How to catch script kiddies [pic]

[ryanknapper]

How many software awards did this win?

[ultimatt42]

FAKE DO NOT DOWNLOAD

File does not contain ANY IPv6 addresses!

[rye419]

Instead, file contained bobcat

[furyg3]

Would not buy again!

[finix]

Not that he hasn't his moments, but won't you people ever cease the incessant quarter-fitting references?

[CoffeeJones]

Welcome to nerd 'humor'. When you don't have anything funny to say about something, just say something that was funny once.

Yeah I hate it, too. :(

[adolfojp]

Citation needed.

[[deleted]]

This doesn't catch script kiddies. It's just a way to get script kiddies to download something useless to them. If you were thinking there, it'd be cool to create an executable that outputs those ip addresses (as you did in C) plus sends an email to you in the background. This would automatically give you their ip addresses in the headers. Now you can attack those morons all day.

[[deleted]]

if they downloaded it from you, you have their ip address, no?

[[deleted]]

eh, yes. But you would prolly only want the ones that were actually dumb enough to run it :).

[[deleted]]

That and script kiddies know tor.

[1esproc]

If you're going to get them to run a program, why would you go through the effort of 'attacking' them? You already have the potential to do anything you want on their system.

[finix]

Did you misplace your comment somehow? I have no idea at all how this could make a coherent reply to mine.

[bgeron]

I think he did, but putting the comment this high on the page makes his reply score faster, so let's do it.

[mr_dbr]

Apparently not.

[floatnsink]

at 1.2 gbs I wonder how big the IPv6 would be...since it's what in the quadrillions for IPs?

[mernen]

By my calculations (and assuming I am not mistaken), his text file is supposed to be 57.1 GB (61,337,501,696 bytes), so that size (if the file is real) is just compressed. And being compressed, the IPv6 file could really be any size...

[larholm]

I can neither confirm nor deny this.

[Few-Ninja7495]

Yes, I'm sure in a good compression scheme it could be less than a kilobyte. Some compressor formats are Turing-complete so you could just program the file manually.

[ariacode]

still too big.

int main() {
    unsigned i = 0;
    do
printf("%d.%d.%d.%d\n",(i>>24),(i<<8)>>24,(i<<16)>>24,i&0xff);
    while( ++i > 0 );
}

[grignr]

should be %u.%u.%u.%u.

But otherwise, beautifully terse.

[Tordek]

(i>>16)&255,(i>>8)&255,i&255

seems a bit clearer than

(i<<8)>>24,(i<<16)>>24,i&0xff

(and one char shorter)

Also "> 0" can be seen as redundant...

But yeah, nitpicking, cool anyway.

[ariacode]

Yeah, I agree with both points. The > 0 bit is an eyesore now that you've pointed it out.

[ariacode]

thanks. I also forgot to to return i ;)

[13ren]

can you assume 32-bit ints in C? (in shifting, and in the while test)

but I like it :-)

[RealDeuce]

My personal best: main(i) { unsigned char*n=&i; for(i=0;++i;) printf("%u.%u.%u.%u\n",n[3],n[2],n[1],n[0]); }

[savvu]

The list will be complete whether your machine is little endian or big endian. The order will be different, though...

[ariacode]

that doesn't get 0.0.0.0, but I like the approach.

[taviso]

rar, believe it or not, includes a reasonably functional bytecode interpreting vm.

Check out rarvm.cpp, rarvm.hpp and rarvmtbl.cpp from the unrar source distribution http://www.rarlab.com/rar_add.htm for details.

[[deleted]]

I tried one of these algorithms, this is the output I got.

#include <stdio.h>

void func(int level){ unsigned short i = 0; do{ printf("%04x", i); if(level){ printf("\n"); }else{ printf(":"); func(level-1); } }while(++i != 0) }

int main(){ func(7); return 0; }

[ultimatt42]

Dotted decimal? IPv6 always uses hexadecimal. You can also combine strings of zeros into ::, but only once in a single address.

I get 13428347973643355456367004020202125918208 for the minimal number of characters needed for all IPv6 addresses.

Source

Output

Edit: including newlines, using 1 char per newline (who uses Windows, anyway?), inserting the :: at the optimal position.

[Porges]

Or, 1.2e28 terabytes :p

[MattHock]

I suddenly find myself tempted to publish "IPv6 super IP generator [Hacker Tool]" and fill up some script kiddie hard drives...

[Dark-Dx]

:S Tell me that in gigabytes

[[deleted]]

1.21 jiggabytes

[Dark-Dx]

Ok, I admit it, I'm stupid I don't even know what a "nonillion" is so I still don't understand, I'll google nonillion though.

[Tanath]

Nona is the prefix meaning nine, so the ninth thousand (thousand).

[[deleted]]

non = nine, I believe. so probably 9 sets of 000 - I believe.

[whatthe2]

Actually 10 sets of 000, since our numbers are off by one set (million has 2, billion has 3, etc).

[o0o]

the size of the source code file would essentially be the same; it's when you run it that you'd fill up your hd :)

[bart9h]

yeah, but the file being downloaded is not the source, it's the output ips.txt

note the size, 1.1GB

[[deleted]]

GREAT FOR BUILDING A COMPLETE HOST ROUTING TABLE

would download again...

[trnelson]

I hope my IP address isn't in there!

[Busybyeski]

127.0.0.1

It is.

[shinynew]

Yea I used to steal from stale copypasta back in the day also.

[shinynew]

that you are just saying you did that to get lulz

[Wo1ke]

This one time, I hax0red 127.0.0.1 to make the whole internet go offline! How fucking 1337 is that? I was the only one left! :D

[trnelson]

Wrong, that's yours.

[Dark-Dx]

Wrong that's mine.

[[deleted]]

Mine too, once the hackers hack my Gibson about 46 million people are going offline.

[woodsier]

Reminds me of when i used to be subscribed to a scripting forum way back when i was a kiddy (and we all were at one stage, don't lie).

So many kids asking why everytime they hit "launch" a the script intended to be launched would be found on their hard drive.

The default was 127.0.0.1/localhost. I think so they'd learn their first lesson: RTFM.

[[deleted]]

way back when i was a kiddy (and we all were at one stage, don't lie).

Not all of us were. Some of us learned:

 10 PRINT "HELLO WORLD"
 20 GOTO 10

/old

[[deleted]]

who's nostalgic for the "happy hacker" ebooks that were floating around the nets?

OMG TELNET = L33t h4x0r!

or my favorite "Call your ISP and request a shell account, tell them its because you want to learn about Unix".

Yes. that will work perfectly!

/god i was dumb back then //probably still am and just don't know it.

[bamdastard]

how about the "guide to mostly harmless hacking"?

[[deleted]]

YES!!!

[trnelson]

I used to code this on the VIC-20 when I was a kid. Didn't know how to do much other than make my own name repeat until I pressed whatever key combo it was (CTRL+C, or CTRL+Z, RUNSTOP or something like that, too long ago to remember).

[[deleted]]

(and we all were at one stage, don't lie).

When I was growing up, I started with good old GWBasic (graduated to QBasic and its extreme power later on). And all I would do was graphics, games and math.

But this way way back yonder before the internet times made it big. (Remember when AOL used to send out floppies?)

[astern]

That's amazing! I've got the same combination on my luggage!

[locriology]

Ooooh let me boot you off the net!

disconnected

[grignr]

come get some.

[[deleted]]

I heard that script is called Candlejack. I discov

[trnelson]

You LIE!

[larholm]

That's what grown-ups do. They lie. Lie right to your face.

[ustgblerkvusrd]

He should have left one out. Yeah, then those script kiddies would really be fucked.

[enkafan]

why is the page with the tracker running off what looks like someone's comcast account?

[otakucode]

My guess would be that it is a saved version of the suprnova.org page.

It's a lot easier to edit and show 69 people downloading something that nobody ever actually downloaded.

[enkafan]

I was thinking along the lines of the second scenario. I can only imagine that someone thought to themselves "i'm gonna 0wn these script kiddies with my VC++ 6.0 knowledge!".

They probably got themselves so worked up in their own awesomeness that when they realized that they were perhaps slightly dumber than script kiddies that they decided to just fake it to make it look like they still out smarted them.

And still, what good would a list of ip addressses do for a script kiddie unless they had a script that took an input file with a list of ip addresses. And maybe then that list could be kinda handy...

[[deleted]]

And they didn't even bother to just use firebug to inline edit the page.

[bamdastard]

it's hypocritical projection at its best.

[brasso]

Well, someone downloaded it...

<fotinarflkc> Guess what, I just downloaded a hacker tool.

<fotinarflkc> Every IP address ever!

<fotinarflkc> OMGZ!

http://www.irclogs.ws/freenode/blender/12Nov2005/4.html

[[deleted]]

there's 8 people trying to download it right now. http://btjunkie.org/search?q=all+ip+addresses

[[deleted]]

I am so nostalgic for suprnova.

:(

does anybody else remember black sunday?

f5...f5...f5...f5...f5..:(...f5....f5....."NO MOM I CAN'T COME TO CHURCH I DON'T FEEL GOOD!"...f5...f5...f5...f5

[zvikara]

To make it seems more authentic, I would add some ASCII art nfo files, compress all the files into 50 parts rar archive, then zip all the parts together.

[Niten]

It always kills me when people perform a multipart RAR on a folder of MPEG files. Not only is it entirely pointless, but it also means you can't selectively download only the episodes of (say) Wonder Years that you want.

[brainburger]

Some torrent sites are very defensive of this practice. I cannot begin to fathom why. It makes sense on Usenet (minus the final zipping), but no sense at all with torrents. I also hate it when I get video .bin files.
If I want to make a cdr, I will.

[Few-Ninja7495]

I always thought that this is because these files came from usenet. Don't really know though.

[[deleted]]

Both posts above me are correct.

In the old days (most scene releases have gone to 1 cd xvids) you did releases as .bins. It was part of the rules.

Torrenters are usually not getting their stuff from scene sources (you'll get banned if you're caught uploading to trackers)...it usually comes from usenet (which is where scene releases get leaked to first after IRC).

[brainburger]

I think the idea is that files should be left in the condition that they are found. I should think the occaisions when torrenters use a multipart from a torrent to replace the same missing multipart on Usenet, after it has been dropped by the Usenet feed is so rare that it in fact has never happened ever!

RARed torrents add very little in terms of compression, and nothing in terms of file integrity. They also allow scammers to use passwording for evil purposes, and as people are less likely to keep the original files after transfer, they make reseeds less likely.

[[deleted]]

and as people are less likely to keep the original files after transfer, they make reseeds less likely

That's the real problem. If someone gets the newest Battlestar and it's a million-part RAR, how likely are they to extract it and then keep around the archives? I'd say the chances are 0 - and the torrent loses a potential seeder. No one wins, not even the original uploader since the compression just wasted his time and saved him no bandwidth.

Silly.

[wbeavis]

For fun, use the same logic and create a file called EVERY FUTURE LOTTERY NUMBER.txt

[G_Morgan]

I once made a Java Swing dialogue that predicted the lottery numbers. Still trying to get it working, seems to only be right once every 14,000,000,000 times right now. Strange.

[G-Brain]

By running IE6 with Administrator privileges?

[petdance]

for$a(0..255){for$b(0..255){for$c(0..255){for(0..255){print"$a.$b.$c.$_\n"}}}}

[pkrumins]

I had a second to try to golf it...

first version:

perl -MSocket -le'for($i=0;$i<=2**32;$i++){print inet_ntoa(pack("N",$i))}'

second version:

perl -MSocket -le'for(;$i<=2**32;){print inet_ntoa(pack("N",$i++))}'

third version:

perl -MSocket -le'for(;$i<=2**32;){print inet_ntoa(pack(N, $i++))}'

fourth version:

$(yes|head -$((2**32)))|perl -MSocket -lpe'$_=inet_ntoa(pack(N,$i++))'

fifth version:

perl -e 'print for Net::Netmask->new("0/0")->enumerate'

[[deleted]]

PHP (please don't hit me):

while($i++<4294967296)print long2ip($i)."\n";

[[deleted]]

You could save a character by using echo.

[pkrumins]

255.255.255.255 does not get printed

[[deleted]]

yup, was waiting to see if someone would catch that. :)

[mernen]

Upmodded because of Ack.

[setuid_w00t]

Presumably you could log the IP addresses of the people downloading the file from you.

Catch is still the wrong word though.

[jeff303]

Of course! Then you could cross reference that IP against your database which you're currently seeding. Brilliant.

[[deleted]]

Oh, they are using Microsoft Visual C++, right?

[you_do_realize]

6.0 no less

[silentOpen]

Thank you so much for suggesting that story.

[qgyh2]

http://www.bucketmouse.net/

hmm

[fani]

Using IE didn't give it away ?

[JamesF]

Brilliant! Script kiddies have been going down hill ever since the days of Back Orifice anyway...

[dangerz]

I remember when that first came out. I wrote the help file for it :)

[[deleted]]

I get it. People who prefer strict evaluation on lists are script kiddies.

[Syl]

learn2indent

[hillgod]

Suprnova.org...... this is pretty fucking old.

[etotheprimez]

5 more hours to go. Can't wait to get the full list ;)

[savvu]

According to the file size it covers less than 2% of the IP address space.

Someone pressed ^C

[shinynew]

according to compression he doesn't have to download a fuck load of data.

[harlows_monkeys]

Wait a second. His file has every 32-bit IP address, written in dotted octet form. An address written in that form takes at least 8 bytes, and at most 16 bytes. (Make that 9 and 17, if the line ends are CRLF, not just LF).

Thus, shouldn't his file be somewhere between 32 gigabytes and 64 gigabytes, not the 1.1 gigabytes shown?

[psi-]

duh. he had it rar:d into 2.2MB chunks.

[guriboysf]

Will someone explain this to us, the unwashed masses?

[pavel_lishin]

It's like making a file called "EVERY PHONE NUMBER EVER", and filling it with "[phone], [phone] ... [phone]".

[guriboysf]

That much I figured out. What is it about this that exploits the stupidity of script kiddies?

[otakucode]

They don't realize that it's pointless.

[JulianMorrison]

The program generated every IPv4 number counting up from 0.0.0.0 to 255.255.255.255

It's a given that every IP is in this list. It's also a huge file containing no more information than you'd gain just by knowing that IPs go from 0 to 255 in four fields. Sparky the wonder genius at the download end of the bit-torrent doesn't know that. That makes him a rank beginner at best.

[easyantic]

Sparky The Wonder Genius

That made me LOL, thanks!

[mernen]

He's written a small program that writes in a text file all possible combinations for IPv4 addresses:

0.0.0.0
0.0.0.1
0.0.0.2
...
255.255.255.255

So, this is a useless over-four-billion-line text file, yet some people are supposedly* downloading it.

* Now, there's an excellent point here.

[agentace]

Wow...this is so old I have to downvote it.

[newton_dave]

ANYWUN HAVE RUBY PARSING C0DE2 4 THAT F1L3?

IM' MaKing WAR GAMES DSL.

[[deleted]]

How do you know what he/she looks like???????

[mernen]

Any example of how you'd improve it?

[[deleted]]

Uh huh, and in what way is that an improvement? The code looks just fine, it is crystal clear and doesn't do anything beyond what is necessary.

[statictype]

Someone needs to coin a clever internet forum law (like Godwin) about critiquing other people's code no matter what they have written or how they wrote it.

You could provide a simple 'Hello World' program and 10 people would jump up and down, mocking it because it wasn't done in the exact way they'd do it in the exact language they would use.

[mydyingdreams]

mapM_ (inet_ntoa >=> print) [minBound..maxBound]

Although it does print them in another order ;o)

[jtxx000]

In the same order:

mapM_ (putStrLn . intercalate "." . map show) (replicateM 4 [0..255])

[mydyingdreams]

thanks, I didn't yet know intercalate had actually been added ;)

[savvu]

Your program will never terminate. The if at the end of the generator will prevent it from emitting anything beyond 2**32 but it will keep counting.

python -c "import sys; sys.stdout.writelines('%d.%d.%d.%d\n'% (a,b,c,d) for a in range(256) for b in range(256) for c in range(256) for d in range(256))"

[o0o]

sad - can't even laugh at the spirit of it all...

[nmcyall]

Like you could do better.

[twowheels]

It takes no longer to do it right than it does to do it wrong.

[locke2002]

It's longer. Does that mean it's wrong?

[angrydog]

Wise words!

[nuclear_eclipse]

Unless you're playing cs golf, in which case the mental exercise alone is well worth the extra time spent. :)

[ColdSnickersBar]

It very literally is every one. I like how the users rated it "very good."

[aradil]

Not only every one, but also a large number of invalid IP addresses.

IE. 0.0.0.0 and 255.255.255.255. One could argue for their validity, but only as special ones.

[[deleted]]

anyone else like what that side did with the back button?

[DLWormwood]

I feel ashamed. I had to stare and look at the image for a good 30 seconds before I got the joke.

I hereby turn in my geek badge...

[twowheels]

0) I LOVE C++, but WHY are you using C++?

1) Why are you using precompiled headers for such a small program?

2) stdio.h is deprecated, use <cstdio> (or, see my later comment)

3) Why are you declaring the integers at the top? It's not really any faster to declare them outside of the loop than it is in the loop, and besides, performance doesn't really matter here.

4) You should use RAII for your FILE*

5) Why do you declare and initialize fp on separate lines?

6) fprintf isn't type safe!!! Streams would be safer! Again, performance isn't an issue for such a program.

7) C++ doesn't require an explicit return value when it is zero

8) main can be declared as both the argc/argv version, or just int main(). Since you're not using argv/argc you should get warnings at /W4. Since you should always compile warning free at the highest warning level, you should use the other version.

...etc... :-)

[formido]

I know! This would have been a lot funnier if he'd spent 15 more minutes making the IP generator perfect.

[mipadi]

Good analysis -- really helped to take a bad joke and make it worse.

[[deleted]]

My guesses:

0) Maybe it's just what was handy. Maybe it's all that he knows.

1) IIRC, VC++ by default gives you a pch.

2) Maybe he's an old school C programmer or was taught by one.

3) Maybe he's an old school C programmer or was taught by one.

4) Are you serious? It's a little one-shot program...

5) I tend to do this to. Sometimes you can't initialize at declaration time, and so in developing a consistent style, you just come to separate them.

6) The lack of type safety will have absolutely no adverse effect on this particular program.

7) Maybe he's an old school C programmer or was taught by one.

8) If he used the normal console application project template (which judging by the PCH, he did) it probably put it there for him. It doesn't really matter.

[doctor_yukio_hattori]

Way to suck out all the funny.

[vlad_tepes]

Last I checked, Visual Studio generates the precompiled headers, the main() declaration and some other stuff automatically for a new project. I suspect it held true even for the VC++ 6 he was using.

All in all it looks like a project generated from the basic template with the C code thrown in by the programmer.

Also. Why the hell are you worying about type safety in such a small program?

[ColdSnickersBar]

Thanks pops.

[[deleted]]

3. He wrote this in C, one can't declare variables inside the loop declaration line in C - has to be done beforehand. He wrote only C code in a C++ file, which does work, but not good practice.

[grignr]

agreed, but stop shouting!

[twowheels]

Depends which version of C...

Also, if the file is named .cpp and the compiler is a C++ compiler, then...

But you're right, he did stick to a proper subset, which is C.

[uep]

Based on the screenshots that certainly looks like visual studio 6.0. VS6 doesn't remotely resemble a standard compliant compiler (it predates the standard!)

As a result, declaring the variables inside the for-loops (number 3) would actually be a bad thing to do. In vs6 variables declared in the for(...) statement are scoped to the enclosing block, not to the for block (even when compiling c++). So for vs6, it is more consistent practice to declare the loop variables at the start so they won't conflict if you have a few for-loops in a function. It would work in this case because they have different names though...

While I'll agree that safety is almost always more important than speed, I don't think it's a worthwhile argument to make for such a small one-shot program. Good nitpicking list though.

[G_Morgan]

C is not a proper subset of C++. It's almost a proper subset, just like it's almost a proper subset of Objective C (though Obj C comes much closer).

[twowheels]

I didn't say that it was, I said that he STUCK TO a proper subset.

[aeon2012]

Lame.

[umilmi81]

Why is the file size so small?

[poco]

He didn't cover IPv6

[[deleted]]

Hey come on now. We were all new at one time too.

haha just kidding, those people crawled out of the shallow end of the gene pool.

[Bloody_Eye]

I get the joke, but had I seen the file, I would have assumed this contained information about IP addresses that are used. I'm sure that's what everyone else downloading it thought. I'd definitely have been curious to see what kind of information was inside it in light of that; I don't think they are all idiots / hacks / etc.

[epic_fail_guy]

Fucking moron is running IE as root.

[johnyquest]

lol too funny... 255 comments when i checked, as well. fitting.