* - Release 3.0 -

* Portwolf, 2000

* E-mail

* Information Insemination
__________________________________________________
Forward
New in Release 3
Intro
Prerequisites
Intro to h/p/v/c
A little Hacker lingo
Ethics
What you need - a Hacker's equipment
Keeping from getting caught
TCP/IP and the Client/Server model
Getting Started - You're first night as a Newbie
UNIX
__________________________________________________

Forward
Imagine two rooms. Between these two rooms is a solid brick wall. We as human being have been conditioned to believe that this wall keeps us from moving from one room to the other. From the moment each of us were born, we have been taught that we cannot move between these rooms. We have been made to think according to predefined rules. We think… in a box. Boxthinkers. Hacking - by any definition - is the art of thinking outside of that box. To creatively formulate new, unconventional ways to do things. Dennis Ritchie (the creator of C), Linus Torvalds, the people at Xerox who invented the mouse. All became who they were for thinking outside the box. Kevin Mitnick, Kevin Paulson - accomplished the legendary computer and phone system break-in they did for not being boxthinkers. Computer hacking does require an amount of technical knowledge. That's why you're reading this manual. Arguably more important, though, is creativity. Resourcefulness, and an open mind. When shown a brick wall, know that it is possible to get into the other room - all you have to do is figure out how.

"You have to let it all go, Neo.
Fear. Doubt.
Free your mind."
-Morpheus, The Matrix

New in Release 3
Well, its 2000 now. Many Years ago hackers were very few, and pretty much unheard of. Now its the second millennium, with technology to show for it. And 'hackers in training' are getting their hands on computers and learning the craft in unbelievable quantities. This is partly due to the extreme drop in cost in computer hardware we've seen in the last few years. It also is due to the demystification of the craft of hacking, and others willing to share their information and secrets. Which is - of course - what this really is all about. Information. And getting it one way or another.
So here is my contribution to the technological underground. Are you a newbie at hacking? Are you completely new to this game, and find nothing but outdated and vague info on the subject? Look no further - this is the exact manual you've been looking for. Here you'll find the bare basics of hacking, including what kinds of programs you'll need and how to use them. You'll learn the basics of UNIX and NT. You'll learn how to crack any password. You'll learn how to defeat firewalls. If you already know the basics, you'll learn a variety of sophisticated techniques and tactics to add to your weaponry. And if you consider yourself a novice hacker already - great. You'll be able to dive right into the advanced NT and UNIX break-in techniques later in this text. If not - don't worry - you'll be able to do all this el33t stuph soon enough.
What will you find new in this release? I have a whole new section of exploits for various platforms, including CGI vulnerabilities, where to get code for them, etc. This should be a great resource to newbie and ueberhacker alike, it has a variety of vulnerabilities to keep an eye out for while hacking. Also, most of the existing sections have been updated and expanded upon, especially the NT and UNIX sections. Also, I took out the RFC on well-known ports, and just made one of my own - it seemed like a waste of space since you'll almost never see half of the ports listed there. The 'Elite Hacker Tactics' section has been filled with more 31337 k-rad stuph too. Also, this release is a bit more... resource full. By that I mean that this isn't a light-reading text that you'll read once and throw away. Most sections are pretty technical and full of content, so you'll probably have to read it a few times to get everything. Also, DV3 servers as resource material - tables and charts of important stuff that you'll want to refer to later. And if you're brand new to the world of h/p, some of the latter sections might confuse you - and will make sense after you've gained a bit of experience. This cannot be stressed enough: after you read a section try out what you've learned. Things will make more sense, and come together better.
One note though. Be sure to read the 'Keeping from Getting Caught' section before you actually try anything. Newbies who pull off their first hack tend to get overexcited and to stupid things. Be paranoid.
So sit back, crack open a can of Jolt Cola, and dig in.

Intro
The reason I wrote this is because there are a vast amount of "hacking for newbies" texts available on the Internet, most by very knowledgeable individuals. However, the vast majority are older, and cover dialup hacking only. To explain what I mean by that, let me categorize the various means in which a hacker gains access to a computer, supermini, mainframe, etc - into three distinct genres. There's the obvious on-site access, which is as simple as being in the premises of the system in question. There's dial-up access, which is simply using a modem to dial into another modem, and going from there. And finally, there's access via the Internet. On-site (relatively unfeasible in most cases) hacking is usually covered briefly in most of the readily available texts out there, though they mostly focus on dial-up hacking. The idea of connecting to a computer elsewhere with a modem has been around a long time, so therefore has the dial-up access method of hacking. But the Internet, having only been around for about 30 years, has not been a widely used method of access. Until recently. Actually, it hasn't been that recent, so why a guide to hacking on the internet hasn't already been written is beyond me. A few exceptions are The Happy Hacker's Guides to Mostly Harmless Hacking series. These
tutorials (available at www.happyhacker.org) certainly server their purpose but are also a bit limited. The primary focus of this text is hacking over the Internet. There's something avatar-like, almost omniscient about the ability to be able to do so much without leaving your house. Now, take any computer or network of any potential target of yours, and most likely they are connected to the Internet. Which means you, as a Internet-hacker-to-be can break into it. This is very good for people like us, because finding a computer or network on the Internet is much easier than finding a modem number (I'll explain how later). Now, you may on occasion find yourself actually dialing right in to a computer you attempt to break into, but most systems you target won't have a dial-in modem - this trend has faded with the explosion of the Net. One exception to this rule is NT's RAS (Remote Access Service), which I'll go into in the NT section, and in Appendix A.
One last thing before we get into the actual hacking stuff: this text will not teach you to be a hacker, nor will any text out there or any collection of texts. Hacking is a self-thought craft, meaning you will need the dedication to go out and find materials on your own. If you have a specific question, go ahead and ask someone on a hacker IRC channel of whatever, but if your question is too broad ('how do I hack into a Netware box?') you will be ridiculed and labeled a lamer. Keep your questions technical in nature ('what's the SMTP command to set the recipient'), and most will be happy to share their knowledge with you. Once you've completed this text, I suggest you play around with what you've learned (as 80% or so of what you learn will come from hands-on experience). Next you will need some material on topics just glazed over in this text. Get yourself a UNIX book, specifically: one on UNIX networking. Then get yourself a book on Windows Networking. These are also readily available. Definitely get yourself a TCP/IP book as you delve deeper into the hacking world. At one point, also, you'll almost have to learn at least one programming language (to become elite), so pick one, and get a book on it. Good ones to learn are: C and Perl. VB is good for all you Win32 gurus. Other books you should have in your collection are general hacking books. The book Maximum Security is very informative, as is Secrets The Happy Hacker. Hacking Exposed is a new one that I haven't seen yet, but heard good things about it. Secrets of a Super Hacker, Steal This Computer Book, and the New Hacker's Dictionary are at least worth checking out at your library. If all this seems like too much work, well then you probably lack the dedication to become a hacker. If you're still eager to learn - great! This text will point you in the right direction. So, without further adoo (adu?) - on with the hacking!

Prerequisites
First of all, let me say that it is assumed that the reader of this text already has a basic working knowledge of computers and the Internet. Not extensive, by any means. This text is targeted to people who probably have their own computer (or ready access to one), surf the web, and have always wanted to know what exactly hacking was all about. If you start reading and find yourself lost, put this down and go get yourself a basic book on computers and the Internet before you delve into this. For example, its assumed that you already know what a URL (web address) looks like (eg: http://www.hackers.com/archives). Also, you should know what a 'prompt' looks like (eg: C:\, %, or #).
This really goes without saying, but I as the writer of this text, take no responsibility in the actions of those who act based upon principals learned by reading this material. Really, this is intended to inform anyone who's always wondered how exactly these "hackers" they hear so much about do what they do, and for concerned system administrators who want to know how hackers can infiltrate their network. Breaking into systems then deleting all sort of stuff doesn't prove you're leetness, it proves your immaturity. This manual can make you a bad-guy in a day, so don't be. Okay, anyways, onto the good stuff.

Intro to h/p/v/c
This is an acronym you're sure to see a lot, or sometimes just h/p. This refers to activities of the digital underground. It stands for hacking/phreaking/virii/crypto.

Hacking
The subject of this manual. Arguably synonymous to the term 'cracking.' Though some might tell you that hacking means to creatively (and legally) explore different subjects of computers, like programming and networking; while cracking refers to breaking into various systems. I'll let you form your own definitions of each.

Phreaking
Phreaking, in a nutshell, is hacking the public telephone network (the PSTN). Phreaking isn't done with computers (most often) though. Now, there aren't really things to break into on the telephone network - so hacking might not be the exact term. Phreaking is more of exploring the phone network, learning how it works and how (in some cases) to circumvent traditional 'blocks.' Phreaks use what are called boxes. Ever heard of a redbox or a bluebox? These are the two most well-know phreaker tools. Redboxes are autodialers (available at Radio Shack) with a crystal of a different MHz used to generate the tones made when you drop coins into a payphone. Meaning - free calls. Nowadays these don't work on the newer payphones - but if you live in a smaller town with older systems, its worth a try. Blueboxes are used to gain the privileges of the average operator. Beige boxes (also called linesman handsets) are used to connect to phone box terminals that are located in various places. Other boxes include: the orange box, the yellow box, the black box, and pretty much any other color you can think of. For more info, get yourself a text on phreaking.

Virii
The plural of virus - meaning computer virus. Viruses really have nothing to do with hacking (contrary to the movie 'Hackers') - but are a component of the underground. Originally, viruses were written in assembly, which is like a very low-level programming language (the language used to write the programming languages). Assembly code is just a step above binary (ones and zeros), and isn't coherent at all. At any rate, creating viruses then was honorable only because of the complexity involved. Now, though, viruses are written in C, perl, C++, java, scripting languages (like javascript), and even ActiveX. Much less skill is required - making virus writing not much of an accomplishment. In fact, programs like Virus Lab exist that aid completely computer-stupid people in making their own viruses.
Types of viruses include: the boot sector virus. These infect (copy their code into) the boot sector of your hard drive (the MBR, specifically), so the every time you boot up, the virus is loaded into memory. A virus in memory is said to be 'active' - and once active, viruses can do whatever they were created to do. File viruses are another kind. They infect executables (applications) or
individual files. Whenever the infected program is run, or the infected file loaded into memory (eg: opening an infected MS Word file) the virus becomes active. Some less educated people may also tell you that a Trojan Horse is another kind of virus - in fact most virus checker software look for them also. Trojans are in fact, tools that we (hackers) use. They are back door programs, remote administration tools, fake login screens, even keyloggers are considered Trojans by some. Don't be confused though - Trojans are not virii. I'll go into more depth on Trojans later.

Crypto
Cryptography. Encryption is a security measure used in many ways. Put simply - encrypting something (a file, a word, whatever) changes it into something incomprehensible. For example, if I encrypted the word: 'windows', it might look something like: '2mkd032nwds'. The text or file before encryption ('clear text') is converted into the jargon ('cipher text') by means of an encryption algorithm. This is a complex mathematical and logical equation used to cipher data. Two common uses of encryption are password hashing and VPNs.
Whenever you log into any kind of computer system, the OS compares the password you entered to the password it has on file to determine if you entered the password correctly. However, keeping passwords on file is inherently insecure. The solution - encryption. The system (be it UNIX, NT, or whatever) keeps the passwords encrypted (called the 'hash'), and decrypts in temporarily just long enough to see if it matches what you entered. (This is all done in RAM, the password hashes in the actual password file on the hard disk stays encrypted).
Virtual Private Networks (VPNs) are two computers talking to each other over a publicly accessible network (usually the Net) that encrypt all data before sending it to one another. The machine on the other end of this link then decrypts it, and vice versa. This way, if the data is intercepted (by say, a sniffer - a tool you'll learn to use) it's incomprehensible to the interceptor. This is the same way SSL (Secure Socket Layer - encrypted HTTP or https) and SSH (Secure SHell - encrypted telnet sessions) work.
You can use encryption to your advantage. Get PGP (Pretty Good Privacy) or some other military-strength encryption scheme and encrypt your secret files (ie: your hacker stuph!). Federal authorities cannot force you - even in court - to give out the key to your encryption.

A little Hacker lingo
I'll get the jargon out of the way now, in case I refer to one of these terms later.
OS - Operating System. The OS handles CPU and memory usage of the system, manages applications, and provides the interface. Common OS's are: Windows, UNIX, MacOS, VMS, DOS, Netware, OS/2, and Be.
Hacker - one who infiltrates and explores various computer systems for the sole purpose of expanding their knowledge and satisfying their insatiable thirst for information.
Cracker - a hacker who acts maliciously. Deletes, crashes, implements viruses, etc.
Warez d00d - a lowlife techno weenie who sells pirated software (basically people who couldn't quite make it as a hacker).
Elite, leet, el33t, 31337, etc - a hacker who's learned just about everything there is to know regarding computers, networks, and security (not really possible). Many claim to be leet, very few are.
Newbie - an amateur hacker (different from a lamer).
Lamer - a complete hacker wannabe. The difference between a newbie and a lamer is this: a lamer knows a little bit, decides that's enough, and calls himself a hacker. A newbie also knows a little bit, but is humble enough to know that there is a lot more to be learned.
Root - status on any system that gives the hacker total control of it. Usually, root is the desired end result of any hack.
Shell - a shell is an interface between you as a user and a particular computer. Windows Explorer is a shell, DOS prompts are a shell. If you log into a UNIX machine, you are using a shell
Rootshell - A rootshell is a shell with root (superuser) privileges to resources on that machine. You can obtain a rootshell by either logging into the box as root (assuming you have the password) or by using an exploit program to create a rootshell for you (more on this later).
Packet - when data is sent over a network, it is broken down into manageable chunks called packets. This isn't always the case, but in TCP/IP (the protocol used on the Internet), this is always true.
Protocol - a set of rules and guidelines that computers on a network must follow in order for communications to be coordinated, and therefore successful. A protocol defines specifically how data is broken into packets, sent over a wire, and reassembled at the other computer (and how sessions are set up over a network).
Client - Usually refers to either A: a computer on a network that requests resources from a server, or a computer that is not a server; or B: a program that makes request of a server or service. Netscape Navigator and Internet Explorer are client software programs in that they request web pages from servers.
Server - Either A: a computer set up to share resources such as printers, files, or serve web sites, or B: a program used to fofull requests, such as IIS (Microsoft's Internet Information Server). More on clients and servers later.
Proxy Server - Okay, if a company has its own network and its own website, there will be a portion of the network accessible (with a username and password, of course) by anyone with Internet access. All the HTML files for the company's website will be somewhere on this segment of the network. Then, there will be the portion of the network strictly for business purposes, hidden from the rest of the world. A proxy server (along with sometimes a firewall) separates these two segments. So if you want to access the restricted part of any network, you will need to do it via the proxy server. Also, if all the workstations in an office have Internet access, they most likely do through the proxy server.
Firewall - Sort of like a proxy server, but has no other purpose but to keep unauthorized user out. Even if you have a valid username and password for a system - if a firewall is in your way, you're pretty much out of luck. Hacking through one is very difficult -even for the leet. It is possible, though, and I've provided a few techniques and angles to cracking them in the Firewall Penetration section.
Daemon - A daemon is a program that is active but does nothing until a certain condition becomes true (similar to a TSR, or program in your Win9X system tray). Daemons often 'listen' on certain TCP ports of a machine on the Net, and when a connection is made, they will do what intended. For example, when you browse www.hotmail.com, you're browser connects to TCP port 80, and the daemon listening on that port (httpd, usually) sends you a copy of the web page you requested. More on this later.

Ethics
I won't bore you with the usual "never use your powers for evil" stuph, but I have to throw out my opinion on ethics. Hacking maliciously, be it by deleting files, screwing with configurations, or what have you, besides being just plain mean, is a sure way to motivate people into tracing you. As a rule, you should never change any files on a system you break into. The lone exception to this is altering log files to cover your tracks (explained later). Hacking webpages - changing the default web page to 'Pheer me! This box was haxored by M4nt|S' - is a bit of a gray area. Technically, its considered malicious, and will piss the sysadmin of the network off. But if you must - at least back up the original index.html or default.htm file.

What you need - a Hacker's equipment
Here is a basic list of the hardware, software, and other miscellaneous things you will need to begin your days in the world of digital espionage.
· A computer (duh) with some kind of Internet access, be it PPP, a T1, or whatever (more on this later).
· One, preferably two accounts with an ISP, your phone company, or whatever. One should be in no way shape of form attached to you (ie: someone else's account!) More on this later.
· The following software:
An Internet browser.
A telnet client.
An FTP client.
A ping utility.
An IP scanner.
A port scanner.
A whois and nslookup utility.
A traceroute utility.
A password cracker.
Less necessary but very useful utilities include:
A CGI vulnerability scanner
A Net BIOS share scanner.
A cenzurat client.
Compilers.
Cache rippers.
A brute force program of some sort.
Trojans, rootkits, and RAT's.
Internet warfare tools.
Sniffers.
Keyloggers.
Sound complicated already? Its really not - I'll explain the function of each, along with some good ones of each. Almost all the programs I talk about here are available at The CyberUnderground (http://home.cyberarmy.com/tcu). Otherwise, try www.hackersclub.com, www.hackers.com, www.anticode.com, or just do a search online.

Internet Browsers
If you don't know what this is or where to get one, you should probably put this manual away. IE and Netscape are the two biggies. Lynx is phun to surf with on occasion (UNIX). Whatever browser you use, make sure it allows for the use of proxies. IE and Netscape do (even the older versions), so now would be a good time to familiarize yourself with the proxies options for each (more on this later). Also, make sure your browser supports gopher (which is kinda like HTML but only text) incase you stumble upon an old gopher server - these can be goldmines of information! IE and Netscape support gopher - to use it just type gopher:// instead of http://.

Telnet Clients
Almost any OS you get these days has some sort of telnet client. Just type 'telnet' at a command prompt (Windows or UNIX). This is the primary means in which you'll connect to computers, and though its a simple enough program, to hack you'll have to become very familiar with how it works. Though fine for newbies, you'll probably find the Windows telnet client a bit... lackluster later in your hacking career. PuTTY is a good replacement (which, by the way, supports SSL and raw TCP connections - very handy). Whatever you use, make sure you can log (record) your sessions to a text file. The Windows client does allow for this, so try it out.

FTP Clients
FTP is the Internet protocol used to transfer files between two computers, though I'll go into more depth on this later. Both UNIX and Windows 9X come with command-line FTP clients. IE and Netscape have built-in FTP clients, and are even a GUI. The downside of them is that you can't issue commands. To use it, just type ftp:// instead of http://. You can also buy full-blown GUI FTP clients like WS FTP (www.ipswitch.com), and FTP Explorer (www.microsoft.com). My personal opinion, though, is that command-line is faster and gives you more control.

Ping Utilities
Both UNIX and Windows 9X have command-line ping utilities. Ping is a simple program (part of the ICMP protocol - which you'll learn later) with one purpose: to test the connectivity between two machines. To ping a computer type:

%ping www.computername.com
(the '%' is a UNIX prompt - similar to C:\)
If there is an unblocked path between you and www.computername.com, the ping will be returned by a pong, a reply. Ping is used to test connections, and to determine the time it takes for the ping packet to make a round trip. For example, a successful (unblocked) ping might look like:

c:\ping www.msn.com
pinging www.msn.com [221.54.64.7] with 32 bytes of data:
Reply from 221.54.64.7: bytes=32 time=100 ms TTL=32
Reply from 221.54.64.7: bytes=32 time=90 ms TTL=32
Reply from 221.54.64.7: bytes=32 time=95 ms TTL=32
Reply from 221.54.64.7: bytes=32 time=100 ms TTL=32

Whereas an unsuccessful ping might look like:

c:\ping 201.33.250.1
pinging 201.33.250.1 with 32 bytes of data:
unable to establish connection

You can play around with switches to send pings of different payloads (sizes), number of packets, and TTL. With both UNIX and Windows pings, you can get an IP address from a host name, and vice versa. More on IP addresses later.

IP Scanners
Sometimes called a subnet scanner. Ever heard of a wardialer? A wardialer is a program used by old-school hackers. All it did was dial phone numbers in a specified range looking for modems. An IP scanner does the same thing - enter a range of IP addresses or a subnet, and it will ping each address in that range or subnet to determine if that address belongs to a computer (and if it is reachable, ie: not blocked by a firewall, proxy server, or router). Most IP scanners prompt you for a start address and an end address - and it will attempt to ping every address in between. Subnet scanners, though, ask for the first three octets, and it will scan from .1 to .254 (the entire block). If you don't know how IP addressing works, you will after reading the TCP/IP section. Here's an example IP scanner output screen:

Scan from: 130.11.8.1
Scan to: 130.11.8.10
-------------------------------
Scanning from 130.11.8.1 to 130.11.8.10
130.11.8.1: Connected
130.11.8.2: Connection Refused
130.11.8.3: Connection Refused
130.11.8.4: Connection Refused
130.11.8.5: Connection Refused
130.11.8.6: Connected
130.11.8.7: Connected
130.11.8.8: Connection Refused
130.11.8.9: Connected
130.11.8.9: Connection Refused
130.11.8.9: Connected

A 'connected' means that the machine can be pinged, or connected to. A 'connection refused' means that either no computer belongs to that IP address, or that the machine isn't accessible to you: behind a firewall or proxy server. Some IP scanners show each machine in the scan, while others only show the ones that were successfully connected to.
Good IP scanners are: HakTek, WS PingProPack, and Shadow Scan. Online scanners are available at places such as http://infinityzone.cjb.net.

Port Scanners
A port scanner scans a particular IP address or hostname (a particular computer) for open ports. No, I don't mean serial or parallel ports. TCP ports - services, programs running on that server that can be connected to. The concept of ports will be explained in detail in the TCP/IP section of this manual. For now, just know that port and IP scanners are two very important tools you'll need. Output from a port scanner might look something like:

Scan: 20.1.139.21
Scan from: 1
Scan to: 1024
-------------------
Scanning from TCP port 1 to port 1024
Open: 16 (chargen)
Open: 21 (ftp)
Open: 23 (telnet)
Open: 25 (smpt)
Open: 80 (www)
Open: 79 (cenzurat)

This means that ports 16, 21, 23, 25, 79, and 80 are open an this particular machine (20.1.139.21). Port numbers are generally used for a specific service, for example an open port 79 almost always is used for cenzurat (the cenzurat daemon, or service).
Good port scanners are: NMap (UNIX), HakTek, WS PingProPack (which will scan IP ranges and ports on each one), and YAPS. Online scanners are available also. These are nice because the server running the scan scripts do the scanning, meaning their IP addresses get logged on the target machine - not your own. This is a good way to keep from being traced.

Whois and NSLookup
Whois is a utility used to find out who a particular domain name (eg: hackersclub.com) belongs to. If you whois a site, you'll get the address, phone number, and email address of the technical contact (probably the system administrator) and the administrative contact (probably the owner or person who runs that name / business) of it. NSlookup, on the other hand, is a utility to find out what domain a particular hostname or IP address belongs to, and what name servers represent it. This is useful when trying to map out networks, and find determine all machines belonging to a certain domain. The concept of mapping networks, name servers, and the like will be explained in more detail in later sections. Here is a sample whois query:

%whois aol.com
connecting to rs database...connected
America Online (AOL-DOM)
12100 Sunrise Valley Drive
Reston, Virginia 22091
USA
Domain Name: AOL.COM

Administrative Contact:
O'Donnel, David B E-mail
(730) 453-4255
Technical Contact:
America Online E-mail
(730) 453-4160

Record last updated on 13-mar-97
Record created on 22-jun-95

Domain Servers listed in order:
dns-01.aol.com 152.163.12.1
dns-aol.fu.net 122.56.87.3

By whois-ing aol.com, we get a wealth of (public) info. We get phone numbers to social engineer if need be (explained later). We get email addresses (valid login names). We get the hostnames and IP addresses of the DNS servers (also explained later). All things to be noted when trying to hack a particular domain.
Here's an example nslookup query:

%nslookup oliver.mail.tlsp.com
[no name] (oliver)
Hostname: oliver.mail.tlsp.com
Address: 103.222.54.8
System: SUN running SUNOS
nameserver: ns1.mail.tlsp.com
nameserver: ns.tlsp.com
nameserver: ns2.tlsp.com
nameserver: name.att.net

So, let's say that we wanted some info on the computer oliver.mail.tlsp.com. We run an nslookup on it, as shown above, and look at all the stuff we get. The IP address, what kind of machine it is (a Sun box), the OS (SunOS - a flavor of UNIX). We get all the domain name servers for that domain - including tlsp.com's upstream provider - their ISP. All very useful information. If you're new to hacking and aren't sure how all this info will help you break in, you will as you get further into this manual.
UNIX has whois and nslookup built right in - just type either at a prompt. Windows, however, doesn't - you'll have to go and get nslookup and whois utilities for your Windows box. Good ones are Sam Spade and WS_PingPrpPack - both available at TCU. What's the difference between whois and nslookup? You whois a domain name (something.com), whereas you nslookup a particular machine (IP address or host name). Now would be a good time to download one of each (both programs listed above have both utilities) and play with them a bit.

Traceroute
The Internet is an internetwork (hence the name), meaning a network of networks. These individual networks are connected together by sophisticated pieces of hardware called routers. Oftentimes, there are multiple routes between your computer and any other on the Net. Traceroute utilities do just that - trace the route between you and any computer you specify, listing the IP address of any router it passes through to get there. Traceroute is used to troubleshoot network problems, mostly. As a hacker you can do a number of things with traceroute. If you're being blocked from a particular IP address on the Net, you can run a traceroute to it and find out exactly where you're being blocked at. Also, you can find your target's upstream provider with traceroute - handy in mapping networks and
learning more about your potential victim. Both UNIX and Windows have traceroute utilities built in: for UNIX, type 'traceroute', for Windows type 'tracert' at a command prompt. Output from a traceroute might look like:

C:\tracert www.yahoo.com
tracing route to www.yahoo.com [250.217.111.6]
over a maximum of 30 hops:
1 150ms 144 ms 138 ms dialup-b.yourisp.net (110.135.87.4)
2 99 ms 145 ms 150 ms cisco7k.mr.com (32.55.87.1)
3 100 ms 144 ms 161 ms routel2.uswest.com (98.2.3.78)
4 160 ms 160 ms 143 ms gateway.con324.att.net (178.68.111.3)
5 147 ms 162 ms 177 ms intern.net3.yahoo.com (250.23.87.2)
6 171 ms 168 ms 165 ms www.yahoo.com (250.11.45.87)
trace complete

Here we had to go through 4 routers to get to www.yahoo.com. The first entry (dialup-b.byourisp.net) is your computer - the last is your destination. Now, pretend for a minute that www.yahoo.com was blocked by a firewall. Then your traceroute might look like:

C:\tracert www.yahoo.com
tracing route to www.yahoo.com [250.217.111.6]
over a maximum of 30 hops:
1 150ms 144 ms 138 ms dialup-b.yourisp.net (110.135.87.4)
2 99 ms 145 ms 150 ms cisco7k.mr.com (32.55.87.1)
3 100 ms 144 ms 161 ms routel2.uswest.com (98.2.3.78)
4 160 ms 160 ms 143 ms gateway.con324.att.net (178.68.111.3)
intern.net3.yahoo.com reports: host unreachable

Here intern.net3.yahoo.com is telling us that it wont let any our packets get past it. Most likely a firewall of some sort. If ever you can't connect to an IP address or hostname that you know to be valid, traceroute to it and find out what's blocking you. Now, if you look at all this hostname and IP address stuph and scratch your head - don't worry. You'll understand better after reading the 'TCP/IP and the Client/Server Model' section.

Password Crackers
As described in the Crypto section of 'Intro to h/p/v/c', the passwords of any computer system are encrypted. Oftentimes your ultimate goal in hacking into a machine will be to get the file that holds these passwords. This step, though difficult, is usually one of your last. So if you can get your hands on /etc/passwd of a UNIX box, or the sam._ file or a registry dump from an NT box, you'll want a password cracker program to decrypt the hashes. How do these work? Well, most OS's (including NT, Netware, and UNIX) use the DES (Digital Encryption Standard) encryption form. So knowing that, its possible to decrypt the password hashes, with the aid of a dictionary. Yes, a dictionary - in this case a file of thousands of words. What the cracker program will do is take each word from the dictionary file, encrypt it using DES, and see if the encrypted dic word matches the encrypted password. If so - that word is (95% of the time) the password. Needless to say, the bigger the dictionary file, the more likely you are to crack passwords. Some crackers have the option to try every combination of characters possible (instead of using wordlist files), but this takes time - and is a CPU cycle hog.
What password cracking program you need depends on the type of password you want to hack.
UNIX passwords: John the Ripper (for DOS and Windows) and Cracker Jack (for UNIX) are the most popular crackers for this OS. Many others exist, like a program called Crack, but JtR and CJ work the best.
NT passwords: L0pht Crack is the most reputable and best NT cracker around. You can crack sam._ files (the password file), or you can dump the local or remote registry (system database) and collect the SAM hive right into your L0pht program, and crack em that way. Other NT crackers exist, but don't even come close to the speed and power of LC.
Windows9X passwords: Win9X stores passwords in .pwl files. A johna.pwl file the encrypted password for user 'johnh.' A handful of crackers for pwl's exist, the best probably being Glide.
Other types of passwords are Novell Netware passwords, IRC passwords, Wwwboard passwords, FTP passwords (for standalone ftp servers), and the like - and a password cracker for each exists - just search the Net.

CGI Vulnerability Scanners
CGI and how to exploit it is explained later in this text. Basically, these scanners look for CGI scripts on a specified webserver that can be exploited. WebChk is a good one for Windows, as is Nessus, and SATAN for UNIX. Online CGI scanners are sometimes found online, like at infinityzone.cjb.net.

Net BIOS Share scanner
A Share (as explained in the NT section) is a directory available to people on a network. Sharescanners just scan an IP address range or subnet for these shares. This (like any kind of scanning) can be done manually, but scanner software speeds the process up. WinHack Gold is a decent share scanner for UNIX, and Legion is a good one for Windows

cenzurat Clients
Though cenzurat (explained later - sorry) can be done manually by telnetting into the cenzurat port, sometimes its useful to have a cenzurat client too. UNIX has a built in client - just type 'cenzurat.' Clients for Windows include: WS PingProPack, WS cenzurat, and HakTek.

Compilers
Most exploits you find (little programs that exploit programming vulnerabilities in programs) are not c