How to make someones day

[chsh]

Originally posted by Badassatchu

Dog you got it all wrong ... my bad





The idea is that you can send an email to someone .... from any adress that you desire, i sent my younger sister one that 'apparently' came from santa@northpole.com now hopefully she should really like this (or she might just go schizo)

Two things:



That's a standard, correct response from a mail server. Let's say that your ISP's mail server is running at a.net. I can telnet into *YOUR* ISP's mail server by going

telnet a.net 25

and do something like:

helo a.net

250 String Which varies from mail server to mail server

mail from: <santa.claus@northpole.net>

250 Sender OK (or other such similar acceptance)

Rcpt to: <you@a.net>

250 Recipient OK (etc..)

data

354 Type your message ending with "."

From: <santa.claus@northpole.net>

Subject: Merry Christmas & Happy New Year



Hi Billy,

You've been such a good boy this year, Santa's going to get you [insert name of product here] just like you wanted.



Santa

.

250 Message Accepted for Delivery



Server responses in Italics, my typing in bold.



This is all fine and dandy, and actually how mail servers have to work in order for email to function. I've never seen an ISP with a 'password protected' port 25. It's almost always host-based (for a reason).



The second thing is that while this is great and all, you can still track the IP of the sender from most well-behaved mail servers by looking at the extended headers in the email.

There is usually a line that reads:

Received: from my.host.name.com by mail.a.net for <you@a.net>

From well-behaved mail servers (qmail and Sendmail both behave this way by default IIRC), this reveals the ip address of the machine used to post it, so it's not smart to use this type of thing to send death threats.



Really all that's going on here is that you're connecting to the mail server as your client would and doing the same things.

The I.P i posted is of a mail server run by a ***** who claimed his free email server to be safe as houses and proceeded to shout obcenities at me ... yet you can login without a password through port 25? (no fire wall)

If it happens to be the mail server at your sister's ISP, then sure it will work. If not, and the guy's server is sitting there as an open relay, then I suggest you have some fun sending him emails from himself.



Peruse the BOFH files here for some ideas.



Isn't SMTP fun?

[Badassatchu]

hosts with firewalls do not let you in.

And i was sending the message to my little sis, shes 6 years old for christ sake ... shes not going to look at the extended headers.

I shall post a tut on how to read email headers sometime for those of you who reckon its not really bill@gates.com thats sending you insulting emails.

[ThePreacher]

I was just wondering if this sort of thing is illegal? I am pretty bad at this, and I dont want to get arrested for something stupid. Here are some mail servers I have found.

telnet mail.geocities.com 25
telnet w3.org 25
telnet erie.net 25
telnet eff.org 25


I couldnt get these to work after I typed in:

rcpt to:address@address.com

This came up:

"Relaying denied....IP name lookup failed"

What is the problem?

[lekt0r]

I have a question. I tried to connect to a few of my mail servers and I was refused every time. I am quite sure that they are behind a firewall, are there any servers out there that do work? Peace.

[Badassatchu]

All those you wrote have been patched against relaying...

Check out www.twizted.net, take a look atround for a smtp IP address. Use your brain it isnt really hard to find. His is not patched.

Oh and dont try thing like geocities etc the admin will probably get really pissed with all these people trying to this. Go for small time places like colleges etc.

[zone8]

Did you just read the ultimate guide to happy hacking?

[Badassatchu]

That to me? If so ... no i havnt where can get hold of it?

[Badassatchu]

The idea to post that came around after a long conversation with IchnisanIch ... we decided that other people might want to do it aswell.

[[WebCarnage]]

I was just wondering if this sort of thing is illegal? I am pretty bad at this, and I dont want to get arrested for something stupid. Here are some mail servers I have found.

Dude,...don't try any Geocities SMTP servers. Whenever I always did it i'd just use HotMails. It's the best so far. Since it's only dedicated to sending mail.

And dude, Rcpt to: <somebodiesrealaddress@whereever.net>, just incase. And maybe it could be your firewall blocking outgoing attempts on that port, sounds stupid but check it anyway (I highly doubt it though). Just play around, I doubt it's illegal. I mean it's like mailing your neighbor, except you use his return address instead. Nobody cares as long as the mail sent through fine and no anthrax is embeded within the letter. ...heh heh heh. (...no i'm only joking...but i'm dubious to beleive it's illegal.)

[chsh]

Originally posted by [WebCarnage]
Just play around, I doubt it's illegal. I mean it's like mailing your neighbor, except you use his return address instead. Nobody cares as long as the mail sent through fine and no anthrax is embeded within the letter. ...heh heh heh. (...no i'm only joking...but i'm dubious to beleive it's illegal.)

I'm no lawyer, but Fraud leaps to mind.