Re[2]: [hlds_linux] Reporting Server Hackers

2003-07-23 Thread Jan Brunner
MS> I'm still waiting for you to sniff a password from my clear-text MS> POP3 server. You don't have to tell us how and release this MS> exploit, just prove that it works by doing something useful. Just to back Britt up a bit: I've just read a documentation about ARP hacking techniques and I unders

Re: [hlds_linux] Reporting Server Hackers

2003-07-23 Thread jerzy szczudlowski
Britt Priddy (PZGN) wrote: > > Yeah - like I said - "I have no idea what I'm talking about" > Whats even more frightening is that I passed the CCIE exam with flying > colors - but I cheated right? :P Finally you admitted that. ___ To unsubscribe, edit

RE: [hlds_linux] Reporting Server Hackers

2003-07-23 Thread Tyler \"Overkill\" Schwend
IF what you're talking about was even remotely possible, every website on Earth would have been hacked already, email passwords would be useless, and in fact considered a security risk, and anything unencrypted would be sniffed out by every script kiddy on the net. - Tyler "[TASF]Overkill"

Re: [hlds_linux] Reporting Server Hackers

2003-07-23 Thread Frank Stollar
Kevin J. Anderson wrote: I cant believe you guys are STILL talking about this... Hey, this is one of the best and most productive discussions since months :) SCNR Frank ___ To unsubscribe, edit your list preferences, or view the list archives, please vis

RE: [hlds_linux] Reporting Server Hackers

2003-07-23 Thread Britt Priddy (PZGN)
Yeah - like I said - "I have no idea what I'm talking about" Whats even more frightening is that I passed the CCIE exam with flying colors - but I cheated right? :P LOL - I'm outta this discussion - its only going to lead to more wanna be hackers on the net. Enjoy!

RE: [hlds_linux] Reporting Server Hackers

2003-07-23 Thread Kevin J. Anderson
I cant believe you guys are STILL talking about this... ->-Original Message- ->From: [EMAIL PROTECTED] ->[mailto:[EMAIL PROTECTED] Behalf Of Frank ->Stollar ->Sent: Wednesday, July 23, 2003 4:33 PM ->To: [EMAIL PROTECTED] ->Subject: Re: [hlds_linux] Reporting Server Hackers -> -> ->Floria

Re: [hlds_linux] Reporting Server Hackers

2003-07-23 Thread Frank Stollar
Florian Zschocke wrote: "Britt Priddy (PZGN)" wrote: LOL Florian - that is where I sit. (the spoofed packet):P LOL Britt - I'm not sure what you are trying to tell me. :) That MAC address is a Cisco MAC address and I am 95% sure that Frank doesn't have a NIC with a Cisco MAC address. So I gu

RE: [hlds_linux] Reporting Server Hackers

2003-07-23 Thread Mad Scientist
According to the great words of PZGN: > That's ok - I know it's a Cisco MAC Address - but I have to stop here - > I'm not going to be the guy that spills out the fire on how things are > done behind the scenes. We can leave it at, "I have no idea what I'm > talking about" - or "I'm wrong and a wan

Re: [hlds_linux] Reporting Server Hackers

2003-07-23 Thread Mad Scientist
According to the great words of Florian Zschocke: > Well, then excuse me for being a nitpicker but since this subject is > infested with too much half-truths and incomplete facts, I thought it > was worth pointing out that this statement wasn't a bit unprecise. :) No > offence. Since we're maximiz

RE: [hlds_linux] Reporting Server Hackers

2003-07-23 Thread Britt Priddy (PZGN)
That's ok - I know it's a Cisco MAC Address - but I have to stop here - I'm not going to be the guy that spills out the fire on how things are done behind the scenes. We can leave it at, "I have no idea what I'm talking about" - or "I'm wrong and a wanna be :P" - just for sakes argument. So - ba

RE: [hlds_linux] Reporting Server Hackers

2003-07-23 Thread Mad Scientist
According to the great words of PZGN: > Ok - to clear the confusion - this is done by spoofing and placing > yourself on that local segment - and you can obtain any MAC address you > are able to connect to - note I pulled the MAC of the IP of the guy that > asked me to look at it - this was done by

Re: [hlds_linux] Reporting Server Hackers

2003-07-23 Thread Florian Zschocke
"Britt Priddy (PZGN)" wrote: > > LOL Florian - that is where I sit. (the spoofed packet):P LOL Britt - I'm not sure what you are trying to tell me. :) That MAC address is a Cisco MAC address and I am 95% sure that Frank doesn't have a NIC with a Cisco MAC address. So I guess I still didn't qui

Re: [hlds_linux] Reporting Server Hackers

2003-07-23 Thread Florian Zschocke
Frank Stollar wrote: > > Sorry for the simple misunderstanding as I only talked about 'ethernet > ARP' as we are taking about MAC addresses. Well, then excuse me for being a nitpicker but since this subject is infested with too much half-truths and incomplete facts, I thought it was worth pointing

Re: [hlds_linux] Reporting Server Hackers

2003-07-23 Thread Frank Stollar
Britt Priddy (PZGN) wrote: Ok - to clear the confusion - this is done by spoofing and placing yourself on that local segment - and you can obtain any MAC address you are able to connect to - note I pulled the MAC of the IP of the guy that asked me to look at it - this was done by sitting on his n

Re: [hlds_linux] Reporting Server Hackers

2003-07-23 Thread Florian Zschocke
"Britt Priddy (PZGN)" wrote: > > Ok - to clear the confusion - this is done by spoofing and placing > yourself on that local segment - and you can obtain any MAC address you > are able to connect to Right, any MAC address you are able to *connect to*. You are not able to connect to any MAC address

Re: [hlds_linux] Reporting Server Hackers

2003-07-23 Thread Frank Stollar
Florian Zschocke wrote: Frank Stollar wrote: Espacially this would be very hard if anywhere between two routers is no ethernet-link but ATM or any other Layer2 protocol. In no other Layer2 are ARPs present. Uhm, no. ARP is not restricted to Ethernet. As ATM hast no MAC adresses, ARP would not wo

Re: [hlds_linux] Reporting Server Hackers

2003-07-23 Thread jerzy szczudlowski
Florian Zschocke wrote: > > Espacially this would be very hard if anywhere between two routers is no > > ethernet-link but ATM or any other Layer2 protocol. In no other Layer2 > > are ARPs present. > > Uhm, no. ARP is not restricted to Ethernet. But on the other hand some historic PROnet or ARCnet

RE: [hlds_linux] Reporting Server Hackers

2003-07-23 Thread Britt Priddy (PZGN)
LOL Florian - that is where I sit. (the spoofed packet):P -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Florian Zschocke Sent: Wednesday, July 23, 2003 2:27 PM To: [EMAIL PROTECTED] Subject: Re: [hlds_linux] Reporting Server Hackers "Britt Prid

RE: [hlds_linux] Reporting Server Hackers

2003-07-23 Thread Britt Priddy (PZGN)
Ok - to clear the confusion - this is done by spoofing and placing yourself on that local segment - and you can obtain any MAC address you are able to connect to - note I pulled the MAC of the IP of the guy that asked me to look at it - this was done by sitting on his network with a spoofed pack

Re: [hlds_linux] Reporting Server Hackers

2003-07-23 Thread jerzy szczudlowski
Florian Zschocke wrote: > Someone is running a cs/tfc server on a Cisco router? Wow, that is a new > one to me! :) Well, you can "forward" ports :) ___ To unsubscribe, edit your list preferences, or view the list archives, please visit: http://list.val

Re: [hlds_linux] Reporting Server Hackers

2003-07-23 Thread Florian Zschocke
Frank Stollar wrote: > > Espacially this would be very hard if anywhere between two routers is no > ethernet-link but ATM or any other Layer2 protocol. In no other Layer2 > are ARPs present. Uhm, no. ARP is not restricted to Ethernet. Florian. ___ To un

Re: [hlds_linux] Reporting Server Hackers

2003-07-23 Thread Florian Zschocke
"Britt Priddy (PZGN)" wrote: > > As for your machine - I see SSH running that's pretty much it as far as > anything I can connect to to establish an open connection. > IP 141.84.69.34 = MAC = 00:09:b7:27:84:a0 > Almost 99% UDP traffic is seen - which as you probably know is just raw > data in clea

Re: [hlds_linux] Reporting Server Hackers

2003-07-23 Thread jerzy szczudlowski
Britt Priddy (PZGN) wrote: > I understand the logic you're thinking and how easy it is to 'sniff' > traffic even on a network that is not inline - but all you have to do is > get an arp request from the IP in question - which then gives you the Which you cannot get, unless you are on the same Ethe