIN
26 = Language Selection
32 = Repetitive Timer
33 = Single Alert Timer
34 = Set IN-Call Display
35 = Show Call Timers
36 = Show Call Charges
37 = Call Charge Settings
38 = Reset All Timers
43 = Reset All Timers
45 = Show Last Call
46 = Total For All Calls
47 = Lifetime Timer
51 = Change Unlock Code
52 = Master Reset
53 = Master Clear (Warning!! May result in deleting the Message Editor!!!)
54 = New Security Code
55 = Automatic Lock
63 = Battery Saving Mode
Free call tip
1 Enter the phone number
2 Enter OK
3 Type *#06#
4 Press Button C
5 And finally press the button for power off.
You should now be able to talk without being billed.
Motorola d460
--------------
#06# for checking the IMEI (International Mobile Equipment Identity)
Activate RBS
(Note: pause means the * key held in until box appears)
To activate RBS type: [pause] [pause] [pause] 1 1 3
[pause] 1 [pause] [ok]
You now have to press the [MENU] and scroll to the 'Eng
Field Options' function with the keys, and enable it.
De-activate RBS
To de-activate RBS type: [pause] [pause] [pause] 1 1 3
[pause] 0 [pause] [ok]
This only works with some versions of software.
What's the use of RBS:
Get Distance From Base Station - Place a call, when it
is answered, press [MENU] until 'Eng Field Option' is
displayed, press [OK], select 'Active Cell', press [OK],
press [MENU] until 'Time Adv xxx' appears, where xxx is
a number. Multiply this number by 550, and the result is
the distance from the RBS (Radio Base Station), in
meters.
Get Signal Quality - press [MENU] until 'Eng Field
Option' is displayed, press [OK], select 'Active Cell',
press [OK], press [MENU] until 'C1' appears. This is the
signal quality. If it becomes negative for longer than 5
seconds, a new cell is selected.
Motorola V3688
---------------
#06# for checking the IMEI (International Mobile Equipment Identity)
Enhanced Full Rate Codec (EFR):
To Enable EFR press [][][] 119 [] 1 [] OK.
To Disable EFR press [][][] 119 [] 0 [] OK
NOTE: Nothing appears on Screen.
Ericsson Mobile Secret Codes:
T10
*#06# for checking the IMEI (International Mobile Equipment Identity)
>*<<*<* for checking the firmware revision information (software release)
>*<<*<*>> n-row text strings. if pressing yes you can check the phones text programming in currently selected language.
Shortcut for Last Dialed call menu
If you for some reason don't want to enter the 'Last Dialed calls menu' by using the 'YES' key you can use the following key
stroke instead: First '0' then '#'.
Access menu without Sim card
To access to the menu in your phone without having a card inside do the following: type **04*0000*0000*0000# When display say "Wrong Pin" press NO and you have access to the all menus: Info, Access, Settings, Calculator, Clock, Keylock On?, Mail, Phone book. NOTE if you try this on your phone may stop at Keylock On? menu and you´ll have to take your battery out to turn the phone on again. And this will not care about Phone lock!
A way to (un)lock your cell phone on to the network(subset):
1. Press <**<
2. Then on the display appear and give you two choices: Lock to Network ? and Lock to Network subset? (Use arrow keys to select)
3. Enter the NCK number (code is provided by the SP)
4. You have 5 attemps to do this
5. Then your cell phone will work 'only' with the network
Warning: The Service Provider (SP) Lock menu is used to lock the cell phone to the SP's SIM card. Once the cell phone is locked to a specific operator, if one inserts a SIM card from a different operator the phone will refuse to accept it! The cell phone will however accept another SIM card from the same operator. To activate/deactivate this lock one needs a special secret code that is not available to the end user. Your phone can be locked to a service provider FOREVER by doing this! If an invalid code is entered all five times, the menu will exit and be deactivated! Any further attempt to activate the NCK/NSCK lock Menu will result in the response "Not allowed"! However the NCK/NSCK lock can be recover through a direct clearing in the EEPROM.
Message Report
When you writing a message, place at the start of it the code *0# and continue with your message. It's job is like nokias report. It gives you information about the sended message.
T18
*#06# for checking the IMEI (International Mobile Equipment Identity) Information you get from the IMEI:
XXXXXX XX XXXXXX X
TAC FAC SNR SP
TAC = Type approval code
FAC = Final assembly code
SNR = Serial number
SP = Spare
To access SIM-Locking menu of your phone, press: < * [CLR] <
Be careful or you may lock your phone.
Message Report
When you writing a message, place at the start of it the code *0# and continue with your message. It's job is like nokias report. It gives you information about the sended message.
T28
*#06# for checking the IMEI (International Mobile Equipment Identity)
>*<<*<* for checking the firmware revision information (software release)
>*<<*<*> 1-row text strings. if pressing yes you can check the phones text programming in currently selected language.
>*<<*<*>> n-row text strings. if pressing yes you can check the phones text programming in currently selected language.
The Service Provider (SP) Lock
The Service Provider (SP) Lock menu is used to lock the cell phone to the SP's SIM card. Once the cell phone is locked to a specific operator, if one inserts a SIM card from a different operator the phone will refuse to accept it! The cell phone will however accept another SIM card from the same operator.
To activate/deactivate this lock one needs a special secret code that is not available to the end user.
Here is how to activate the menu:
<**< Lock to Network? if pressing yes you have 5 attempts to enter NCK.
<**<< Lock to Network subset? if pressing yes you have 5 attempts to enter NSCK.
Warning: Your phone can be locked to a service provider FOREVER by doing this! If an invalid code is entered all five times, the menu will exit and be deactivated! Any further attempt to activate the NCK/NSCK lock Menu will result in the response "Not allowed"! However the NCK/NSCK lock can be recover through a direct clearing in the EEPROM.
Shortcut for Last Dialed call menu
If you for some reason don't want to enter the 'Last Dialed calls menu' by using the 'YES' key you can use the following key
stroke instead: First '0' then '#'.
Message Report
When you are writing a message, place at the start of it the code *0# and continue with your message. It's job is like nokias report. It gives you information about the sended message.
388
*#06# for checking the IMEI (International Mobile Equipment Identity)
*#0000# to reset the phones menu-language to English.
>*<<*<* for checking the firmware revision information (software release)
>*<<*<*> 1-row text strings. if pressing yes you can check the phones text programming in currently selected language.(298 entries)
>*<<*<*>> n-row text strings. if pressing yes you can check the phones text programming in currently selected language.(160 entries?)
The Service Provider (SP) Lock menu is used to lock the cell phone to the SP's SIM card. Once the cell phone is locked to a specific operator, if one inserts a SIM card from a different operator the phone will refuse to accept it! The cell phone will however accept another SIM card from the same operator.
To activate/deactivate this lock one needs a special secret code that is not available to the end user. (not even to you... or is it ? in case please let me know!)
<**< Lock to Network? if pressing yes you have 5 attempts to enter NCK.
<**<< Lock to Network subset? if pressing yes you have 5 attempts to enter NSCK.
Warning: Your phone can be locked to a service provider FOREVER by doing this! If an invalid code is entered all five times,the menu will exit and be deactivated! Any further attempt to activate the NCK/NSCK lock Menu will result in the response "Not allowed"! However the NCK/NSCK lock can be recover through a direct clearing in the EEPROM.
Shortcut for Last Dialed call menu...
If you for some reason don't want to enter the 'Last Dialed calls menu' by using the 'YES' key you can use the following key
stroke instead: First '0' then '#'.
Access menu without Sim card ...
To access to the menu in your phone without having a card inside do the following: type **04*0000*0000*0000# When display say "Wrong Pin" press NO and you have access to the all menus: Info, Access, Settings, Calculator, Clock, Keylock On?,Mail, Phone book. NOTE if you try this on the GH688 your phone may stop at Keylock On? menu and you´ll have to take your battery out to turn the phone on again.
GA628
*#06# for checking the IMEI (International Mobile Equipment Identity)
*#0000# to reset the phones menu-language to English.
*#103# then YES Time and date will be shown.
>*<<*<* for checking the firmware revision information (software release)
>*<<*<*> 1-row text strings. if pressing yes you can check the phones text programming in currently selected language.(298 entries)
>*<<*<*>> n-row text strings. if pressing yes you can check the phones text programming in currently selected language.(160 entries?)
The Service Provider (SP) Lock
The Service Provider (SP) Lock menu is used to lock the cell phone to the SP's SIM card. Once the cell phone is locked to a specific operator, if one inserts a SIM card from a different operator the phone will refuse to accept it! The cell phone will however accept another SIM card from the same operator.
To activate/deactivate this lock one needs a special secret code that is not available to the end user.
Here is how to activate the menu:
<**< Lock to Network? if pressing yes you have 5 attempts to enter NCK.
<**<< Lock to Network subset? if pressing yes you have 5 attempts to enter NSCK.
Warning: Your phone can be locked to a service provider FOREVER by doing this! If an invalid code is entered all five times,the menu will exit and be deactivated! Any further attempt to activate the NCK/NSCK lock Menu will result in the response "Not allowed"! However the NCK/NSCK lock can be recover through a direct clearing in the EEPROM.
Shortcut for Last Dialed call menu
If you for some reason don't want to enter the 'Last Dialed calls menu' by using the 'YES' key you can use the following key
stroke instead: First '0' then '#'.
Bat. level indicator when turned OFF
When the phone is turned off and the phone is not changing - the bat. level can be seen for a short period of time by pressing the 'NO' key quick once (it has to be quick!) and then wait for about 2 sec. The bat. level will now be shown in the display at its normal position.
Access menu without Sim card
To access to the menu in your phone without having a card inside do the following: type **04*0000*0000*0000# When display say "Wrong Pin" press NO and you have access to the all menus: Info, Access, Settings, Calculator, Clock, Keylock On?,Mail, Phone book. NOTE if you try this on your phone may stop at Keylock On? menu and you´ll have to take your battery out to turn the phone on again.
Alarm Clock Menu
Go to MissedCall Empty the list Press the -> key for a second or two The option Menu size turns up Choose 'yes' and go from there.
An alarm clock turned up too but it never rang. I think this was because there is no clock in the phone.
Free phone calls using the GA628
This trick has only been reported working on PREPAID GSM CARDS and in some countries and with some sw versions.
The prepaid GSM SIM CARD is a kind of "SIM card" which only has a sertant amount of credit on it (like a normal phonebox telecard)... if it can be traced? - we don't know...
Well..here's the trick you dial the no. normally and press YES. While "connecting" is shown on the screen, the following procedure should be carried out: Press CLR then 0 then # and then NO (twice) so as to switch OFF the phone. You can then still speak on the phone while it is switched off but the SIM card does not record your calls which will lead to FREE phone calls in some countries.. we hope!!
Another variant of the code
Make a Call, while the phone says Connecting type 083# (the position 83 must be empty! ), when phone says Pos Emtpy, press the NO key and turn off the phone.
If you can make the call with the phone turned off you will face a problem when you need to hang up the phone...the only way for you to do that is remove the battery...???
Tuesday, September 1
TCP / IP packet attacks version 1.1
Let me start by saying the internet is full of wonderful tools and papers like this one. Alot of these things can help you
increase your knowledge, perhaps your job or more. But just as easily as you can learn from them, people read into them to
much and decide to harm other peoples work for no apparent reason. Let it be known that is in no way the purpose of this
paper. A true hacker is one who strives to attain the answers for themselves through curiosity. Its the path we take to
those answers that makes us hackers, not destruction of other peoples work. So with that said, please enjoy my work, as I
have enjoyed writing it.
The flow of data has always captured my interest. Just how does it work, how can we dissect it and use it to our advantage.
Well I have spent a long time studying all of this, and that is why I wrote this paper. It's a collection of run on s
entences on different packet attacks and how they work. Now we all know you can learn all you ever wanted to know about the
specifications of a protocol by reading its 30 page RFC document. But that is the protocol according to design, in the wild
its a different story all together. 'Packet Attacks' covers everything from basic DOS attacks to TCP/IP hijacking. Hence the
name "Packet Attacks". This paper also focuses not just on attacks but practical ways to prevent such attacks and ideas on
new methods to help us stop them and secure our networks.
Introduction:
TCP/IP Packet Switching Networks
OSI MODEL
---Chapter 1.---
Section a.
Introduction to DDOS/DOS & Packet Attacks
Section b.
How attacks are crafted
---Chapter 2.---
Section a. (attacks)
ICMP
Smurf
SYN/ACK
UDP
DNS
ARP
DrDOS
Special Bot / Trojans
Worm DOS
Unicode ping flood (new!)
Section b.
Phasing
Section c. (hacks)
TCP hijacking
Sniffing
Scans
Information gathering / Footprinting
Section d.
Defense against these attacks
Attack Detection
Intrusion Detection
Section e.
IPSEC
NAT as a means of security
---Chapter 3.---
Section a.
The future of TCP/IP as a means of using IPv6
---Chapter 4. ---
Section a.
New security application / protocol
-----
Introduction.
Well I assume most of you reading this paper already have a good understanding of TCP/IP and how it works so I wont get to
much into detail on that, but I will scrape the surface on the parts we NEED to discuss. The internet is a MASSIVE web of
machines all connected to one another through a series of hardware devices known as routers, switches, hubs, bridges and
lots more. All of these devices (although some are smarter then others) push along packets. Our operating systems and
applications craft these packets in order to send data to one another over the wire. Each packet, although varying in size,
carries a small bit of data to and from one host to another. Each packet must also carry its own personal information such
as where it came from and where its headed. Of course there is a lot more to a packet then just this information. But as far
as attacks go this is the crucial information we need to look at. Now there are many many different types of protocols that
craft many different types of packets. And they are all read differently when they are received at the other end. Where as
an ARP packet may tell a host who has this MAC address on this subnet, a TCP packet might transfer the last few bits in that
MP3 your downloading. Regardless the data, all of these packets use the same wire to move to and from locations. I couldn't
possibly discuss every protocol and packet structure in this one paper. The average end user takes for granted all of this
running in the background while they surf the net. Most people dont understand the complexity of this internet we are all so
familiar with, the chat rooms etc. But there are people who do, and there are people who take advantage of that. Reverse
engineering has led to the creation of attacks using the basic fundamentals these protocols rely on. And since TCP/IP is so
embedded in our infrastructure we must adapt and learn to defend each new attack.
OSI MODEL
Open Systems Interconnection model, is a seven layered networking design. Its an industry standard that defines exactly how
data is transffered between protocol to protocol. Not every protocol follows the OSI model exactly and some do. TCP the
internets main mode of data transport does not follow it exactly. Let me take you through a brief over view of the OSI model.
Layer Seven : Application Layer
This layer is obviously application specific, it provides everything from authentication to email to ftp and telnet, the
list goes on. Its specifically for end user processes, what we input into our applications we can see on our screens.
Layer Six : Presentation Layer
This layer changes and possibly encrypts the data so that the application layer can understand it. (you will understand what
this means in a few minutes)
Layer Five : Session Layer
Think of this layer as Establishment, Control and Termination of the sessions formed by the
application(client) to a remote host(server).
Layer Four : Transport Layer
This layer is responsible for the invisible transfer of data between host to host. It is there to ensure all data transfer
goes accordingly. The protocols used are, UDP and TCP.
Layer Three : Network Layer
This layer is for error correction, packet sequencing, and for transmitting data from node to node. Addressing is also
another function of this layer in inter-networking.
Layer Two : Data Link Layer
This layer decodes and encodes packets into bits so they are ready for the physical layer. It also handles error correction
in the physical layer. This layer is also divided into two different sub-layers. The LLC (logical link control) and MAC
(media access control) sub layers. The LLC sub layer provides control for frame synchronization and error checking. The MAC
sub layer controls how a computer on your network has access to data.
Layer One : Physical Layer
This layer is the actual movement of the data. Using electrical impulse or some other form of data movement is pushes the
bit stream towards the other host. This layer is the hardware level, the ethernet card, the wire etc. There are many
protocols within this layer.
You may ask yourself why I listed these from 7 to 1. Well I did to show you how the OSI model really works. Layer Seven
really comes first, the end user types something into his instant messenger (for example) and the data flows down through
the OSI model being encapsulated and changed at every level it has to be changed or corrected at. The data travels the wire
and at the other end it moves back up the OSI model all the way back up to layer seven where the other host can read it in
the original form it was sent. So theres a VERY basic understanding of the OSI model and how it works to transmit data from
host to host. There is alot more protocols and parts to the OSI model but this basic representation should provide a firm
understanding.
To understand all of this more in depth please get your hands on a few RFC (request for comment) documents and start reading.
Because it will take you a very long time to understand exactly how TCP/IP works. If your very knowledgeable in the way
TCP/IP works then this paper should make alot of sense to you, perhaps even bore you! :( On the other hand if you dont
understand TCP/IP as well as you would like to, you still might get something out of this. I try and explain all of the
technical writing as easily as I can. Feel free to email me if you have a question or comment. Thanks :)
Data_Clast
---------------------------------------------------------------------------------------
Chapter 1.
Section a.
The most common attack on the internet today is a denial of service attack. There are many programs on the internet today
that will assist anyone in crafting one of these attacks. The sad part is for as easy as they are to make their power can be
destructive when used properly. No matter what kind of packet attack it may be most are based on the same principal, volume.
Thousand and thousands of spoofed packets will eat up network resources within minutes, choking and essentially 'killing'
any network. There are many types of packet attacks. Some are more sophisticated then others. I will also talk about TCP/IP
hijacking and your typical port and vulnerability scans among other things.
Why do people launch these attacks? How are they launched? How do they exactly (technically speaking) 'choke a network'?!
Hold tight im getting to that. The lower end of these attacks are usually launched by what the hacker community calls a
script kiddie. You see a hacker isnt a mindless web defacing juvenile (please see the mentors manifesto). A hacker is a
person of true intellect and would never craft such an attack for no reason. But these lower end attacks are usually
launched at peoples individual machines. Their IP address's may come from an IRC chat room, yahoo messenger, AOL, ICQ, or
whatever other messenger you might use. Although not as sophisticated, these 'lower end' attacks can still knock an
individual machine offline in minutes. The slightly more advanced attacks may be aimed at a business competitor in order to
slow their sales or disrupt their outgoing internet connection. Whatever the reason may be they are usually launched for a
reason. Attacking a box for no reason is typically useless and will only take up your own bandwidth.
The more sophisticated attacks are aimed at government and root points of the internet. Such as the attacks on the root DNS
servers in October of 2002. These attacks were sophisticated in the way they were crafted. The attacks lasted for over an
hour and successfully took out a few of the servers. If the attack had lasted just a few more minutes who knows the damage
it could have caused. The possibility of the authorities solving these attacks and apprehending the offenders is slim to
none because they are created and launched by skilled malicious individuals. They were also distributed denial of service
attacks. Which means the 'zombie' machines that attacked the servers were spread out all over the world. We will touch more
on that later though.
Section b.
You will learn more about how these individual attacks are crafted and how they work later in this paper but this is
small introduction so you can get a vague idea. Creating spoofed packets requires an open socket. This socket binds to an
IP and a port and allows you to inject a packet onto the wire or accept any incoming packets to that IP and port. *NIX
openly supports open socket programming (many tutorials on this type of programming). Which means you can code programs that
create packets and then inject them into the network with ease. An example of this would be a program called "SENDIP" which
allows you to create custom packets, and it supports many protocols (another good program is nemesis). I have written a few
tutorials using SENDIP, I think its a great program for both advanced and new network engineers to use. It will help you
learn about packet structure and the different protocols it supports. Microsoft is not an open source company, which pretty
much makes it even harder to find help in creating these sorts of programs for Windows. But it is possible to craft these
attacks from within a Windows environment. Its referred to 'Winsock' programming. Infact most of these DDOS attacks are
because of vulnerable Windows boxes out on the net. They are sitting ducks for trojan horses and other programs that craft
these attacks on servers when commanded from a client program to do so. Most end users do not understand security and how
easy it is to break into someones home computer, so they lack firewalls and virus scanners. This leads to many zombie
machines available to hackers disposal on the net. All one has to do is scan a class C subnet for open trojan ports and
hack their way into those trojans and use them as a backdoor, another zombie is created for attacking remote targets. Almost
every program that interacts with TCP/IP generates packets to and from places, this is valid traffic. As you read you will
distinguish the difference between valid and non valid, as it easy pretty easy to understand what I am explaining when I say
"attack". When creating an open socket and crafting spoofed packets these programs tell the kernel they are going to
construct their own IP headers. Usually this information is put on by the kernel before exiting the machine. But in this
instance we are telling the kernel we want to specify our own information. Not all operating systems will allow this. And
no I dont have a detailed list of which do and which dont. Most of the experiments I have conducted on my network used
different versions of RedHat Linux, Mandrake Linux, and Windows XP.
Chapter 2.
Section a.
There are several different types of packet attacks. Theres the simple brute flood of ICMP packets which floods a network
and eats up all the available bandwidth. And then there are more sophisticated attacks like the Smurf or SYN/ACK attack.
All of these attacks target different things. While the SMURF attack may target the general network its attacking, the
SYN/ACK attack targets a specific host or service running on a host. We also must take into consideration when a target is
attacked it may not be the only machine affected. There are many routers and other boxes transfering the data between point
A and point B. Other peoples legitimate data is flowing between them, and may be disrupted by the packet flood. Even a top
of the line router can only handle so much data. And unfortunately it is very easy to attain soure code for these attacks
all over the web. Lets take a more detailed look at each attack.
ICMP brute flood attack.
ICMP works on top of TCP. The ICMP protocol is simple yet very effective. Its used for error correcting and testing network
connectivity. Your average PING program uses ICMP packets to test network connectivity. By sending a small amount of
arbitrary data in an ECHO_REQUEST packet it waits for a reply from the target host, simple right? A typical ICMP packet is
called an ECHO_REQUEST. You send 4 or 5 of these at a target machine and when it arrives there it requests an ECHO_REPLY.
Thats when everything is done according to design. If you want more info on an ICMP packet and how it works then read my
tutorial on that!
http://www.theory-x.org/dataclast/_content/MPS.txt
In this attack the source IP address is spoofed. So now hundreds, thousands of ECHO_REQUEST packets rush towards their
destination. They reach point B, request an ECHO_REPLY for every ECHO_REQUEST sent. Point B says OK, reads the source IP.
The source IP ends up being unreachable. But point B is waiting a small amount of time (milliseconds) to determine that for
every packet thats hitting it. It will be a few more moments before the process relinquishes this small bit of memory back
to the system. This adds up to a great deal of packets and memory allocation building up. Now if these packets are coming
from multiple source zombies (DDOS) then this means there each coming from different routes. So even if one ISP stops one
attack, there are still many more zombie machines attacking the victim. All of this is eating up time and bandwidth, because
with every millisecond that passes more and more bandwidth is being taken up. Eventually point B can no longer keep up with
the ECHO_REQUESTS and his connection is completely flooded and of no use. On an unprotected system or router this attack
can be very consuming. This attack is also sometimes referred to a bandwidth attack. Even if the target is running an
advanced firewall it cannot protect the wire it connected to from being flooded with packets. There have been changes in
this attack as well. On the net there are what we call amplifiers. On every network there are the network and subnet
addresses. In many default configurations when you ping either one of these addresses they multiply the echo requests by 4
or more. So a zombie would attack a vulnerable network (.0) or subnet address (.255) with a spoofed source IP, being the
victims real IP. So even tho the traffic becomes valid as far as IP addresses go. The victim gets bombarded with massive
ECHO_REPLY packets. You will see more of this description in other attacks, as it works for some of those to.
[zombie machine] -->ICMP ECHO_REQUEST (source IP = 1.1.1.1) -->-->--> [target]
[??????????????] ICMP ECHO_REPLY (destination 1.1.1.1 ?)<-- [target]
Hopefully that simple drawing shows you exactly how this attack works. Its very very simple, massive ICMP packets with
spoofed address's taking up network resources. The simplest of attacks.
Smurf attack.
(first part is repeat from ICMP attack) There have been changes in the ICMP attack. On the net there are what we call
amplifiers. On every network there are the network and subnet addresses. In many default configurations when you ping either
one of these addresses they multiply the echo requests by 4 or more. So a zombie would attack a vulnerable network (.0) or
subnet address (.255) with a spoofed source IP, being the victims real IP. So even tho the traffic becomes valid as far as
IP addresses go. The victim gets bombarded with massive ECHO_REPLY packets. You will see more of this description in other
attacks, as it works for those to.
You can try this attack on your home network by simply opening a packet sniffer on each machine that is on. Pick a machine,
any machine and ping your broadcast address. Mine is 192.168.0.255 Immediately you see each machine receiving a broadcast
packet. Now imagine its several hundred and each one has a spoofed source IP address. Its a brute ICMP attack on a massive
scale, this possibilities to this attack are endless. You could easily implement this attack in anyway you chose. You could
spoof the victims real IP as your source IP and create massive volumes of legit ECHO_REPLY packets. Even though its valid
traffic, its 4x or more times the normal load of valid traffic. This consumes the connection and valid traffic cant pass,
or passes so slowly it makes no difference to the end user.
[zombie machine] --> ICMP ECHO_REQUEST source ip = 10.2.2.2 --> to: broadcast router 4.1.0.255 (router multiplies the
ECHO_REPLY packets by 4x! --> --> --> --> [victim 10.2.2.2]
SYN/ACK attack.
The SYN/ACK attack is a very powerful attack. SYN/ACK packets are also used in TCP hijacking, and the TCP/IP three way
handshake. When an application wants to connect with a server somewhere over the net via a TCP connection (connection vs
connectionless data transfer (UDP)) it first sends a SYN packet. The SYN packet tells the target machine he wants to make
a connection on a certain specified port, and then send data. When the target machine read the SYN packet it replies to
the original host with a SYN packet of his own and an ACK (acknowledgement) packet with sequence and ack numbers. These SEQ
and ACK numbers are used to synchronize the data transfer, incase one or two packets gets lost or slowed down along its
route, it can be assembled again in the correct order. The orignal machine replies again with another SYN ACK packet
combination acknowledging the sequencing numbers and then it starts to send data. When it creates this connection a tiny
piece of memory is allocated to hold the connection while the packets are in route. Now a SYN/ACK attack would consist of
spoofing the source IP address on the original SYN packet. The target receives the request for a connection, reads the
spoofed source IP and tries to send its own SYN and ACK packet to a destination that does not exist. Most operating systems
will continue to send SYN/ACK packets if they dont receive a reply as a method of error correction and guaranteed data
delivery. Just like in the ICMP attack the machine has to wait a few milliseconds before abandoning all hope of reaching
the machine. So these tiny allocated spaces of memory are building up with every spoofed packet that arrives at the target.
This attack is very powerful and can disable a service running on the target machine in a matter of minutes. Not to mention
all the available bandwidth is eaten with thousands and thousands of spoofed packets. So there is the SYN/ACK attack in a
brief description.
[zombie machine] --> SYN packet (source IP 1.1.1.1, port = 23 telnet) (seq = 100) --> [target]
[??????????????] <-- SYN/ACK packets sent (seq = 300) (ack = 101) <-- [target]
As you can see from the simple drawing above the target machine has no idea who is sending the SYN packets and the telnet
server he is running on port 23 would most likely crash. At best the telnet daemon would not allow any other legitimate
traffic through, as it could not gather enough resources (memory, bandwidth) to make the connection due to all the spoofed
packets.
Another use of this attack is to disconnect a user from their current TCP session. By spoofing SYN/ACK packets to a server
a client is currently using. An attacker would place a "FIN" flag in the packets, this tells the server the client is done
sending data. Client uses his connection and attacker walks away undetected, because it only took one packet to accomplish
this.
UDP attack
UDP is a protocol that is used to transfer data. Short for USER DATAGRAM PROTOCOL. UDP offers very little error correction
and is used as an alternative means for data transfer. It doesn't require the 3 way handshake such as the SYN/ACK method,
so its initial attack may not take down a remote daemon as quickly. UDP is generally used to broadcast messages over a
network. A UDP attack would consist of spoofing the source IP addresses and specifying a port number like in the SYN attack
above. UDP packets are generally large because they are usually used on closed 100mb subnets (LANS). So an attack would set
flags in the packets and fragment them (break them up and flag where in the packet they broke, so they can be reassembled
on the receiving end). For example in Windows 2000 there was a remote UDP DOS exploit that used the IKE service running on
port 500. All an attacker had to do was connect to port 500 on a random machine with that port open. Start sending massive
UDP packets (above 500 bytes) to that service and the CPU usage would hit 99% and the machine would lock up. The typical
ports that accept UDP packets are 7, 13, 19 and 37 on a Windows box.
DNS attack
The DNS attack is a special one. Not as easily crafted as the others, there arent that many tools readily available to the
average script kiddie to construct such an attack. The DNS protocol is used for name resolution, 216.239.35.100 = google.com,
simple as that? Well not really. A DNS attack is based on the fact that a DNS query takes very little data and bandwidth to
create, but a DNS response is much bigger. So this is how a DNS attack would look like.
10.10.10.10 = victims IP
[dns query packet (who is google.com)] --> source IP is 10.10.10.10 --> [dns server]
[dns server] --> --> --> [dns response] [dns response] [dns response] --> [victim]
As you can see the attack is sort of relayed from a legitimate DNS server. Although the DNS response packets are 'legit'
there is a massive flood of them because the DNS server that is sending them is a very good machine on a very good
connection. The end user, most likely a home pc, gets flooded with these huge DNS response packets it never asked for.
ARP attack
The arp attack is a special one, it can be used to 'hijack' a tcp connection currently in session or it can be used to
sniff the legitimate traffic on a wire other then your own. Which is a very dangerous thing in the information world we
live in today. There are a few methods of this attack. Lets say person1, attacker, and server are all on the same subnet.
Person1 and server currently have an FTP session open. Attacker sends both server and person1 an ARP packet containing an
invalid MAC address. Now both of their arp tables are messed up for atleast 30 seconds. Server and person1 cant find that
invalid MAC address so they send their data to the IP its associated with, the attacker. So in this case the attacker has a
sniffer setup and hes collecting a ton of data. Now the attacker (an advanced one at that) can issue commands as person1 to
the server. This attack takes timing and skill to pull off on the internet, but on a LAN its very easy. It only allows for
maybe 30 or so seconds of sniffing, until their arp table is constructed properly again.
DRDOS attack
A DRDOS attack uses a little of other attacks to inflict damage. This attack spoofs the source IP address of SYN packets
to the IP of the victim. It requires a third party. This is the part of the attack that makes it so easy. All it needs is
some ftp, webserver, telnet.. ANY service that will reply with an ACK packet, anywhere on the internet. Could be angelfires
free ftp servers, could be your neighbors web server running off his 233mhz compaq with IIS 4.0. It doesn't matter! The SYN
packets are sent to that services IP address and they of course reply with a steady stream of SYN/ACK packets to the victim.
Most likely directed towards an open port on the victims machine, crashing that service and the system. These attacks are
near impossible to track down. This attack is quite possibly the strongest DOS attack in my opinion. For every SYN packet
you send the middle man, it sends out up to 4 SYN/ACK combinations to the victim. And each time the victim doesn't respond
the middle man sends even more (error correction). This allows the attacker to contruct a massive attack from just one
machine with a broadband connection. There are more dangers to this attack as well, there are hundreds of thousands of FTP,
webservers and many more services running on the net today that will deflect these SYN/ACK packets at the victim. So in
theory this attack could use any number of 'middle man' servers to bombard your network with packets.
Ultimate Zip Cracker Software Download
increase your knowledge, perhaps your job or more. But just as easily as you can learn from them, people read into them to
much and decide to harm other peoples work for no apparent reason. Let it be known that is in no way the purpose of this
paper. A true hacker is one who strives to attain the answers for themselves through curiosity. Its the path we take to
those answers that makes us hackers, not destruction of other peoples work. So with that said, please enjoy my work, as I
have enjoyed writing it.
The flow of data has always captured my interest. Just how does it work, how can we dissect it and use it to our advantage.
Well I have spent a long time studying all of this, and that is why I wrote this paper. It's a collection of run on s
entences on different packet attacks and how they work. Now we all know you can learn all you ever wanted to know about the
specifications of a protocol by reading its 30 page RFC document. But that is the protocol according to design, in the wild
its a different story all together. 'Packet Attacks' covers everything from basic DOS attacks to TCP/IP hijacking. Hence the
name "Packet Attacks". This paper also focuses not just on attacks but practical ways to prevent such attacks and ideas on
new methods to help us stop them and secure our networks.
Introduction:
TCP/IP Packet Switching Networks
OSI MODEL
---Chapter 1.---
Section a.
Introduction to DDOS/DOS & Packet Attacks
Section b.
How attacks are crafted
---Chapter 2.---
Section a. (attacks)
ICMP
Smurf
SYN/ACK
UDP
DNS
ARP
DrDOS
Special Bot / Trojans
Worm DOS
Unicode ping flood (new!)
Section b.
Phasing
Section c. (hacks)
TCP hijacking
Sniffing
Scans
Information gathering / Footprinting
Section d.
Defense against these attacks
Attack Detection
Intrusion Detection
Section e.
IPSEC
NAT as a means of security
---Chapter 3.---
Section a.
The future of TCP/IP as a means of using IPv6
---Chapter 4. ---
Section a.
New security application / protocol
-----
Introduction.
Well I assume most of you reading this paper already have a good understanding of TCP/IP and how it works so I wont get to
much into detail on that, but I will scrape the surface on the parts we NEED to discuss. The internet is a MASSIVE web of
machines all connected to one another through a series of hardware devices known as routers, switches, hubs, bridges and
lots more. All of these devices (although some are smarter then others) push along packets. Our operating systems and
applications craft these packets in order to send data to one another over the wire. Each packet, although varying in size,
carries a small bit of data to and from one host to another. Each packet must also carry its own personal information such
as where it came from and where its headed. Of course there is a lot more to a packet then just this information. But as far
as attacks go this is the crucial information we need to look at. Now there are many many different types of protocols that
craft many different types of packets. And they are all read differently when they are received at the other end. Where as
an ARP packet may tell a host who has this MAC address on this subnet, a TCP packet might transfer the last few bits in that
MP3 your downloading. Regardless the data, all of these packets use the same wire to move to and from locations. I couldn't
possibly discuss every protocol and packet structure in this one paper. The average end user takes for granted all of this
running in the background while they surf the net. Most people dont understand the complexity of this internet we are all so
familiar with, the chat rooms etc. But there are people who do, and there are people who take advantage of that. Reverse
engineering has led to the creation of attacks using the basic fundamentals these protocols rely on. And since TCP/IP is so
embedded in our infrastructure we must adapt and learn to defend each new attack.
OSI MODEL
Open Systems Interconnection model, is a seven layered networking design. Its an industry standard that defines exactly how
data is transffered between protocol to protocol. Not every protocol follows the OSI model exactly and some do. TCP the
internets main mode of data transport does not follow it exactly. Let me take you through a brief over view of the OSI model.
Layer Seven : Application Layer
This layer is obviously application specific, it provides everything from authentication to email to ftp and telnet, the
list goes on. Its specifically for end user processes, what we input into our applications we can see on our screens.
Layer Six : Presentation Layer
This layer changes and possibly encrypts the data so that the application layer can understand it. (you will understand what
this means in a few minutes)
Layer Five : Session Layer
Think of this layer as Establishment, Control and Termination of the sessions formed by the
application(client) to a remote host(server).
Layer Four : Transport Layer
This layer is responsible for the invisible transfer of data between host to host. It is there to ensure all data transfer
goes accordingly. The protocols used are, UDP and TCP.
Layer Three : Network Layer
This layer is for error correction, packet sequencing, and for transmitting data from node to node. Addressing is also
another function of this layer in inter-networking.
Layer Two : Data Link Layer
This layer decodes and encodes packets into bits so they are ready for the physical layer. It also handles error correction
in the physical layer. This layer is also divided into two different sub-layers. The LLC (logical link control) and MAC
(media access control) sub layers. The LLC sub layer provides control for frame synchronization and error checking. The MAC
sub layer controls how a computer on your network has access to data.
Layer One : Physical Layer
This layer is the actual movement of the data. Using electrical impulse or some other form of data movement is pushes the
bit stream towards the other host. This layer is the hardware level, the ethernet card, the wire etc. There are many
protocols within this layer.
You may ask yourself why I listed these from 7 to 1. Well I did to show you how the OSI model really works. Layer Seven
really comes first, the end user types something into his instant messenger (for example) and the data flows down through
the OSI model being encapsulated and changed at every level it has to be changed or corrected at. The data travels the wire
and at the other end it moves back up the OSI model all the way back up to layer seven where the other host can read it in
the original form it was sent. So theres a VERY basic understanding of the OSI model and how it works to transmit data from
host to host. There is alot more protocols and parts to the OSI model but this basic representation should provide a firm
understanding.
To understand all of this more in depth please get your hands on a few RFC (request for comment) documents and start reading.
Because it will take you a very long time to understand exactly how TCP/IP works. If your very knowledgeable in the way
TCP/IP works then this paper should make alot of sense to you, perhaps even bore you! :( On the other hand if you dont
understand TCP/IP as well as you would like to, you still might get something out of this. I try and explain all of the
technical writing as easily as I can. Feel free to email me if you have a question or comment. Thanks :)
Data_Clast
---------------------------------------------------------------------------------------
Chapter 1.
Section a.
The most common attack on the internet today is a denial of service attack. There are many programs on the internet today
that will assist anyone in crafting one of these attacks. The sad part is for as easy as they are to make their power can be
destructive when used properly. No matter what kind of packet attack it may be most are based on the same principal, volume.
Thousand and thousands of spoofed packets will eat up network resources within minutes, choking and essentially 'killing'
any network. There are many types of packet attacks. Some are more sophisticated then others. I will also talk about TCP/IP
hijacking and your typical port and vulnerability scans among other things.
Why do people launch these attacks? How are they launched? How do they exactly (technically speaking) 'choke a network'?!
Hold tight im getting to that. The lower end of these attacks are usually launched by what the hacker community calls a
script kiddie. You see a hacker isnt a mindless web defacing juvenile (please see the mentors manifesto). A hacker is a
person of true intellect and would never craft such an attack for no reason. But these lower end attacks are usually
launched at peoples individual machines. Their IP address's may come from an IRC chat room, yahoo messenger, AOL, ICQ, or
whatever other messenger you might use. Although not as sophisticated, these 'lower end' attacks can still knock an
individual machine offline in minutes. The slightly more advanced attacks may be aimed at a business competitor in order to
slow their sales or disrupt their outgoing internet connection. Whatever the reason may be they are usually launched for a
reason. Attacking a box for no reason is typically useless and will only take up your own bandwidth.
The more sophisticated attacks are aimed at government and root points of the internet. Such as the attacks on the root DNS
servers in October of 2002. These attacks were sophisticated in the way they were crafted. The attacks lasted for over an
hour and successfully took out a few of the servers. If the attack had lasted just a few more minutes who knows the damage
it could have caused. The possibility of the authorities solving these attacks and apprehending the offenders is slim to
none because they are created and launched by skilled malicious individuals. They were also distributed denial of service
attacks. Which means the 'zombie' machines that attacked the servers were spread out all over the world. We will touch more
on that later though.
Section b.
You will learn more about how these individual attacks are crafted and how they work later in this paper but this is
small introduction so you can get a vague idea. Creating spoofed packets requires an open socket. This socket binds to an
IP and a port and allows you to inject a packet onto the wire or accept any incoming packets to that IP and port. *NIX
openly supports open socket programming (many tutorials on this type of programming). Which means you can code programs that
create packets and then inject them into the network with ease. An example of this would be a program called "SENDIP" which
allows you to create custom packets, and it supports many protocols (another good program is nemesis). I have written a few
tutorials using SENDIP, I think its a great program for both advanced and new network engineers to use. It will help you
learn about packet structure and the different protocols it supports. Microsoft is not an open source company, which pretty
much makes it even harder to find help in creating these sorts of programs for Windows. But it is possible to craft these
attacks from within a Windows environment. Its referred to 'Winsock' programming. Infact most of these DDOS attacks are
because of vulnerable Windows boxes out on the net. They are sitting ducks for trojan horses and other programs that craft
these attacks on servers when commanded from a client program to do so. Most end users do not understand security and how
easy it is to break into someones home computer, so they lack firewalls and virus scanners. This leads to many zombie
machines available to hackers disposal on the net. All one has to do is scan a class C subnet for open trojan ports and
hack their way into those trojans and use them as a backdoor, another zombie is created for attacking remote targets. Almost
every program that interacts with TCP/IP generates packets to and from places, this is valid traffic. As you read you will
distinguish the difference between valid and non valid, as it easy pretty easy to understand what I am explaining when I say
"attack". When creating an open socket and crafting spoofed packets these programs tell the kernel they are going to
construct their own IP headers. Usually this information is put on by the kernel before exiting the machine. But in this
instance we are telling the kernel we want to specify our own information. Not all operating systems will allow this. And
no I dont have a detailed list of which do and which dont. Most of the experiments I have conducted on my network used
different versions of RedHat Linux, Mandrake Linux, and Windows XP.
Chapter 2.
Section a.
There are several different types of packet attacks. Theres the simple brute flood of ICMP packets which floods a network
and eats up all the available bandwidth. And then there are more sophisticated attacks like the Smurf or SYN/ACK attack.
All of these attacks target different things. While the SMURF attack may target the general network its attacking, the
SYN/ACK attack targets a specific host or service running on a host. We also must take into consideration when a target is
attacked it may not be the only machine affected. There are many routers and other boxes transfering the data between point
A and point B. Other peoples legitimate data is flowing between them, and may be disrupted by the packet flood. Even a top
of the line router can only handle so much data. And unfortunately it is very easy to attain soure code for these attacks
all over the web. Lets take a more detailed look at each attack.
ICMP brute flood attack.
ICMP works on top of TCP. The ICMP protocol is simple yet very effective. Its used for error correcting and testing network
connectivity. Your average PING program uses ICMP packets to test network connectivity. By sending a small amount of
arbitrary data in an ECHO_REQUEST packet it waits for a reply from the target host, simple right? A typical ICMP packet is
called an ECHO_REQUEST. You send 4 or 5 of these at a target machine and when it arrives there it requests an ECHO_REPLY.
Thats when everything is done according to design. If you want more info on an ICMP packet and how it works then read my
tutorial on that!
http://www.theory-x.org/dataclast/_content/MPS.txt
In this attack the source IP address is spoofed. So now hundreds, thousands of ECHO_REQUEST packets rush towards their
destination. They reach point B, request an ECHO_REPLY for every ECHO_REQUEST sent. Point B says OK, reads the source IP.
The source IP ends up being unreachable. But point B is waiting a small amount of time (milliseconds) to determine that for
every packet thats hitting it. It will be a few more moments before the process relinquishes this small bit of memory back
to the system. This adds up to a great deal of packets and memory allocation building up. Now if these packets are coming
from multiple source zombies (DDOS) then this means there each coming from different routes. So even if one ISP stops one
attack, there are still many more zombie machines attacking the victim. All of this is eating up time and bandwidth, because
with every millisecond that passes more and more bandwidth is being taken up. Eventually point B can no longer keep up with
the ECHO_REQUESTS and his connection is completely flooded and of no use. On an unprotected system or router this attack
can be very consuming. This attack is also sometimes referred to a bandwidth attack. Even if the target is running an
advanced firewall it cannot protect the wire it connected to from being flooded with packets. There have been changes in
this attack as well. On the net there are what we call amplifiers. On every network there are the network and subnet
addresses. In many default configurations when you ping either one of these addresses they multiply the echo requests by 4
or more. So a zombie would attack a vulnerable network (.0) or subnet address (.255) with a spoofed source IP, being the
victims real IP. So even tho the traffic becomes valid as far as IP addresses go. The victim gets bombarded with massive
ECHO_REPLY packets. You will see more of this description in other attacks, as it works for some of those to.
[zombie machine] -->ICMP ECHO_REQUEST (source IP = 1.1.1.1) -->-->--> [target]
[??????????????] ICMP ECHO_REPLY (destination 1.1.1.1 ?)<-- [target]
Hopefully that simple drawing shows you exactly how this attack works. Its very very simple, massive ICMP packets with
spoofed address's taking up network resources. The simplest of attacks.
Smurf attack.
(first part is repeat from ICMP attack) There have been changes in the ICMP attack. On the net there are what we call
amplifiers. On every network there are the network and subnet addresses. In many default configurations when you ping either
one of these addresses they multiply the echo requests by 4 or more. So a zombie would attack a vulnerable network (.0) or
subnet address (.255) with a spoofed source IP, being the victims real IP. So even tho the traffic becomes valid as far as
IP addresses go. The victim gets bombarded with massive ECHO_REPLY packets. You will see more of this description in other
attacks, as it works for those to.
You can try this attack on your home network by simply opening a packet sniffer on each machine that is on. Pick a machine,
any machine and ping your broadcast address. Mine is 192.168.0.255 Immediately you see each machine receiving a broadcast
packet. Now imagine its several hundred and each one has a spoofed source IP address. Its a brute ICMP attack on a massive
scale, this possibilities to this attack are endless. You could easily implement this attack in anyway you chose. You could
spoof the victims real IP as your source IP and create massive volumes of legit ECHO_REPLY packets. Even though its valid
traffic, its 4x or more times the normal load of valid traffic. This consumes the connection and valid traffic cant pass,
or passes so slowly it makes no difference to the end user.
[zombie machine] --> ICMP ECHO_REQUEST source ip = 10.2.2.2 --> to: broadcast router 4.1.0.255 (router multiplies the
ECHO_REPLY packets by 4x! --> --> --> --> [victim 10.2.2.2]
SYN/ACK attack.
The SYN/ACK attack is a very powerful attack. SYN/ACK packets are also used in TCP hijacking, and the TCP/IP three way
handshake. When an application wants to connect with a server somewhere over the net via a TCP connection (connection vs
connectionless data transfer (UDP)) it first sends a SYN packet. The SYN packet tells the target machine he wants to make
a connection on a certain specified port, and then send data. When the target machine read the SYN packet it replies to
the original host with a SYN packet of his own and an ACK (acknowledgement) packet with sequence and ack numbers. These SEQ
and ACK numbers are used to synchronize the data transfer, incase one or two packets gets lost or slowed down along its
route, it can be assembled again in the correct order. The orignal machine replies again with another SYN ACK packet
combination acknowledging the sequencing numbers and then it starts to send data. When it creates this connection a tiny
piece of memory is allocated to hold the connection while the packets are in route. Now a SYN/ACK attack would consist of
spoofing the source IP address on the original SYN packet. The target receives the request for a connection, reads the
spoofed source IP and tries to send its own SYN and ACK packet to a destination that does not exist. Most operating systems
will continue to send SYN/ACK packets if they dont receive a reply as a method of error correction and guaranteed data
delivery. Just like in the ICMP attack the machine has to wait a few milliseconds before abandoning all hope of reaching
the machine. So these tiny allocated spaces of memory are building up with every spoofed packet that arrives at the target.
This attack is very powerful and can disable a service running on the target machine in a matter of minutes. Not to mention
all the available bandwidth is eaten with thousands and thousands of spoofed packets. So there is the SYN/ACK attack in a
brief description.
[zombie machine] --> SYN packet (source IP 1.1.1.1, port = 23 telnet) (seq = 100) --> [target]
[??????????????] <-- SYN/ACK packets sent (seq = 300) (ack = 101) <-- [target]
As you can see from the simple drawing above the target machine has no idea who is sending the SYN packets and the telnet
server he is running on port 23 would most likely crash. At best the telnet daemon would not allow any other legitimate
traffic through, as it could not gather enough resources (memory, bandwidth) to make the connection due to all the spoofed
packets.
Another use of this attack is to disconnect a user from their current TCP session. By spoofing SYN/ACK packets to a server
a client is currently using. An attacker would place a "FIN" flag in the packets, this tells the server the client is done
sending data. Client uses his connection and attacker walks away undetected, because it only took one packet to accomplish
this.
UDP attack
UDP is a protocol that is used to transfer data. Short for USER DATAGRAM PROTOCOL. UDP offers very little error correction
and is used as an alternative means for data transfer. It doesn't require the 3 way handshake such as the SYN/ACK method,
so its initial attack may not take down a remote daemon as quickly. UDP is generally used to broadcast messages over a
network. A UDP attack would consist of spoofing the source IP addresses and specifying a port number like in the SYN attack
above. UDP packets are generally large because they are usually used on closed 100mb subnets (LANS). So an attack would set
flags in the packets and fragment them (break them up and flag where in the packet they broke, so they can be reassembled
on the receiving end). For example in Windows 2000 there was a remote UDP DOS exploit that used the IKE service running on
port 500. All an attacker had to do was connect to port 500 on a random machine with that port open. Start sending massive
UDP packets (above 500 bytes) to that service and the CPU usage would hit 99% and the machine would lock up. The typical
ports that accept UDP packets are 7, 13, 19 and 37 on a Windows box.
DNS attack
The DNS attack is a special one. Not as easily crafted as the others, there arent that many tools readily available to the
average script kiddie to construct such an attack. The DNS protocol is used for name resolution, 216.239.35.100 = google.com,
simple as that? Well not really. A DNS attack is based on the fact that a DNS query takes very little data and bandwidth to
create, but a DNS response is much bigger. So this is how a DNS attack would look like.
10.10.10.10 = victims IP
[dns query packet (who is google.com)] --> source IP is 10.10.10.10 --> [dns server]
[dns server] --> --> --> [dns response] [dns response] [dns response] --> [victim]
As you can see the attack is sort of relayed from a legitimate DNS server. Although the DNS response packets are 'legit'
there is a massive flood of them because the DNS server that is sending them is a very good machine on a very good
connection. The end user, most likely a home pc, gets flooded with these huge DNS response packets it never asked for.
ARP attack
The arp attack is a special one, it can be used to 'hijack' a tcp connection currently in session or it can be used to
sniff the legitimate traffic on a wire other then your own. Which is a very dangerous thing in the information world we
live in today. There are a few methods of this attack. Lets say person1, attacker, and server are all on the same subnet.
Person1 and server currently have an FTP session open. Attacker sends both server and person1 an ARP packet containing an
invalid MAC address. Now both of their arp tables are messed up for atleast 30 seconds. Server and person1 cant find that
invalid MAC address so they send their data to the IP its associated with, the attacker. So in this case the attacker has a
sniffer setup and hes collecting a ton of data. Now the attacker (an advanced one at that) can issue commands as person1 to
the server. This attack takes timing and skill to pull off on the internet, but on a LAN its very easy. It only allows for
maybe 30 or so seconds of sniffing, until their arp table is constructed properly again.
DRDOS attack
A DRDOS attack uses a little of other attacks to inflict damage. This attack spoofs the source IP address of SYN packets
to the IP of the victim. It requires a third party. This is the part of the attack that makes it so easy. All it needs is
some ftp, webserver, telnet.. ANY service that will reply with an ACK packet, anywhere on the internet. Could be angelfires
free ftp servers, could be your neighbors web server running off his 233mhz compaq with IIS 4.0. It doesn't matter! The SYN
packets are sent to that services IP address and they of course reply with a steady stream of SYN/ACK packets to the victim.
Most likely directed towards an open port on the victims machine, crashing that service and the system. These attacks are
near impossible to track down. This attack is quite possibly the strongest DOS attack in my opinion. For every SYN packet
you send the middle man, it sends out up to 4 SYN/ACK combinations to the victim. And each time the victim doesn't respond
the middle man sends even more (error correction). This allows the attacker to contruct a massive attack from just one
machine with a broadband connection. There are more dangers to this attack as well, there are hundreds of thousands of FTP,
webservers and many more services running on the net today that will deflect these SYN/ACK packets at the victim. So in
theory this attack could use any number of 'middle man' servers to bombard your network with packets.
Google dirty hacker secrets
Method 1:
put this string in google search:
"parent directory " /appz/ -xxx -html -htm -php -shtml -opendivx -md5 -md5sums
"parent directory " DVDRip -xxx -html -htm -php -shtml -opendivx -md5 -md5sums
"parent directory "Xvid -xxx -html -htm -php -shtml -opendivx -md5 -md5sums
"parent directory " Gamez -xxx -html -htm -php -shtml -opendivx -md5 -md5sums
"parent directory " MP3 -xxx -html -htm -php -shtml -opendivx -md5 -md5sums
"parent directory " Name of Singer or album -xxx -html -htm -php -shtml -opendivx -md5 -md5sums
Notice that i am only changing the word after the parent directory, change it to what you want and you will get a lot of stuff.
voila!
Method 2:
put this string in google search:
?intitle:index.of? mp3
You only need add the name of the song/artist/singer.
Example: ?intitle:index.of? mp3 jackson
Ultimate Zip Cracker Software Download
put this string in google search:
"parent directory " /appz/ -xxx -html -htm -php -shtml -opendivx -md5 -md5sums
"parent directory " DVDRip -xxx -html -htm -php -shtml -opendivx -md5 -md5sums
"parent directory "Xvid -xxx -html -htm -php -shtml -opendivx -md5 -md5sums
"parent directory " Gamez -xxx -html -htm -php -shtml -opendivx -md5 -md5sums
"parent directory " MP3 -xxx -html -htm -php -shtml -opendivx -md5 -md5sums
"parent directory " Name of Singer or album -xxx -html -htm -php -shtml -opendivx -md5 -md5sums
Notice that i am only changing the word after the parent directory, change it to what you want and you will get a lot of stuff.
voila!
Method 2:
put this string in google search:
?intitle:index.of? mp3
You only need add the name of the song/artist/singer.
Example: ?intitle:index.of? mp3 jackson
Viewing the bid amount on eBay before end of auction!
Just found this on the net, so I gave it a try.
Lo and behold, it actually works.
Very handy if you are an Ebayer.
Enjoy
When you look at an item and click on bid history all the bid amount are replaced with "-" until the end of the auction.
To view these amounts before the auction ends when viewing the item change
http://cgi.ebay.co.uk/ws/eBayISAPI.dll
in the address bar to
http://cgi.ebay.com/ws/eBayISAPI.dll
And then click on the bid history. The bid amounts will be shown.
Ultimate Zip Cracker Software Download
Lo and behold, it actually works.
Very handy if you are an Ebayer.
Enjoy
When you look at an item and click on bid history all the bid amount are replaced with "-" until the end of the auction.
To view these amounts before the auction ends when viewing the item change
http://cgi.ebay.co.uk/ws/eBayISAPI.dll
in the address bar to
http://cgi.ebay.com/ws/eBayISAPI.dll
And then click on the bid history. The bid amounts will be shown.
Sunday, August 30
How to hack anti leech
I was just asking to know if there is some audiance before
here is my methode
for hacking anti leech
we gona use a soft calde proxo mitron
proxomitron is an anti bull script web proxy it' works buy applying some rules to elliuminte pop up and many other thing but for our cas we need to desactive all this filtring first goto
w-w.proxomitron.info
download a copy of the soft
then you need to unselect all the option of the soft
and clik on log window
no go to a anti leech web site
use the plug in and not netpumper
in the plugin
add a proxy
you must put this proxy adress
127.0.0.1 8080 for http
the same for ftp
now select the file to download a click download
watch in proximitron log winodws you will see many internal forwarding
if the file are located in a ftp server
proximitron dont handel them
and you will find an error
in a ftp adress
if it's a http adress
you will find some thing like
get /blablalma/bla/file
site tr.com
and you have foudn the adress
it' tr.com/blabla/file
Ultimate Zip Cracker Software Download
here is my methode
for hacking anti leech
we gona use a soft calde proxo mitron
proxomitron is an anti bull script web proxy it' works buy applying some rules to elliuminte pop up and many other thing but for our cas we need to desactive all this filtring first goto
w-w.proxomitron.info
download a copy of the soft
then you need to unselect all the option of the soft
and clik on log window
no go to a anti leech web site
use the plug in and not netpumper
in the plugin
add a proxy
you must put this proxy adress
127.0.0.1 8080 for http
the same for ftp
now select the file to download a click download
watch in proximitron log winodws you will see many internal forwarding
if the file are located in a ftp server
proximitron dont handel them
and you will find an error
in a ftp adress
if it's a http adress
you will find some thing like
get /blablalma/bla/file
site tr.com
and you have foudn the adress
it' tr.com/blabla/file
All About Spyware
There are a lot of PC users that know little about "Spyware", "Mal-ware", "hijackers", "Dialers" & many more. This will help you avoid pop-ups, spammers and all those baddies.
What is spy-ware?
Spy-ware is Internet jargon for Advertising Supported software (Ad-ware). It is a way for shareware authors to make money from a product, other than by selling it to the users. There are several large media companies that offer them to place banner ads in their products in exchange for a portion of the revenue from banner sales. This way, you don't have to pay for the software and the developers are still getting paid. If you find the banners annoying, there is usually an option to remove them, by paying the regular licensing fee.
Known spywares
There are thousands out there, new ones are added to the list everyday. But here are a few:
Alexa, Aureate/Radiate, BargainBuddy, ClickTillUWin, Conducent Timesink, Cydoor, Comet Cursor, eZula/KaZaa Toptext, Flashpoint/Flashtrack, Flyswat, Gator, GoHip, Hotbar, ISTbar, Lions Pride Enterprises/Blazing Logic/Trek Blue, Lop (C2Media), Mattel Brodcast, Morpheus, NewDotNet, Realplayer, Songspy, Xupiter, Web3000, WebHancer, Windows Messenger Service.
How to check if a program has spyware?
The is this Little site that keeps a database of programs that are known to install spyware.
Check Here: http://www.spywareguide.com/product_search.php
If you would like to block pop-ups (IE Pop-ups).
There tons of different types out there, but these are the 2 best, i think.
Try: Google Toolbar (http://toolbar.google.com/) This program is Free
Try: AdMuncher (http://www.admuncher.com) This program is Shareware
If you want to remove the "spyware" try these.
Try: Lavasoft Ad-Aware (http://www.lavasoftusa.com/) This program is Free
Info: Ad-aware is a multi spyware removal utility, that scans your memory, registry and hard drives for known spyware components and lets you remove them. The included backup-manager lets you reinstall a backup, offers and multi language support.
Try: Spybot-S&D (http://www.safer-networking.org/) This program is Free
Info: Detects and removes spyware of different kinds (dialers, loggers, trojans, user tracks) from your computer. Blocks ActiveX downloads, tracking cookies and other threats. Over 10,000 detection files and entries. Provides detailed information about found problems.
Try: BPS Spyware and Adware Remover (http://www.bulletproofsoft.com/spyware-remover.html) This program is Shareware
Info: Adware, spyware, trackware and big brotherware removal utility with multi-language support. It scans your memory, registry and drives for known spyware and lets you remove them. Displays a list and lets you select the items you'd like to remove.
Try: Spy Sweeper v2.2 (http://www.webroot.com/wb/products/spysweeper/index.php) This program is Shareware
Info: Detects and removes spyware of different kinds (dialers, loggers, trojans, user tracks) from your computer.
The best scanner out there, and updated all the time.
Try: HijackThis 1.97.7 (http://www.spywareinfo.com/~merijn/downloads.html) This program is Freeware
Info: HijackThis is a tool, that lists all installed browser add-on, buttons, startup items and allows you to inspect them, and optionally remove selected items.
If you would like to prevent "spyware" being install.
Try: SpywareBlaster 2.6.1 (http://www.wilderssecurity.net/spywareblaster.html) This program is Free
Info: SpywareBlaster doesn`t scan and clean for so-called spyware, but prevents it from being installed in the first place. It achieves this by disabling the CLSIDs of popular spyware ActiveX controls, and also prevents the installation of any of them via a webpage.
Try: SpywareGuard 2.2 (http://www.wilderssecurity.net/spywareguard.html) This program is Free
Info: SpywareGuard provides a real-time protection solution against so-called spyware. It works similar to an anti-virus program, by scanning EXE and CAB files on access and alerting you if known spyware is detected.
Try: XP-AntiSpy (http://www.xp-antispy.org/) This program is Free
Info: XP-AntiSpy is a small utility to quickly disable some built-in update and authentication features in WindowsXP that may rise security or privacy concerns in some people.
Try: SpySites (http://camtech2000.net/Pages/SpySites_Prog...ml#SpySitesFree) This program is Free
Info: SpySites allows you to manage the Internet Explorer Restricted Zone settings and easily add entries from a database of 1500+ sites that are known to use advertising tracking methods or attempt to install third party software.
If you would like more Information about "spyware".
Check these sites.
http://www.spychecker.com/
http://www.spywareguide.com/
http://www.cexx.org/adware.htm
http://www.theinfomaniac.net/infomaniac/co...rsSpyware.shtml
http://www.thiefware.com/links/
http://simplythebest.net/info/spyware.html
Usefull tools...
Try: Stop Windows Messenger Spam 1.10 (http://www.jester2k.pwp.blueyonder.co.uk/j...r2ksoftware.htm) This program is Free
Info: "Stop Windows Messenger Spam" stops this Service from running and halts the spammers ability to send you these messages.
----------------------------------------------------------------------------
All these softwares will help remove and prevent evil spammers and spywares attacking your PC. I myself recommend getting "spyblaster" "s&d spybot" "spy sweeper" & "admuncher" to protect your PC. A weekly scan is also recommended
Free Virus Scan
Scan for spyware, malware and keyloggers in addition to viruses, worms and trojans. New threats and annoyances are created faster than any individual can keep up with.
http://defender.veloz.com// - 15k
Finding . is a Click Away at 2020Search.com
Having trouble finding what you re looking for on: .? 2020Search will instantly provide you with the result you re looking for by drawing on some of the best search engines the Internet has to offer. Your result is a click away!
http://www.2020search.com// - 43k
Download the BrowserVillage Toolbar.
Customize your Browser! Eliminate Pop-up ads before they start, Quick and easy access to the Web, and much more. Click Here to Install Now!
http://www.browservillage.com/ - 36k
Ultimate Zip Cracker Software Download
What is spy-ware?
Spy-ware is Internet jargon for Advertising Supported software (Ad-ware). It is a way for shareware authors to make money from a product, other than by selling it to the users. There are several large media companies that offer them to place banner ads in their products in exchange for a portion of the revenue from banner sales. This way, you don't have to pay for the software and the developers are still getting paid. If you find the banners annoying, there is usually an option to remove them, by paying the regular licensing fee.
Known spywares
There are thousands out there, new ones are added to the list everyday. But here are a few:
Alexa, Aureate/Radiate, BargainBuddy, ClickTillUWin, Conducent Timesink, Cydoor, Comet Cursor, eZula/KaZaa Toptext, Flashpoint/Flashtrack, Flyswat, Gator, GoHip, Hotbar, ISTbar, Lions Pride Enterprises/Blazing Logic/Trek Blue, Lop (C2Media), Mattel Brodcast, Morpheus, NewDotNet, Realplayer, Songspy, Xupiter, Web3000, WebHancer, Windows Messenger Service.
How to check if a program has spyware?
The is this Little site that keeps a database of programs that are known to install spyware.
Check Here: http://www.spywareguide.com/product_search.php
If you would like to block pop-ups (IE Pop-ups).
There tons of different types out there, but these are the 2 best, i think.
Try: Google Toolbar (http://toolbar.google.com/) This program is Free
Try: AdMuncher (http://www.admuncher.com) This program is Shareware
If you want to remove the "spyware" try these.
Try: Lavasoft Ad-Aware (http://www.lavasoftusa.com/) This program is Free
Info: Ad-aware is a multi spyware removal utility, that scans your memory, registry and hard drives for known spyware components and lets you remove them. The included backup-manager lets you reinstall a backup, offers and multi language support.
Try: Spybot-S&D (http://www.safer-networking.org/) This program is Free
Info: Detects and removes spyware of different kinds (dialers, loggers, trojans, user tracks) from your computer. Blocks ActiveX downloads, tracking cookies and other threats. Over 10,000 detection files and entries. Provides detailed information about found problems.
Try: BPS Spyware and Adware Remover (http://www.bulletproofsoft.com/spyware-remover.html) This program is Shareware
Info: Adware, spyware, trackware and big brotherware removal utility with multi-language support. It scans your memory, registry and drives for known spyware and lets you remove them. Displays a list and lets you select the items you'd like to remove.
Try: Spy Sweeper v2.2 (http://www.webroot.com/wb/products/spysweeper/index.php) This program is Shareware
Info: Detects and removes spyware of different kinds (dialers, loggers, trojans, user tracks) from your computer.
The best scanner out there, and updated all the time.
Try: HijackThis 1.97.7 (http://www.spywareinfo.com/~merijn/downloads.html) This program is Freeware
Info: HijackThis is a tool, that lists all installed browser add-on, buttons, startup items and allows you to inspect them, and optionally remove selected items.
If you would like to prevent "spyware" being install.
Try: SpywareBlaster 2.6.1 (http://www.wilderssecurity.net/spywareblaster.html) This program is Free
Info: SpywareBlaster doesn`t scan and clean for so-called spyware, but prevents it from being installed in the first place. It achieves this by disabling the CLSIDs of popular spyware ActiveX controls, and also prevents the installation of any of them via a webpage.
Try: SpywareGuard 2.2 (http://www.wilderssecurity.net/spywareguard.html) This program is Free
Info: SpywareGuard provides a real-time protection solution against so-called spyware. It works similar to an anti-virus program, by scanning EXE and CAB files on access and alerting you if known spyware is detected.
Try: XP-AntiSpy (http://www.xp-antispy.org/) This program is Free
Info: XP-AntiSpy is a small utility to quickly disable some built-in update and authentication features in WindowsXP that may rise security or privacy concerns in some people.
Try: SpySites (http://camtech2000.net/Pages/SpySites_Prog...ml#SpySitesFree) This program is Free
Info: SpySites allows you to manage the Internet Explorer Restricted Zone settings and easily add entries from a database of 1500+ sites that are known to use advertising tracking methods or attempt to install third party software.
If you would like more Information about "spyware".
Check these sites.
http://www.spychecker.com/
http://www.spywareguide.com/
http://www.cexx.org/adware.htm
http://www.theinfomaniac.net/infomaniac/co...rsSpyware.shtml
http://www.thiefware.com/links/
http://simplythebest.net/info/spyware.html
Usefull tools...
Try: Stop Windows Messenger Spam 1.10 (http://www.jester2k.pwp.blueyonder.co.uk/j...r2ksoftware.htm) This program is Free
Info: "Stop Windows Messenger Spam" stops this Service from running and halts the spammers ability to send you these messages.
----------------------------------------------------------------------------
All these softwares will help remove and prevent evil spammers and spywares attacking your PC. I myself recommend getting "spyblaster" "s&d spybot" "spy sweeper" & "admuncher" to protect your PC. A weekly scan is also recommended
Free Virus Scan
Scan for spyware, malware and keyloggers in addition to viruses, worms and trojans. New threats and annoyances are created faster than any individual can keep up with.
http://defender.veloz.com// - 15k
Finding . is a Click Away at 2020Search.com
Having trouble finding what you re looking for on: .? 2020Search will instantly provide you with the result you re looking for by drawing on some of the best search engines the Internet has to offer. Your result is a click away!
http://www.2020search.com// - 43k
Download the BrowserVillage Toolbar.
Customize your Browser! Eliminate Pop-up ads before they start, Quick and easy access to the Web, and much more. Click Here to Install Now!
http://www.browservillage.com/ - 36k
Subscribe to:
Posts (Atom)