A test for my server.

Today I was thinking and came up with a good idea to test my server's security. I have created a little game of 'hack me' for the users of AO to participate in.

All information and rules about this game can be found here http://24.15.51.219/ .

Now I know the issue will arise that this server is not mine and what not, this server is running from my IP (which is logged to this site) and I will do anything anyone asks to further prove that this is my server.

Have fun, and anyone who gets past my 1337 security and bypasses the hidden traps ;) will get some mad respect. =P

- Cheers, dave

Even me? :D

nmap -sN -O -vv -sV 24.15.51.219

Quote:

---

# nmap 3.55 scan initiated Thu Sep 2 20:37:14 2004 as: nmap -sN -O -vv -sV -oN dave1.txt 24.15.51.219
Warning: OS detection will be MUCH less reliable because we did not find at least 1 open and 1 closed TCP port
All 1660 scanned ports on c-24-15-51-219.client.comcast.net (24.15.51.219) are: filtered
Too many fingerprints match this host to give specific OS details
TCP/IP fingerprint:
SInfo(V=3.55%P=i686-pc-linux-gnu%D=9/2%Time=4137BD5E%O=-1%C=-1)
T5(Resp=N)
T6(Resp=N)
T7(Resp=N)
PU(Resp=N)



# Nmap run completed at Thu Sep 2 20:39:58 2004 -- 1 IP address (1 host up) scanned in 164.058 seconds

---

nmap -sS -O -P0 -vv 24.15.51.219

Quote:

---

# nmap 3.55 scan initiated Thu Sep 2 20:37:26 2004 as: nmap -sS -O -P0 -vv -oN dave2.txt 24.15.51.219
Warning: OS detection will be MUCH less reliable because we did not find at least 1 open and 1 closed TCP port
Interesting ports on c-24-15-51-219.client.comcast.net (24.15.51.219):
(The 1659 ports scanned but not shown below are in state: filtered)
PORT STATE SERVICE
80/tcp open http
Device type: general purpose|load balancer
Running (JUST GUESSING) : Apple Mac OS X 10.1.X (94%), FreeBSD 4.X|5.X|2.X|3.X (94%), Microsoft Windows 95/98/ME|NT/2K/XP|2003/.NET (94%), IBM AIX 4.X (92%), F5 Labs embedded (88%)
Aggressive OS guesses: Apple Mac OS X 10.1.4 (Darwin Kernel 5.4) on iMac (94%), FreeBSD 4.3 - 4.4PRERELEASE (94%), FreeBSD 5.0-RELEASE or -CURRENT (Jan 2003) (94%), FreeBSD 4.9 - 5.1 (94%), Microsoft Windows Millennium Edition (Me), Windows 2000 Professional or Advanced Server, or Windows XP (94%), FreeBSD 2.2.1 - 4.1 (94%), Microsoft Windows Server 2003 (94%), FreeBSD 5.2-CURRENT (Jan 2004) on x86 (94%), IBM AIX 4.3.2.0-4.3.3.0 on an IBM RS/* (92%), Apple Mac OS X 10.1.5 (90%)
No exact OS matches for host (test conditions non-ideal).
TCP/IP fingerprint:
SInfo(V=3.55%P=i686-pc-linux-gnu%D=9/2%Time=4137BF7F%O=80%C=-1)
TSeq(Class=TR%IPID=I%TS=0)
T1(Resp=Y%DF=Y%W=FFFF%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=FFFF%ACK=S++%Flags=AS%Ops=MNWNNT)
T4(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(Resp=N)
T6(Resp=N)
T7(Resp=N)
PU(Resp=N)

TCP Sequence Prediction: Class=truly random
Difficulty=9999999 (Good luck!)
TCP ISN Seq. Numbers: C4ED51B4 E31E8E2F 402EA364 5D30299A 9EF55050 4DB427E4
IPID Sequence Generation: Incremental

# Nmap run completed at Thu Sep 2 20:49:03 2004 -- 1 IP address (1 host up) scanned in 697.871 seconds

---

Demonic, it is most certainly a windows server.

Quote:

---

Apache/2.0.50 (Win32) PHP/4.3.8 Server at 24.15.51.219 Port 80

---

I don't think I'll be taking part in this, but it should end up being interesting :)

Pooh, I'm just running it lol.

I should really get rid of those dirty little directory listing pages... ;) They're such bad liars. ;)

sounds like fun, however... if its a 'test' for your new server to see how secure it is... if and when somoene defaces it, wouldnt you have to change settings to prevent the exact same attack. when you start using the server... (cause its been done once)[ or will be rather]

n00b.

I can vouche that it is indeed him. jaguar291 comes to Unerror under the alias dave:

--- [dave] ([email protected]) : dave
--- dave :is connecting from *@c-24-15-51-219.client.comcast.net 24.15.51.219
--- [dave] #lobby
--- [dave] unerror.anewerairc.net :Unerror IRC Server
--- [dave] idle 00:00:03, signon: Thu Sep 2 23:26:29
--- [dave] End of WHOIS list.

Anyways, I think I'll give it a try tommorow after school, I'm nmapping him now. ;-)

Peace
mb

Quote:

---

Originally posted here by CybertecOne
sounds like fun, however... if its a 'test' for your new server to see how secure it is... if and when somoene defaces it, wouldnt you have to change settings to prevent the exact same attack. when you start using the server... (cause its been done once)[ or will be rather]

n00b.

---

You're assuming it'll happen... I have a bit different thought to it. ;) Just look at this place, half the people can't even tie their shoes without help.. =P

lol, yes of course its IF it happens, i was just asking if it did, would it remain to be a threat??

Ofcourse it would remain a threat if not properely secured. I think he is just bored and wants something to do, so he set up a wargames type server. Not a bad idea, as long as you don't mind people probing around.

mb

Quote:

---

Originally posted here by CybertecOne
lol, yes of course its IF it happens, i was just asking if it did, would it remain to be a threat??

---

Depends how the server is exploited, if it was an issue with Apache or some other software, the bug will be reported, if it is a configuration issue on my part, I'll talk to the winner and we'll try to figure out a fix for it... but traffic is fairly light from what I can see so I don't think it'll be that big of an issue..

A week from this Saturday at 4:00 PM Central USA time, I will shut down the server if it has not been taken care of. =D

Hmm that doesn't give me a lot of time to try out some things... since this weekend I'll be gone and then Univ starts... but some light scanning will be heading out your way.

Do you want defacing? Or any kind of disruptive activity goes? I don't mean D[R][D]oS-ing, mind you :)

Quick Note: Before you nmap or probe some one who drop is IP here, really make sure it's own IP because you could get yourself into a lot of legal trouble.

It is his IP, SDK.

hypronix, all information regarding the 'contest' is on the site.

Negative, I'm glad you're keeping a good eye on this thread. ;)

I cant reach it in any way.

DoS'ed???

This is the folly of playing these games...... Most of the idiots out there can't take a somple challenge.... When they fail they get pissy and stamp their little feet.... And that's why they will always be skiddies..... No talent, no skill... no sense.... :rolleyes:

Seems as if your webserver is down right now, when I get back to my dorm, I will do some looking around. I am assuming that, this challenge still applies.

Let me know. I will catch you around Jag.

I think I'm going to give it a shot too. I'm not a hacker but lets give it a shot.

Hey jag, does your "mad respect" have any cash value?

Server still down??

click on it foo...yeah lol its still down :)

I'm back and yes, the server is down because of a DoS attack.. I had to call Comcast and ask them to reassign me a new IP... thanks to the jackass who did that... but whatever... server was up about 2 days and no one got anything.

Secrets of my security...
____________________

Stock Apache 2 install on Win XP Home SP2
PHP 4
Linksys Router
No AV, no software firewall

Sucks that you got DOSed. Did you post the IP anywhere else or just here?
Was it a DOS attack for sure or was it multiple people scanning you at once?

I posted the IP on UnError, and Shrekkie's good ol' place... it might have traveled... I showed a few friends as well.

As for the DoS, idk to be honest, I'd assume bad packets because it went on for hours and my connection was cut off by Comcast so =\

So lame to d0s. :(

What kinda connection do you have?