|
|
|
[ Pobierz całość w formacie PDF ]
only field that shows which gives information on the handling of the message is the Date field.
When we expand to a full header, we are able to see all the fields of the header. We will now go through this
information line by line.
Received: by o200.fooway.net (950413.SGI.8.6.12/951211.SGI)for techbr@fooway.net id OAA07210; Fri, 11
Apr 1997 14:10:06 -0400
This line tells us that I downloaded this email from the POP server at a computer named o200.fooway.net.
This was done on behalf of my account with email address of techbr@fooway.net. The
(950413.SGI.8.6.12/951211.SGI) part identifies the software name and version running that POP server.
********************************************
Newbie note: POP stands for Post Office Protocol. Your POP server is the computer that holds your email
until you want to read it. Usually your the email program on your home computer or shell account computer
will connect to port 110 on your POP server to get your email.
A similar, but more general protocol is IMAP, for Interactive Mail Access Protocol. Trust me, you will be a
big hit at parties if you can hold forth on the differences between POP and IMAP, you big hunk of a hacker,
you! (Hint: for more info, RTFRFCs.)
********************************************
Now we examine the second line of the header:
Received: from ifi.foobar.no by o200.fooway.net via ESMTP (950413.SGI.8.6.12/951211.SGI)for
id OAA18967; Fri, 11 Apr 1997 14:09:58 -0400
Well, gee, I didn t promise that this header would be *totally* ordinary. This line tells us that a computer
named ifi.foobar.no passed this email to the POP server on o200.fooway.net for someone with the email
address of hacker@techbroker.com. This is because I am piping all email to hacker@techbroker.com into the
account techbr@fooway.net. Under Unix this is done by setting up a file in your home directory named
.forward with the address to which you want your email sent. Now there is a lot more behind this, but I m
not telling you. Heh, heh. Can any of you evil geniuses out there figure out the whole story?
ESMTP stands for extended simple mail transfer protocol. The 950413.SGI.8.6.12/951211.SGI
designates the program that is handling my email.
Now for the next line in the header:
Received: from gyllir.ifi.foobar.no (2234@gyllir.ifi.foobar.no [129.xxx.64.230]) by ifi.foobar.no with ESMTP
(8.6.11/ifi2.4) id for ; Fri, 11 Apr 1997 20:09:56 +0200
This line tells us that the computer ifi.foobar.no got this email message from the computer gyllir.ifi.foobar.no.
These two computers appear to be on the same LAN. In fact, note something interesting. The computer
name gyllir.ifi.foobar.no has a number after it, 129.xxx.64.230. This is the numerical representation of its name.
(I substituted .xxx. for three numbers in order to fubar the IP address.) But the computer ifi.foobar.no
didn t have a number after its name. How come?
Now if you are working with Windows 95 or a Mac you probably can t figure out this little mystery. But
trust me, hacking is all about noticing these little mysteries and probing them (until you find something to
break, muhahaha -- only kidding, OK?)
But since I am trying to be a real hacker, I go to my trusty Unix shell account and give the command:
>nslookup ifi.foobar.no
Server: Fubarino.com
Address: 198.6.71.10
Non-authoritative answer:
Name: ifi.foobar.no
Address: 129.xxx.64.2
Notice the different numerical IP addresses between ifi.foobar.no and gyllir.ifi.foobar.no. Hmmm, I begin to
think that the domain ifi.foobar.no may be a pretty big deal. Probing around with dig and traceroute leads me
to discover lots more computers in that domain. Probing with nslookup in the mode set type=any tells me
yet more.
Say, what does that .no mean, anyhow? A quick look at the International Standards Organization (ISO)
records of country abbreviations, I see no stands for Norway. Aha, it looks like Norway is an arctic land
of fjords, mountains, reindeer, and lots and lots of Internet hosts. A quick search of the mailing list for
Happy Hacker reveals that some 5% of its almost 4,000 email addresses have the .no domain. So now we
know that this land of the midnight sun is also a hotbed of hackers! Who said headers are boring?
On to the next line, which has the name and email address of the sender:
From: Vegbar Fubar
Received: from localhost (Vegbarha@localhost) by gyllir.ifi.foobar.no ; Fri, 11 Apr 1997 18:09:53 GMT
I m going to do some guessing here. This line says the computer gyllir.ifi.foobar.no got this email message
from Vegbar Fubar on the computer localhost. Now localhost is what a Unix computer calls itself. While
in a Unix shell, try the command telnet localhost. You ll get a login sequence that gets you right back into
your own account.
So when I see that gyllir.ifi.foobar.no got the email message from localhost I assume that means the
sender of this email was logged into a shell account on gyllir.ifi.foobar.no, and that this computer runs Unix.
I quickly test this hypothesis:
> telnet gyllir.ifi.foobar.no
Trying 129.xxx.64.230...
Connected to gyllir.ifi.foobar.no.
Escape character is '^]'.
IRIX System V.4 (gyllir.ifi.foobar.no)
Now Irix is a Unix-type operating system for Silicon Graphics Inc. (SGI) machines. This fits with the name of
the POP server software on ifi.foobar.no in the header of (950413.SGI.8.6.12/951211.SGI). So, wow, we are
looking at a large network of Norwegian computers that includes SGI boxes. We could find out just how
many SGI boxes with patience, scanning of neighboring IP addresses, and use of the Unix dig and nslookup
commands.
Now you don t see SGI boxes just every day on the Internet. SGI computers are optimized for graphics and
scientific computing.
So I m really tempted to learn more about this domain. Oftentimes an ISP will have a Web page that is found
by directing your browser to its domain name. So I try out http://ifi.foobar.no. It doesn t work, so I try
http://www.ifi.foobar.no. I get the home page for the University of Oslo Institutt for Informatikk. The
Informatikk division has strengths in computer science and image processing. Now wonder people with
ifi.foobar.no get to use SGI computers.
[ Pobierz całość w formacie PDF ]
zanotowane.pldoc.pisz.plpdf.pisz.plkwiatpolny.htw.pl
|
|
| Cytat |
Dobre pomysły nie mają przeszłości, mają tylko przyszłość. Robert Mallet
De minimis - o najmniejszych rzeczach.
Dobroć jest ważniejsza niż mądrość, a uznanie tej prawdy to pierwszy krok do mądrości. Theodore Isaac Rubin
Dobro to tylko to, co szlachetne, zło to tylko to, co haniebne.
Dla człowieka nie tylko świat otaczający jest zagadką; jest on nią sam dla siebie. I z obu tajemnic bardziej dręczącą wydaje się ta druga. Antoni Kępiński (1918-1972)
|
|
