Hackers Handbook - Millenium Edition

home *** CD-ROM | disk | FTP | other *** search

/ Hackers Handbook - Millenium Edition / Hackers Handbook.iso / library / hack / netdiablo.txt < prev next >

Wrap

Text File | 1998-07-17 | 15.3 KB | 297 lines

An Introduction To The Internet And TCP/IP By Netdiablo Of 616 <ndiablo@complink.net> I have written this file because it is really pathetic how many people on the Internet call themselves "hackers" and really have no idea how the network that they "hack" on even works in the first place. This file will cover the basics of the Internet and will provide a good reference to new and intermediate users. The Internet began as the ARPANet in the 1960's. The ARPANet was a network linking together various research installations and universities across the nation that were involved in projects funded under DARPA, the Defense Advanced Research Projects Agency. Initial consultants on the ARPANet included Rand, Inc. and Bolt, Baranek, And Newman. The Internet existed, up to the early 1990's as simply a research network mainly used by universities and corporations, mostly computer companies. In the 1990's, however, the emergence of faster modems and the World Wide Web to the world at large started the Internet phenomenon known today. ------------------------------------------------------------------------------ New User Definition [TCP/IP]: Transmission Control Protocol/Internet Protocol. These are the two protocols that the Internet "runs" on. ------------------------------------------------------------------------------ On the Internet, machines are connected to networks, which are divided into subnetworks. Each machine [or device] on the network has a specific address, known as an IP address. An IP address is composed of four segments, known as octets. These octets define a unique address, with part of them describing a network and/or subnetwork, and part of them describing a particular node on a network. ------------------------------------------------------------------------------ New User Definition [Node]: The generic term for a device on the network, usually used to describe a system or a router. Other network devices, such as printers and hubs are usually not known as nodes. ------------------------------------------------------------------------------ IP addresses are organized into five classes, which are Class A through Class E. Depending on how large an organization is, it uses different classes of addresses to give to the machines on it's network. Class A networks are the largest, with a block of Class A addresses being big enough to use with up to 167772 machines. These are used for very large organizations and collections of related networks. Also, many educational institutions are grouped under a Class A address. Class B networks follow Class A networks in size, with a maximum capacity of being able to address up to 65536 machines. Class C networks are commonly used by many smaller companies. You will also see many local ISPs using one or two blocks of Class C addresses on it's network. Each block of Class C addresses is capable of addressing up to 255 machines. Class D addresses are reserved for IP Multicasting, and Class E addresses are reserved for "experimental purposes". ----------------------------------------------------------------------------- New User Definition [Octet]: An octet a component of an IP address. Each address includes four octets. Each octet can have a value ranging from 0 to 255. In a Class A network, you can use up to three of the octets on your network, in a Class B, you can use up to two, and in a Class C, you can use only the last octet for addressing machines on your network. This is shown in detail below: Class A: Example: Allocates a block, 10.0.0.1 to 10.255.255.255 Class B: Example: Allocates a block, 10.1.0.1 to 10.1.255.255 Class C: Example: Allocates a block, 10.1.1.1 to 10.1.1.255 You can see how with a Class A network, you have three octets you can use up with addresses for machines, on a Class B network, you only have two octets you can use up with addresses, and on a Class C network, you only have a single octet to use for addresses. ----------------------------------------------------------------------------- IP Addresses are designed so that you can make many smaller networks out of larger networks. For instance, you could make 255 Class B networks out of a single Class A block, and you can make 255 Class C networks out of a single Class C block. This process of making large networks into smaller networks is called subnetting. ----------------------------------------------------------------------------- New User Definition [Subnetting]: Creating smaller sub-networks from a single larger network. ----------------------------------------------------------------------------- When subnetworks are created, the concept of masking is also used. Subnet masks mask out certain bits to show where the network addresses end and the space where the addresses that can be used for hosts begin. Examples of masks are below: N=Network addresses H=Host addresses An example of a Class A netmask is: NNNNNNNN.HHHHHHHH.HHHHHHHH.HHHHHHHH Numerically, that is: 0.255.255.255 An example of a Class B netmask is: NNNNNNNN.NNNNNNNN.HHHHHHHH.HHHHHHHH Numerically, that is: 0.0.255.255 An example of a Class C netmask is: NNNNNNNN.NNNNNNNN.NNNNNNNN.HHHHHHHH Numerically, that is: 0.0.0.255 The above diagram will be somewhat confusing to you, so it will be explained below. Above, you will notice that each octet [there are four in an IP address, remember] is represented by eight letters. Each letter represents a bit in an 8-bit byte, which is an octet. This explains the fact that each octet can only hold an address up to 255, because an 8-bit byte can only hold a number up to 255. Network addresses can be pretty hard to remember, so machines on a network can also have a name. Each machine can have a name, and so can the network on which it exists. The name for a network is called a "domain name". Domain names can be registered with the InterNIC for a ridiculously high sum of money. Each network also registers into a high-level domain. These are as follows for the United States: .com: Commercial organizations. .edu: Educational institutions. .org: Nonprofit organizations. .net: Networks. .gov: Non-military governmental sites. .mil: Military sites. Each country also has an ISO top-level domain assigned to it, examples of which are listed below: United States us Russia ru United Kingdom uk Japan jp France fr Italy it Germany de Denmark dk Now that you the structure of an address and domain names have been explained, the next topic that will be covered is ports. Every server on the internet has a number of ports open. If you are having trouble understanding this, think of each port as a door into a building. Some ports are open, and some are closed. On the open ports, programs that serve certain services and protocols run. In the unix vernacular, these programs are called daemons. Examples of daemons are "telnetd", the telnet daemon, "ftpd", the FTP daemon, "sendmail", the UNIX mailer, and "httpd", the HTTP server. You can connect to ports using client programs for the certain port, or you can connect just using telnet, which will give you a raw interface to the port. Now, I will provide an overview of some of the most used services, and how to access them using UNIX. FTP: Port 21 First of all, FTP. FTP is probably the most used file transfer protocol in the world. On the server side, a host will usually be either be running the wuftpd, which was developed at Washington University, or the BSD FTP daemon. FTP is accessed using a client program, the default of which is a small UNIX program called "ftp". To open a connection to a site, you can either run "ftp" with the host you want to connect to given as an argument (i.e. "ftp anubis-gw.dyn.ml.org"), or you can also start "ftp", and then use the "open" command at the "ftp>" prompt (i.e. "open shell.complink.net"). Once you have connected to the server, you will be prompted for a username and password on the remote machine. Sometimes, a machine will also be running an "anonymous" account, this can be accessed by logging in as "anonymous" or "ftp" at the FTP login prompt. Once you have logged into the server, you can get a file using the "get" command, you can send a file using the "send" command, and you can list directories using the "ls" command and you can change directories using the "cd" command. For more information, type "?" or "help" at the "ftp>" prompt. Secure Shell: (Defaults to port 22) Secure Shell is not as much of a protocol as it is an application, but it still deserves to be included here. Secure Shell is a very useful tool for accessing hosts remotely. It resembles the 'telnet' and 'rlogin' applications, but unlike 'telnet' and 'rlogin' Secure Shell encrypts the session. Therefore, the connection cannot be sniffed, which increases security. The client for the Secure Shell protocol is called "ssh". To run the ssh application, the syntax is typically "ssh -l username host", in which host is the host that you will be accessing, and "username" is the username to login to the host as. Just typing "ssh" will make the client program print out a list of command line options. Telnet: Port 23 Now, onto the "telnet" protocol. Telnet is a protocol used to remotely login to machines over a network. UNIX includes a default client for telnet called "telnet". To connect to a host using "telnet", you can either run the telnet application using the host name as an argument (i.e. "telnet anubis-gw.dyn.ml.org"), or you can run the telnet application, and, once you are at the "telnet>" prompt, you can use the "open" command (i.e. "open anubis-gw.dyn.ml.org"). Once you are connected, you can interact with the machine as usual. If you need to get back to the telnet prompt, you can type the escape character at any time during the session. This is set by default to "^]". Once you are at the "telnet>" prompt, you can do things like disconnect or continue your session. When you log out of the machine you have telnetted to, the connection will be automatically closed. Sendmail: Port 25 The "Sendmail" protocol is one of the most common, and also most complex protocols on the Internet. Almost every site on the Internet that handles mail will be running Sendmail, or one of about two alternatives. You interact with Sendmail by using the UNIX program "mail". Usually, you invoke mail with the email address of the person you want to send mail to as an argument (i.e. "mail ndiablo@complink.net"). Once you have done that, you will be prompted for a topic, and then will be able to write the letter. Once you have finished writing the mail, you can send it by typing a "^D" or a "." on an empty line. You can abort mail by typing a "^C" anytime during the program. There are many more arguments for the "mail" program, to learn about them, refer to the "mail" online manual page. DNS: Port 53 DNS is the port that the Internet Domain Name Server Daemon (BIND) runs on. However, before the daemon is explained, you must understand the protocol. As you know, on the Internet, each host has a 'name'. Each 'name' maps to an IP address. Domain name servers contain 'tables' of these hostname- address mappings for the 'domain' they serve. These work in a 'tree' sort of configuration. For instance, each 'top level' domain (e.g. .com, .edu, .mil, etc.) has nameservers that map to all the IP addresses of the nameservers for 'second level' domains (e.g. sun.com mit.edu, etc) which have nameservers that map all the machines in their domains to IP addresses and so on. This is shown in a diagram below: .com .edu .net | | | sun.com mit.edu complink.net | | | machine1.sun.com machine1.mit.edu machine1.complink.net Therefore, this daemon runs on the domains nameservers and maps the IP addresses of the machines in the domain to hostnames in the domain. TFTP: Port 69 FTFP is the Trivial File Transfer Protocol. TFTP resembles FTP in the fact that it is used to transfer files between nodes, but unlike FTP, TFTP uses no user authentication. This really means that any user can TFTP to a host and steal any file they like if the host is running the TFTP protocol. Obviously, this is a big security risk, and no server on the Internet should be running it. The only real use for this protocol is for applications such as a boot server. If this protocol must be run, then at the least the admin should be using password shadowing, be behind a decent firewall, and use the directory limiting feature built into some versions. The client for TFTP is a simple program called "tftp". Since it is so seldom used, refer to the online manual page, or enter "?" or "help" at the "tftp>" prompt. Finger: Port 79 Finger is a protocol for retrieving information on a user on a system. A finger query will usually return the users real name, location, phone number, last login time, and the last time the user read their mail. This protocol is not really that useful, and in my opinion, should not be run, as it's only real purpose is to provide information helpful to those trying to use social engineering attacks against people. The client for the finger protocol is a application, unsurprisingly called "finger". It's syntax usually follows the pattern "user@host", for instance, "ndiablo@complink.net". You can also attempt to finger the host, showing all users logged into the system by a syntax like "@host", like "finger @complink.net". HTTP: Port 80 The HTTP protocol is a familiar one. Everyone should know about the HTTP protocol by this point in time. HTTP is the protocol that the World Wide Web is served upon. There are many clients for HTTP, but the most common text-based one is called "lynx". To connect to a site using lynx, you execute lynx with the name of the site given as an argument. For instance, "lynx http://anubis-gw.dyn.ml.org". You can also execute lynx by typing "lynx" and then entering the name of the site you wish to go to from inside the program. POP Version 3: Port 110 The POP [Post Office Protocol] is used to retrieve mail from a machine remotely. There are a few different UNIX clients for POP, including "fetchmail". These programs have a somewhat large amount of options, and there is no real 'default' syntax. For more information, refer to the online manual page of your POP client. NNTP: Port 119 The NNTP [Network News Transfer Protocol] is used, obviously, to transfer netnews between machines. There are many clients to access this, one example of which is 'tin'. For more information, refer to the online manual page for your network news client. Now, the very fundamentals of the Internet have been explained to you. IP addressing, protocols, ports, the simple theory behind domain name service, and other useful bits of knowledge. Obviously this wasnt an attempt at making a super-reference, but it should do to explain the basic concepts that one will run into while using the Internet. For more advanced information, look in issues of Phrack magazine, and perhaps look into buying a good book on TCP/IP. Any comments, feel free to email ndiablo@complink.net or also root@anubis-gw.dyn.ml.org -Netdiablo Tnx to Reality-X, Digiphreq, and Ishamael for proofreading.