topijrami

This is a guide for newbies using the Windows operating system who always want to know how to find an IP from somewhere. It is simple and to the point. If any of you “elite hackers” are reading this FAQ and complain to me about it being so easy or something well then I might just right a tutorial called “How to Grow a Brain for Complete Dumbasses”.


Getting IP’s for Complete Newbies FAQ

1. What is an IP address?

2. What can an IP tell me about a person?

3. What are the tools I need to get someone’s IP address?

4. How do I find my own IP address?

5. Can I get someone’s IP from his or her email messages?

6. How do I get someone’s IP when they are chatting on MSN/AIM/Yahoo Messengers?

7. What is IRC and how do I get a person’s IP address on there?

8. What is social engineering and how can it help me obtain someone’s IP address?

9. If someone is using a proxy or wingate how can I obtain his or her true IP address?

10. Someone told me that websites could get my IP and other information. Is this true?


What is an IP address?

An IP address or Internet Protocol is a 32-bit number address, which is assigned to each computer (technically called a host) connected to the Internet. It is the address to which different types of data are sent to your computer. It consists of 4 octets. Each octet equals 8 bits and has a range from 0 to 255. (Every IP address on the Internet is sectioned off into classes from class A to class E, depending on a different range of numbers, but I won’t go into that here.) Well I always believed that sometimes pictures speak louder than words so here is an example of a typical IP address:


209.124.223.67

| | | |

| | | |---------> (4th octet. 8-bits. Ranges from 0 to 255)

| | |-------------> (3rd octet. 8-bits. Ranges from 0 to 255)

| |-----------------> (2nd octet. 8-bits. Ranges from 0 to 255)

|---------------------> (1st octet. 8-bits. Ranges from 0 to 255)


Notice how each octet is separated by a decimal. I said earlier that an IP address is a 32-bit number or address. There are 4 octets, which are each 8-bits. So 8-bits + 8-bits + 8-bits + 8-bits = 32-bits. For a more in depth look into Internet Protocol, read RFC 791, which can be found at www.rfc-editor.org.


What can an IP tell me about a person?

Well an IP address can tell a good bit of information about a person, or should I say the computer the person is at or registered to. In its numerical form, an IP number would be kind of hard, to an average and less geeky person, to look at and automatically see what information you can get from it. Enter the Domain Name System (DNS). The Domain Name System or DNS turns those confusing little numbers into readable hostnames (ex. 209.124.223.67 in its DNS form would look like gnzl-as50-67.eatel.net). Now to convert an IP number address into DNS form you would have to use something called rDNS or reverse Domain Name System. To find rDNS tools online just go to www.samspade.org or search at www.google.com (a highly recommended search engine that I use) and run a search on “reverse dns tools”, without the quotes of course. Now let’s analyze the domain that we just resolved:


gnzl-as50-67.eatel.net

| | |

| | |----> (domain belongs to a network)

| |---------> (name of the isp or internet service provider)

|-------------------> (the name of the machine which is located in “gnzl” or gonzales of Louisiana)


Domains could also have suffixes behind them (ex. gnzl-as50-67.eatel.net.uk) indicating that they are from another country. Example:


.jp = Japan

.uk = United Kingdom

.nl = Netherlands

.it = Italy

.ru = Russia

.fr = France

.eg = Egypt



********************************

I might be getting off the subject here but you can sometimes do a little guesswork about a person by looking at their domain. For instance, if you run across someone in a chat room who is trying to act like, in his/her words, “a hacker”, by threatening people and saying he/she will “hack” their computers if they get him/her mad, or by thinking they know everything about computers, and they are on a domain that ends with aol.com or with the words compuserve somewhere in it, its more than likely safe to say that they don’t know a thing about what they are talking about since AOL is not a good service provider for someone serious about hacking or, in my honest opinion, anyone else on the internet. Why you ask? The list goes on my friends. Everything from their poor technical support to there over priced monthly payments. I won’t get into it here but you can go to www.google.com and type in “aol sucks because” to find out for yourself. No offense to those of you AOL members who actually do know something but you know I speak the truth :-).

********************************


What are the tools I need to get someone’s IP address?

The main tool u need above all is a brain. Once you learn how to use that properly, the rest will fall into place. Oh, and a little knowledge of knowing where to look.


How do I find my own IP address?



Windows 95/98/ME:

1. Click the Start button then press Run.

2. In the Run dialog box, type in WINIPCFG in the white space and press OK.

3. An IP Configuration box should pop up with the IP displayed.



Windows 2000

1. Click START, go to Programs, then go to Accessories, and select the Command Prompt.

2. The Command Prompt window will open. Type "ipconfig/all" and hit the RETURN key.


Windows NT

1. Click the Start button then press Run.

2. In the Run dialog box, type in IPCONFIG in the white space and press OK.



OR


1. Click Start, go to Programs, and then select Command Prompt or MS-Dos Prompt.

2. When you see that black window pop up type “ipconfig/all” and press Enter.


Can I get someone’s IP from his or her email messages?

Yes. All you would have to do is look at the email header of the message. A header is the part of information on the email that shows you who the email came from, who it was sent to and what time it was received, and the subject of the email. There is also what’s called an extended header, which tells you more information. I will show this in a minute.


Since Yahoo, Hotmail, and Outlook Express are one of the top email services I will show you how you can view the header options of email messages on each one. When you are on Hotmail, go to Options, and then go to Mail Display Settings to set your header preferences. When you are on Yahoo, go to Options, then Mail Preferences, then change Message Headers to “all”. On Outlook Express, just click on an email message and when the letter is displayed, go to the top and press File, then press Properties. A gray display box should come up, then press Details and you should see the header of that email.


Now Email headers have what’s called a basic header and an extended header. Let me show you an example of a basic email header. I will use Yahoo’s header for an example…



From: “John Doe”

To: “Jane Doe”

Subject: Hello Jane!!!

Date: Sat, 14 Jul 2001 16:54:59





Now here is an example of an extended header…



X-Apparently-To: Jane@yahoo.com via web10605

Received: from 1Cust238.tnt10.rtm1.nl.uu.net (EHLO localhost.localdomain) (213.118.114.228) by mta223.mail.yahoo.com with SMTP; 30 Apr 2001 13:16:15 -0700 (PDT)

Received: from localhost (localhost [[UNIX: localhost]]) by localhost.localdomain (8.11.0/8.11.0) id f3UKNcb02256 for Jane@yahoo.com; Mon, 30 Apr 2001 22:23:38 +0200

From: John Doe

To: Jane Doe

Subject: Re: Hello Jane!!!

Date: Mon, 30 Apr 2001 22:22:47 +0200

X-Mailer: KMail [version 1.0.29]

Content-Type: text/plain

Content-Type:

References:

In-Reply-To: 1.0

MIME-Version: 1.0

Message-Id:

Content-Transfer-Encoding: 8bit

Content-Length: 551





This is what you would see if you had the extended header option on. As you can see I colored the IP in red for you. The header also shows the person’s domain (1Cust238.tnt10.rtm1.nl.uu.net). I would go into detail on everything in the header but that is not why you are reading this and this is not an email tutorial so...


How do I get someone’s IP when they are chatting on MSN/AIM/Yahoo Messenger?

How many times have you moderators on computer security message boards heard this one? The answer is quite simple really. All you need is a direct connection from you to the person’s computer, and a wonderful little command that comes with all windows systems called netstat. Netstat displays active connections and protocol statistics.


Now to get someone’s IP on these messenger you would need a direct connection. I will explain why in a bit. Now to get a direct connection you would need to have some sort of file transferring, voice chat session, or even a web cam session with Windows NetMeeting. Ok say you are sending a file to someone and you want to get his or her IP. First you would need to open up the MS-Dos Prompt or Command Prompt or the little black window thingy to the computer illiterate. Just follow the same format I showed you early on how to find your IP address. You know, Start, Programs, Command Prompt. Ok now you should have the Dos Prompt window up. While you are transferring/receiving a file, or voice chatting with someone, type in the command “netstat -n”. You should see something like this…


C:\WINDOWS>netstat -n

Active Connections



Proto Local Address Foreign Address State

TCP 211.124.228.98:1138 64.4.13.69:1863 ESTABLISHED

TCP 211.124.228.98:1150 64.4.12.190:1863 ESTABLISHED

TCP 211.124.228.98:6891 12.90.50.93:1978 ESTABLISHED



The above is an example I got from using the netstat -n command on a friend. The two above commands are from the MSN messenger service. There are two because I am chatting to two people at this time. So while I was transferring a file to this person I did the netstat -n command and got their IP number (12.90.50.93).

So you might be asking, “How come I can’t just do a netstat -n while I’m chatting with someone?” Well the truth is that you can, but you would only get the IP of the MSN server that you are on. Let me explain it better with a picture….




You

\

\

\

MSN Server

/

/

/

Other Person (cause the word “Victim” sounded too malicious :-) )





So that’s basically how it looks when you send your messages to your friend or what not. They first have to pass through the MSN server then go to your friend’s messenger. So if you were to do a netstat -n you would only get the server’s IP. Now a direct connection (in red) would look like…




You

| \

| \

| \

| MSN Server

| /

| /

| /

Other Person





I think it’s pretty self-explanatory. Now netstat -n would work since the transfer is between you and the other person, and not you, then the server, then the other person. For more on netstat, type “netstat ?” in the DOS prompt.


What is IRC and how do I get a person’s IP address on there?

IRC or Internet Relay Chat is a chat where you can communicate with people all over the world in up to thousands of chat rooms using real-time message sending. To connect to the IRC world of chatting you need a chat client. The main one is mIRC, which can be found at www.mirc.com. Of course there are other clients such as BitchX, ircII, ircle, pIRCh, Xchat and so on. For the second part of the question I’m going to assume that you already know how to operate an IRC client. So to get someone’s IP on IRC all you would have to do is issue the command “/whois Nickname”. Some information on the user should come up and you should see the person’s domain or IP. Unfortunately, most of the IRC servers block a person’s IP number or domain by only showing half of it or by blocking out the entire thing with X’s. This is done for the safety of the chatters from lame bastards who actually think nuking someone and using Subseven is actual hacking. So using /whois on a person might not be too affective.

Another method would be to get a direct connection with someone on IRC using DCC or Direct Client to Client and doing a netstat -n on the person. You can do this by opening the MS-Dos Prompt and issuing the netstat -n command on them while a file transfer in DCC is occurring or by issuing the command while you are in a DCC chat with someone to get their IP address. Look at “How do I get someone’s IP when they are chatting on MSN/AIM/Yahoo Messenger?” for more details about netstat -n.


What is social engineering and how can it help me obtain someone’s IP address?

A technique mainly used on phones, chats, and physical person-to-person talking, social engineering is tricking someone into giving out valuable information to you about someone or something without them knowing they are doing anything wrong. Yeah, I know, that’s just the technical way of saying it. Its mainly just lying your ass off to get what you want.

An example of social engineering, for example, on IRC chat servers is impersonating the services bots that you identify to register your nickname and save your password. Most IRC servers have a services bot called Nickserv, which you would enter a command to register your nickname with a password. Most people online will try impersonating these bots by changing their own nick to look similar to the services bot (example: Nickserve *with an added “e”*). The impersonators would send out Services notices that are similar to, or exactly the same as the ones sent out by the real Services bots. These fake messages would tell you that you have to identify your nickname (example: /msg NickServe IDENTIFY yourpassword), to the fake bot, which in turn would give the imposter posing as the Services bot your password for your nickname. So it’s best, if you are just starting to learn how to chat on IRC, to learn what the real Services messages are for that server so you won’t run into any problems such as this. Also, make sure your password isn’t the same as any other accounts you may have or else a simple stolen nickname can result in the loss of your email accounts, messenger accounts, and so on.

Now, an example of social engineering to get someone’s IP or domain would be to register a web page with, let’s say, geocities and add a site stats counter to the page. (No, you wouldn’t have to make a web page. Just register a free website which should take less than 5 min and add just a counter to the page) When you have done that you can tell one of your online friends or enemies to go “see your pic” page you made (say pic because EVERYONE is a sucker for pictures online) If you think they wouldn’t want to see your ugly mug then say it’s a pic of your girlfriend or boyfriend, depending on who is reading this. So when they click your web page link to see a blank white page with just a counter on it, say something intelligent to them like you forgot to add it or you accidentally deleted it when trying to add it. You’ll figure out something. (To lessen the suspicion add a silly picture of a bodybuilder or a supermodel or something. Be creative :-)) Now when the person visits the site, just go into your website’s stats counter logs and view the person’s IP. If their domain shows then just do a reverse DNS on it.


If someone is using a proxy or wingate how can I obtain his or her true IP address?

As for as I know, I don’t think you can. Not easily anyway. You would have to be the administrator of the proxy or wingate server and or get access to the server logs of your entry somehow. Its how the proxy server administrators are able to track you down when they find out from another system administrator at a company or somewhere that you were using their proxy or wingate to break into the company’s system. They in turn contact the police who end the cycle of tracking you down by throwing your ass in jail.


Someone told me that websites could get my IP and other information. Is this true?

Yes this is true. Anything u connect to via the Internet can capture your IP and other sorts of information. Go to www.privacy.net then click at the top for a full analysis. That site shows u what information other sites may get off of your computer while you are surfing them. Feeling a little less secure now? Well, I would recommend trying an anonymous browser such as www.anonymizer.com or www.safeweb.com. You can also use proxy’s to spoof (hide your real IP or domain) your connection by using MultiProxy, A4Proxy, or Proxomitron (a personal favorite).

that's all folks.. hope you enjoy it ;)