War Tools! -- continued
What really saddens me is how many people
ask me for good host names they can use. It is so easy to
find them yourself!
If you want to be primitive about
it, you can scan for IP addresses by hand. Find a tempting
domain name while surfing the web, running traceroute or tracert,
or in the headers of email. Then try the techniques of the
"Port Surf's Up!" chapter to see if there is anything
interesting there. This is a good way to start, because
you know exactly what you are doing and can get a gut feel for
the process. Also, it's quite a rush to discover something
rare like the Internet backbone VAX/VMS in the port surfing chapter
-- and discover that it is advertising the status of its huge
network to you from port 15!
There also are programs that will
find live Internet host computers for you automatically. Many
of these tools will also map which ports are open. They
won't always give you all the goodies you can get when you port
surf by hand, but they find out the basics for you fast.
You can get punched
in the nose warning: The downside of the IP scanner and
port scanner tools of this chapter is that when you use them
on other people's computers without permission, this practically
shouts "I am a criminal hacker." Presumably this
isn't true, but way too many sysadmins have discovered that a
port scan is soon followed by a break-in attempt.
If you do
insist on scanning without permission, it helps to scan Internet
hosts owned by other hackers. If people who are obviously
hackers complain, the sysadmins at your ISP or company LAN may
not have much sympathy for them. Hey, they are hackers,
they can take care of themselves. However, if you do this
without the hackers' permission, you just might incite a hacker
war against you, which may nevertheless lead to losing your Internet
access.
So we're ready to scan for Internet hosts and their ports. Let's
start with how newbies can do it. You can get a Windows
95/98 program that scans IP addresses and ports, What's Up Gold,
from http://www.ipswitch.com. It's
free for a one month trial. It's a simple point and click
program that does an excellent job.
Here's what I get when I scan IP addresses
from 198.987.999.1 through 198.987.999.254 looking for any open
ports in the range of 1 through 600. This scan is set to
check each port by waiting only 100 milliseconds for a response
from each one:
198.987.999.033
198.987.999.036 80
198.987.999.044
198.987.999.048
198.987.999.049
198.987.999.066
198.987.999.067
198.987.999.074
198.987.999.080
198.987.999.113
198.987.999.115
198.987.999.118
198.987.999.167
More War Tools! -->
