DOS 7.0 offers several Internet tools, none of which are documented in

either the standard Windows or DOS help features. But you’re getting the

chance to learn these hidden features today.

So to get going with today’s lesson, use AOL or whatever lame on-line

service you may have and make the kind of connection you use to get on the

Web (this will be a PPP or SLIP connection). Then minimize your Web browser

and prepare to hack! Next, bring up your DOS window by clicking Start, then

Programs, then MS-DOS.

For best hacking I’ve found it easier to use DOS in a window with a task bar

which allows me to cut and paste commands and easily switch between Windows

and DOS programs. If your DOS comes up as a full screen, hold down the Alt

key while hitting enter, and it will go into a window. Then if you are

missing the task bar, click the system menu on the left side of the DOS

window caption and select Toolbar.

Now you have the option of eight TCP/IP utilities to play with: telnet,

arp, ftp, nbtstat, netstat, ping, route, and tracert.

Telnet is the biggie. You can also access the telnet program directly from

Windows. But while hacking you may need the other utilities that can only be

used from DOS, so I like to call telnet from DOS.

With the DOS telnet you can actually port surf almost as well as from a Unix

telnet program. But there are several tricks you need to learn in order to

make this work.

First, we’ll try out logging on to a strange computer somewhere. This is a

phun thing to show your friends who don’t have a clue because it can scare

the heck out them. Honest, I just tried this out on a neighbor. He got so

worried that when he got home he called my husband and begged him to keep me

from hacking his work computer!

To do this (I mean log on to a strange computer, not scare your neighbors)

go to the DOS prompt C:\WINDOWS> and give the command "telnet." This brings

up a telnet screen. Click on Connect, then click Remote System.

This brings up a box that asks you for "Host Name." Type

"whois.internic.net" into this box. Below that it asks for "Port" and has

the default value of "telnet." Leave in "telnet" for the port selection.

Below that is a box for "TermType." I recommend picking VT100 because,

well, just because I like it best.

The first thing you can do to frighten your neighbors and impress your

friends is a "whois." Click on Connect and you will soon get a prompt that

looks like this:

[vt100]InterNIC>

Then ask your friend or neighbor his or her email address. Then at this

InterNIC prompt, type in the last two parts of your friend’s email address.

For example, if the address is "[email protected]," type in "aol.com."

Now I’m picking AOL for this lesson because it is really hard to hack.

Almost any other on-line service will be easier.

For AOL we get the answer:

[vt100] InterNIC > whois aol.com

Connecting to the rs Database . . . . . .

Connected to the rs Database

America Online (AOL-DOM)

12100 Sunrise Valley Drive

Reston, Virginia 22091

USA

Domain Name: AOL.COM

Administrative Contact:

O'Donnell, David B (DBO3) [email protected]

703/453-4255 (FAX) 703/453-4102

Technical Contact, Zone Contact:

America Online (AOL-NOC) [email protected]

703-453-5862

Billing Contact:

Barrett, Joe (JB4302) [email protected]

703-453-4160 (FAX) 703-453-4001

Record last updated on 13-Mar-97.

Record created on 22-Jun-95.

Domain servers in listed order:

DNS-01.AOL.COM 152.163.199.42

DNS-02.AOL.COM 152.163.199.56

DNS-AOL.ANS.NET 198.83.210.28

These last three lines give the names of some computers that work for

America Online (AOL). If we want to hack AOL, these are a good place to start.

*********************************

Newbie note: We just got info on three "domain name servers" for AOL.

"Aol.com" is the domain name for AOL, and the domain servers are the

computers that hold information that tells the rest of the Internet how to

send messages to AOL computers and email addresses.

*********************************

*********************************

Evil genius tip: Using your Win 95 and an Internet connection, you can run a

whois query from many other computers, as well. Telnet to your target

computer’s port 43 and if it lets you get on it, give your query.

Example: telnet to nic.ddn.mil, port 43. Once connected type "whois

DNS-01.AOL.COM," or whatever name you want to check out. However, this only

works on computers that are running the whois service on port 43.

Warning: show this trick to your neighbors and they will really be

terrified. They just saw you accessing a US military computer! But it’s OK,

nic.ddn.mil is open to the public on many of its ports. Check out its Web

site www.nic.ddn.mil and its ftp site, too -- they are a mother lode of

information that is good for hacking.

*********************************

Next I tried a little port surfing on DNS-01.AOL.COM but couldn’t find any

ports open. So it’s a safe bet this computer is behind the AOL firewall.

**********************************

Newbie note: port surfing means to attempt to access a computer through

several different ports. A port is any way you get information into or out

of a computer. For example, port 23 is the one you usually use to log into a

shell account. Port 25 is used to send email. Port 80 is for the Web. There

are thousands of designated ports, but any particular computer may be

running only three or four ports. On your home computer your ports include

the monitor, keyboard, and modem.

**********************************

So what do we do next? We close the telnet program and go back to the DOS

window. At the DOS prompt we give the command "tracert 152.163.199.42." Or

we could give the command "tracert DNS-01.AOL.COM." Either way we’ll get the

same result. This command will trace the route that a message takes, hopping

from one computer to another, as it travels from my computer to this AOL

domain server computer. Here’s what we get:

C:\WINDOWS>tracert 152.163.199.42

Tracing route to dns-01.aol.com [152.163.199.42]

over a maximum of 30 hops:

1 * * * Request timed out.

2 150 ms 144 ms 138 ms 204.134.78.201

3 375 ms 299 ms 196 ms glory-cyberport.nm.westnet.net [204.134.78.33]

4 271 ms * 201 ms enss365.nm.org [129.121.1.3]

5 229 ms 216 ms 213 ms h4-0.cnss116.Albuquerque.t3.ans.net

[192.103.74.45]

6 223 ms 236 ms 229 ms f2.t112-0.Albuquerque.t3.ans.net

[140.222.112.221]

7 248 ms 269 ms 257 ms h14.t64-0.Houston.t3.ans.net [140.223.65.9]

8 178 ms 212 ms 196 ms h14.t80-1.St-Louis.t3.ans.net [140.223.65.14]

9 316 ms * 298 ms h12.t60-0.Reston.t3.ans.net [140.223.61.9]

10 315 ms 333 ms 331 ms 207.25.134.189

11 * * * Request timed out.

12 * * * Request timed out.

13 207.25.134.189 reports: Destination net unreachable.

What the heck is all this stuff? The number to the left is the number of

computers the route has been traced through. The "150 ms" stuff is how long,

in thousandths of a second, it takes to send a message to and from that

computer. Since a message can take a different length of time every time you

send it, tracert times the trip three times. The "*" means the trip was

taking too long so tracert said "forget it." After the timing info comes the

name of the computer the message reached, first in a form that is easy for a

human to remember, then in a form -- numbers -- that a computer prefers.

"Destination net unreachable" probably means tracert hit a firewall.

Let’s try the second AOL domain server.

C:\WINDOWS>tracert 152.163.199.56

Tracing route to dns-02.aol.com [152.163.199.56]

over a maximum of 30 hops:

1 * * * Request timed out.

2 142 ms 140 ms 137 ms 204.134.78.201

3 246 ms 194 ms 241 ms glory-cyberport.nm.westnet.net [204.134.78.33]

4 154 ms 185 ms 247 ms enss365.nm.org [129.121.1.3]

5 475 ms 278 ms 325 ms h4-0.cnss116.Albuquerque.t3.ans.net [192.103.74.