Telnet, Putty?

[kilerboots]

Well I know that this has been discussed before but I wanted to ask this. I was looking and people were saying not to use telnet. I was wondering why not. Also everyone said use putty could someone tell me the difference and which you should use. Maybe even a good link for both.

>That would be great!!
>
>Thanks.

[g00n]

putty's a free ssh client that does telnet and raw communications... Telnet connections are plaintext, meaning that anyone between you and the server can see exactly what you are typing... including your password... ssh stands for (secure shell)... meaning that all communication between you and the server are encrypted. Which means that someone sniffing your connection cannot tell what is going on on that session.. no username and most importantly no password..

For this reason alone it is worth dropping telnet and moving to ssh, which makes putty a good choice since it's free, and full featured. Allowing you to use the tunneling capabilities of ssh and a good terminal emulation utility. If you access your e-mail from anywhere other than your own home, or are suspicious that someone at your office might be reading your network traffic and have an ssh server running at home, ssh tunneling is a good cheap easy way to encrypt your tcp traffic. But i'll leave that for someone else to explain or for you to lookup on your own.

[phishphreek]

The reason you should not use telnet over public lines is: it is not encrypted. Practically any sniffer can pick up the x-fered info. Try it out yourself. Setup a terminal server w/telnet running, and setup your packet sniffer.

Run your packet sniffer and then telnet/login to the telnet server.

You will be able to grab everything from that session. I played around a bit with this on my school network. People were telnetting to a linux server instead of ssh. I had a network admin by my side when we did this... so I had permission. We were able to grab any session and usernames and passwords of people. We were able to even see the mail they read and wrote. Pretty scary...

It is ok to use it for connection testing on a private lan. Example. You don't have PuTTY installed but you need to test the connection (7 layers) to troubleshoot a network problem. I will use telnet to confirm connection, but won't enter in sensitive info.

PuTTY will supports encryption and it is simply more powerful. You can connect to and do more with less programs.

Even if you use PuTTY to log into a telnet server, your communication can still be sniffed. The solution? Use SSH.

A quick and sloppy description of the differences between Telnet and SSH.
Taken from: here.

Telnet vs. SSH

For many years telnet has been the means by which users logged onto remote computers. But telnet transmits data in plain readable text, which is readily intercepted by hackers.

There's now a better choice: It's SSH (which stands for Secure Shell). SSH clients work just like traditional telnet clients. You can use SSH to do anything you might typically do with telnet and with the assurance that your password and other sensitive information are secure.

g00n: We must have been typing at the same time. Good explination... exactly what I was thinking. I just didn't go into so much detail.

[Algaen]

PuTTY is just a client that can be used to for telnetting.
Telnet is basically a communication protocol used on the Internet. It can be used to remotely log in to machines over the Internet.
This article includes some very technical information on the telnet protocol, along with a link to the RFC describing Telnet.
http://www.scit.wlv.ac.uk/~jphb/comms/telnet.html

PuTTY is simply a client that can be used for telnet, plus some other protocols for remote logins such as Rlogin and SSH (secure shell). I use PuTTY to make an SSH connection from my dorm room to the Linux lab so that I can do all my Linux work without having to walk down the hill.
http://www.chiark.greenend.org.uk/~sgtatham/putty/

The big differences is the level of security between Telnet, Rlogin and SSH.
This link can hopefully clear up the differences between them:
http://the.earth.li/~sgtatham/putty/.../Chapter1.html

Hope this helps!

[kilerboots]

Say I wanted to get into my friends computer is this what i use to do that, what do i have to do?I know this is against the law

[phishphreek]

Say I wanted to get into my friends computer is this what i use to do that, what do i have to do?I know this is against the law

It depends on what services he has running to allow access. If he has SSH running, you can use it. If he has telnet or rlogin or raw open, then yes, you can use this. (PuTTY)

You are going to need usernames and passwords anyway. The method of gaining usernames and passwords can be illegal depending on method used. It'd be much easier to just ask him for access... if you really need it. Even if you do get usernames and passwords, you still need permission.

It is against the law if you don't have permission.

Oh, on what to do... simply type in the ip or url of desired connection. Then choose the server type or port. Then usename. It'll prompt you for a password. You can also read the PuTTY documentation. It'll explain that much better than I have.

[kilerboots]

What does it mean when it says
Putty Fatal Error: Connection Refused.

>Thanks for all your help everyone

[phishphreek]

It means that that machine isn't running the service you tried to connect to.

If you are trying to telnet to a machine that isn't running telnet... you aren't going to be able to connect. Same with any other service. You can use telnet to connect to other services though... say someone is running a web server, you can connect to the web server with telnet. You just have to manually enter in the request info that the web browser would normally do for you.

[mupp3t]

The only problem i can see with putty is there is a honey pot kinda thing that when connected to using putty, exploits a flaw in it. I think it then installs a back door or somethinge else, but it hasnt been that widely used too much and ive never seen much about so im gonna assume that its not that widely known. Sorry for the lack of information, i wasnt that interested in it when i read it.

This wont affect you if your using the latest putty, i heard they updated it to fix this problem.
The source for it all is on packetstorm just do a seach.

[the_JinX]

I compile my own putty from the source (weekly) so I think I'm safe !!