how to be undetected in LAN

I have. If you use a standard (T568B pin-out) patch cable, you simply connect the White/Green to the White/Orange and the Green/White to the Orange/White on one end. I used data-grade vampire taps instead of soldering them together like the paper suggests. (It's not quite as good of a connection as they have, but I'm not good with a soldering iron) It works just fine.

And Yes, you'll only recieve packets. If you do the reverse, you'll only send them. Perfect for a sniffer.

(I'm kinda bummed 'cause I thought I was the first person to think up such a thing! Should have known somebody beat me to it!)

Great for a sniffer, where all you have to do is receive, but wouldn't this kind of setup mess with your tcp? I thought in tcp that the communication had to go both ways (as opposed to udp)?

why do you want to be undetected?

Well you wouldn`t be able to communicate back, but when sniffing there is no need to send back any acks etc... you just eavesdrop on the traffic. What basically happens is that the network traffic is received by all the systems connected to the network hub they just choose to ignore it (as it doesn`t match their MAC address). However when you place your NIC in promiscous mode the MAC filter is switched off so you get to see everything, with no need to respond as it is not actually sent to you. The target system is the one that needs to send back the acknowledgement, not the listening system.

Note: this only works if you have access to the wire the traffic is coming in on, i.e. if you are connected to the same hub then you will see it all, if you are connected to a network that only consists of hubs you will see it all, if you are on a swicthed network you would need to set up spanning ports in order to ensure that you see all the traffic. (this is why when people speak of the ability to sniff all your traffic as it flies across the internet they are generally talking crap).

Quote:

---

Originally posted here by _G_
Cybr1d, if i had the knowledge to make a new version of s7.....

R0n1n, (and others who really game an "advice"), seems like to be undeteected in lan is very hard, maybe i'll firgure ti out someday, now i think i'll use the "variant" to be someone else (to see me as another computer), I don't plan to "harm" with s7, i want to "cheat" (not really games....or some other fun stuff e.g. renaming mp3's - with a totally diferent name,tilte,artist). that's all.

---

A group of you are attacking Cybr1d for flaming. You should prolly attack me for laming then too but have you read any of these posts? _G_ has stated he's going to use sub7. We do not promote the USE of it around here, so yes Cybr1d was correct in flaming. That kind of question is unwelcome around here. If you want to use skiddie tools like sub7 go somewhere use or grow up. Stop being such an immature little ****.

hey HTRegz, it so happens that i noticed your signature:

Quote:

---

-- Prayer is the best Wireless Connection
-- Jesus - No long distance. No roaming charges. Always an open line.
-- Don't Be God's Weakest Link

---

cool!

I new here so be kind if my comment is lame. But how can you not be detected???

Everything you want to do requires packets to be sent with MAC addresses in them. Sure a bit more work to track down, but you can be traced back to your machine. Okay you can change your MAC address too, but the network crew should trace you down to the switch. Then some detective work in the Comm room will narrow to some more to a group of ports. Plus they could sniff the traffic and at some point you are going to send a packet with identifiable info in it.

Its like passwords they all can be broken with time, just a matter of how bad someone want to find you. If you are chewing up a boatload of bandwidth you will be detected.

Quote:

---

Originally posted here by 100ph01e
I new here so be kind if my comment is lame. But how can you not be detected???

Everything you want to do requires packets to be sent with MAC addresses in them. Sure a bit more work to track down, but you can be traced back to your machine. Okay you can change your MAC address too, but the network crew should trace you down to the switch. Then some detective work in the Comm room will narrow to some more to a group of ports. Plus they could sniff the traffic and at some point you are going to send a packet with identifiable info in it.

Its like passwords they all can be broken with time, just a matter of how bad someone want to find you. If you are chewing up a boatload of bandwidth you will be detected.

---

If you put in the effort, then yes. you'll always find the person. However this isn't a large corporation being talked about here, it's a small network (from the sounds of it), there's no guarentee that it's even a managed switch that you could pull information off of. As well the one way cable would not be traceable. Even in a large corporation it may not be worth the time or the hassle to attempt to track down the person (depending on what they are doing). We've had issues on our network with students using VMWare 4 and it create a rogue DHCP server. This results in man-in-the-middle attacks, even though they aren't planned, and are completely accidental. We even have a table mapping every user to their MAC Address. So you'd think ok, get yourself on that DHCP server, find the MAC of the server and compare it to the table, however VMWare generates it's own new MAC addresses, leaving you with a whole new series of problems. There's always a solution, but there's also always a way to expand upon the problem. It depends on time, effort and money just how far you can take it sometimes.

Thanks, HT...I missed the whole sub seven part. That's a definate NO GO!



Wait, Im a little confused:

Quote:

---

Originally posted here by _G_
why do you wanna fight?
(anyway, why is the porn the big discution? 6 from 8 computers in my network have share on porno stuff.....i don't understand the thing with porn.....you have any sexual problems?.....i really must repeat every time that mp3, porn...etc are not the problem?)

and, yes, the s7 is living, in fact i'm proud that s7 was made by romanians (because myself i'm romanian). And if you thinh that "installing" s7 in a network where every pc has norton anti-virus and mcafee, you're so wrong. You think that if i binf the server with someting the AV programs doesn't detect him?! i can say that now i'm "working" to a version of the s7 server (i split the server in files from 5KB-100KB, every file is scaned, etc...etc...when you get the optimal size that AV programs detect the trojan code (signatrue), you know that is the samllest size of code that the AV recognize, then must be modified,....etc kinna complex, i don't want to give more details)

i ask how can i be undetected, maybe someone really smart knows. (...and because the network administration is not my passion/job, and i don't have the time to be "slow")

---

And Then...

Quote:

---

Cybr1d, if i had the knowledge to make a new version of s7.....

R0n1n, (and others who really game an "advice"), seems like to be undeteected in lan is very hard, maybe i'll firgure ti out someday, now i think i'll use the "variant" to be someone else (to see me as another computer), I don't plan to "harm" with s7, i want to "cheat" (not really games....or some other fun stuff e.g. renaming mp3's - with a totally diferent name,tilte,artist). that's all.

---

Now is it just me, or does this stuff not add up. First, a brief technical description of his mods to sub7 and then he feigns ignorance? This is BS, he's BSing all of us.

I don't want to be the whistle blower this time, but I really think that, from what I'm reading, the worthiness of the thread just died. The other stuff he says he wants to do just doesn't fit.