tcpip a mammoth description, short and easy-everything u want to know.txt

黑客培训教程

which port it should be directed to.

In TCP\IP or over the Internet all communication is done using the Socket pair i.e. the combination of the
IP address and the port.

*****************
HACKING TRUTH: Learn More about Ports, IP addresses and Sockets by reading the Net Tools Chapter.
*****************
The Application Layers basically consists of the Applications running on your computer and the
Applications running on the host to which you are connected. Say you are viewing the Hotmail Site, then
the application layer comprises of the Web Browser running on your computer and the HTTP daemon
running at Hotmail's server and the Application Protocol being used to communicate is HyperText Transfer
Protocol.

As soon as a TCP connection is established the Applications running on Each end decide the language or
protocol to be used to communicate and send datagrams.

IP Spoofing Torn Apart

IP spoofing is the most exciting topic you will hear wannabe hackers talking about. It is also a subject
about which no one knows much. Before we continue I would like to tell you that IP Spoofing is quite
difficult to understand and a lot of people have trouble understanding how it is done. The other downside it
has is the fact that it can almost not be done using a Windows system and a system administrator can easily
protect his system from IP spoofing

So what is IP Spoofing? IP Spoofing is a trick played on servers to fool the target computer into thinking
that it is receiving data from a source other than you. This in turn basically means to send data to a remote
host so that it believes that the data is coming from a computer whose IP address is something other than
yours. Let's take an example to make it clear:

Your IP is : 203.45.98.01 (REAL)
IP of Victim computer is: 202.14.12.1 (VICTIM)
IP you want data to be sent from: 173.23.45.89 (FAKE)

Normally sitting on the computer whose IP is REAL, the datagrams you send to VICTIM will appear to
have come from REAL. Now consider a situation in which you want to send a datagram to VICTIM and
make him believe that it came from a computer whose IP is FAKE. This is when you perform IP Spoofing.

The Main problem with IP Spoofing is that even if you are able to send a spoofed datagram to the remote
host, the remote host will reply not to your real IP but to the Fake IP you made your datagram seem to have
come from. Getting confused? Read the following example to clear up your mind.

Taking the same IP's as in the last example, consider the following scenario. Now, if REAL connects to
VICTIM, after the standard three way handshake has taken place, and VICTIM sends an ACK message to
REAL. Now if you spoof you IP, to say FAKE, then VICTIM will try to establish a TCP connection and
will send an ACK message to FAKE. Now lets assume that FAKE is alive, then as it had not requested the
ACK message (sent by VICTIM to FAKE) it will reply with a NACK message which would basically end
the connection and no further communication between FAKE and VICTIM would take place. Now if
FAKE doesn't exist then the ACK message sent by VICTIM will not get any reply and in the end the
connection times out.

Due to this FAKE and REAL IP reasons, when a person is trying to perform an IP Spoof, he does not get
any response from the remote host and has no clue whether he has been successful or not. If he has made
any progress or not. You are as good as blind, with no medium through which you could get feedback.

IP Spoofing can be successful only if the computer with the FAKE IP does not reply to the victim and not
interrupt the spoofed connection.  Take the example of a telephone conversation, you can call up a person
' x ' and pretend to be ' y ' as long as ' y ' does not interrupt the conversation and give the game away.

So why would you need to perform IP Spoofing-:

1.) To Pretend that you are some other computer whose IP address is amongst the trusted list of computers
on the victim's disk. This way you are exploit the 'r' services and gain access to the network as you are
then believed to be from a trusted source.
2.) To Disguise or Mask your IP address so that the victim does not know who you really are and where
the data is coming from.

If you ever read the alt.2600 or the alt.hacking newsgroup, you would probably find many postings like "I
have Win98, how do I Spoof my IP" or even " I do not know TCP/IP. tell me how to perform IP spoofing".
You see the very fact that they are posting such questions and expect to learn how to spoof their IP without
even knowing a bit about TCP\IP, confirms the fact that they would not be able to perform IP Spoofing. No
I am not saying that asking questions is bad, but you see not knowing something is not so bad, but not
knowing something and showing ignorance towards learning it is really, really bad.

You see IP spoofing is a very complex and difficult to perform subject. You need to hog entire TCP/IP and
Networking Protocols manuals and need to be able to write C programs which will help you in the
Spoofing process. It is amazing how people even think that they can spoof their IP without even knowing
what TCP/IP stands for.

You see all packets travelling across the Internet have headers which contain the source and destination IP
addresses and port numbers, so that the packet knows where to go and the destination knows where the
packet has come from and where to respond. Now the process of Spoofing means to change the source IP
address contains by the Header of the packet, in turn fooling the receiver of the Packets into believing that
the packet came from somewhere else, which is a fake IP. Now let's again look at the IP Header of a
datagram.

+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
   |Version|  IHL  |Type of Service|          Total Length         |
   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
   |         Identification        |Flags|      Fragment Offset    |
   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
   |  Time to Live |    Protocol   |         Header Checksum       |
   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
   |                       Source Address                          |
   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
   |                    Destination Address                        |
   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
   |  TCP header info followed by the actual data being transferred             |
   |

Now basically to perform IP spoofing we need to be able to change the value of the field, Source Address.
Now to this you need to be able to guess sequence numbers which is quite a sophisticated process and I will
try to explain it as clearly as possible. Before we go on, you need to understand the fact the IP spoofing is
not the entire process, it is just a stepping stop in the entire process of fooling the remote host and
establishing a trust relationship with the remote host.

So how do these trust relationships take place? Well all of you are encountered with some form of
authentication process or the other. Now the Username-Password pair is the most commonly used form of
authentication, with which we are very much familiar. Now what happens in the Username-Password form
of authentication is that the remote host to which the client is connected to challenges the client by asking
the User to type in the Username and Password. So in this form of authentication, the User needs to
intervened and the remote host challenges the user to enter the Username and Password which act as a from
of authentication.

Now other than the Password-Username form of authentication there is yet another form of authentication
most users do not know of. This is the Client IP. In this form of authentication, what happens is that the
remote host gets or find out the IP address of the client and compares it with a predefined list of IP's. If the
IP of the client who is trying to establish a connection with the remote host is found in the list of IP's
maintained by the host, then it allows the client access to the shell  'without a password'  as the identity of
the client has already been authenticated.

Such kind of rust relationships are common in Unix Systems which have certain 'R services' like rsh ,
rlogin , rcp   which have certain security problems and should be avoided. Despite the threat involved most
ISP's in India still keep the ports of the R services open to be exploited by Hackers. You normally establish
a  Rlogin  trust relationship by using the Unix command,

$>rlogin IP address

**************
HACKING TRUTH: Well there is definitely a cooler way of establishing a trust relationship with a remote
host, using Telnet. The default port numbers at which the R services run are 512, 513,514
**************

So how do I spoof my IP? Well in short, to spoof your IP, you need to be able to predict sequence numbers,
this will clearer after reading then next few paragraphs.

To understand Sequence Numbers you need to go back to, how the TCP protocol works.  You already
know that TCP is a reliable protocol and has certain in-built features which have the ability to rearrange, re-
send lost, duplicated  or out of sequence data. To make sure that the destination is able to rearrange the
datagrams in the correct order, TCP inserts two sequence numbers into each TCP datagram. One Sequence
number tells the receiving computer where a particular datagram belongs while the second sequence
number says how much data has been received by the sender. Anyway, let's move on, TCP also relies on
ACK and NACK messages to ensure that all datagrams have reached the destination error free.
Now we need to reanalyze the TCP Header to understand certain other aspects of sequence numbers and
the ACK Number.

  +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
   |          Source Port          |       Destination Port        |
   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
   |                        Sequence Number                        |
   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
   |                    Acknowledgment Number                      |
   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
   |  Data |           |U|A|P|R|S|F|                                                                       |
   | Offset| Reserved  |R|C|S|S|Y|I|            Window                                       |
   |           |           |G|K|H|T|N|N|                                                                     |
   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
   |           Checksum            |         Urgent Pointer        |
   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
   |   The Actual Data form the next 500 octets                    |
   |                                                               |

You see the TCP Header contains a Sequence Number which actually represents the sequence number of
the first byte of that particular TCP segment. A sequence number is a 32 Bit number which is attached  to
all bytes (data) being exchanged across a Network. The ACK Number Field in the TCP header, actually
contains the  value of the sequence number which it expects to be the next. Not only that, it also does what
it was meant to do, acknowledge  data received. Confused? Read it again till you get the hang of it.

When  a connection is established, the initial sequence number or ISN is initialized to 1. This ISN number
is then incremented by 128,000 every second. There is a certain patter according to which the sequence
numbers increment or change which makes then easy to predict.

To successfully perform IP spoofing or in order to predict Sequence Numbers, you need to be running a
form of UNIX, as Windows does not provide the users with access to really advanced system stuff.
Without a form of Unix IP Spoofing is almost impossible to do.

This text is not the ultimate guide to IP Spoofing and was aimed at only giving you a general outline of the
whole process. Sequence number Prediction is really, really sophisticated and difficult to understand, but
not impossible to do. However a system administrator can easily save his systems from IP spoofing and this
actually makes it quite useless, nonetheless truly exciting. If You really want to learn IP Spoofing I suggest
you read IP Spoofing Demystified by daemon9/route/infinity which was a part of Issue 48 of PHRACK
magazine, File 14 of 18. Go to the Archive Section of their site, http://www.phrack.com and click on Issue
48.

This brings me to the other purpose people use IP Spoofing, IP Masking. Now to something as simple as
mask or hide your IP you do not need to go through the complex procedure of guessing sequence numbers
and performing IP Spoofing. There are  proxy servers to do that for you. Read the Net Tools chapter for
further details.

Port Scanning in Networking Terms

Earlier we learnt what a Port scan is why it is considered to be such a important tool of getting information
about the remote host, which in turn can be used to exploit any vulnerabilities and break into the system.
We all know how a manual Port Scan works. You launch Telnet and manually Telnet to each Port jotting
down information that you think is important.  In a manual Port Scan, when you telnet to a port of a remote
host, a full three way handshake takes place, which means that  a complete TCP connection opens.

The earliest and the oldest version of Port Scanners used the same technique. They connected to each port
and established a full three way handshake for a complete TCP connection. The downside of such port
scanners was the fact that as a full TCP connection was being established, the system administrator could
easily detect that someone is trying to port scan his systems to find a vulnerability. However such port
scanning methods also had a bright side, as an actual TCP connection was being established, the port
scanning software did not have to build a Fake Internet Protocol Packet. (This IP Packet is used to scan the
remote systems.) Such TCP scanners too relied on the three-way TCP handshake to detect if a port is open
or not. The Basic process of detecting whether a port is open or not has been described below:

1.) You send a TCP Packet containing the SYN flag to remote host.
2.) Now the remote host checks whether the port is open or not. If the port is open then it replies with a
TCP packet containing both an ACK message confirming that the port is open and a SYN flag. On the
other hand if the port is closed then the remote host sends the RST flag which resets the connection, in
short closes the connection.