NN2013 - Revision history

Ad001 at 12:27, 29 April 2013

2013-04-29T12:27:37Z

Ad001 at 12:23, 29 April 2013

2013-04-29T12:23:19Z

Ad001 at 12:20, 29 April 2013

2013-04-29T12:20:45Z

Ad001 at 12:19, 29 April 2013

2013-04-29T12:19:19Z

Ad001 at 12:18, 29 April 2013

2013-04-29T12:18:42Z

Ad001 at 12:18, 29 April 2013

2013-04-29T12:18:21Z

Ad001 at 12:18, 29 April 2013

2013-04-29T12:18:04Z

Ad001 at 12:17, 29 April 2013

2013-04-29T12:17:40Z

Ad001 at 12:17, 29 April 2013

2013-04-29T12:17:26Z

Ad001 at 12:15, 29 April 2013

2013-04-29T12:15:50Z

← Older revision		Revision as of 12:27, 29 April 2013
Line 146:		Line 146:
	0		0
	</pre>		</pre>
		+	This test has also been performed in February 2011.

@@ Line 58: / Line 58: @@
 </html>
 </pre>
-This content is contained in a file on a web server. It includes a graphic file. Acquired through the UMTS network of the German Internet service provider ``1\&1'', the file appears with the following content:
+This content is contained in a file on a web server. It includes a graphic file. Acquired through the UMTS network of the German Internet service provider ``1&1'', the file appears with the following content (when downloaded in early 2011):
 <pre>
@@ Line 75: / Line 75: @@
-\subsection{Connection-Manipulation: IP-Address-Spoofing}
+===Connection-Manipulation: IP-Address-Spoofing===
-\label{lsting:ipspoofing}
+====Human-Readable====
-\subsubsection{Human-Readable}
 The request may be as follows:
-\begin{scriptsize}
+<pre>
-\begin{verbatim}
 GET / HTTP/1.1
 Host: heise.de
 Accept: */*
-\end{verbatim}
+</pre>
-It is issued to the IP addresses assigned to the domain \verb,heise.de,:
+It is issued to the IP addresses assigned to the domain heise.de:
-\begin{verbatim}
+<pre>
 [ad001@glas /usr/home/ad001]$ host heise.de
 heise.de has address 193.99.144.80
@@ Line 117: / Line 115: @@
 Connection closed by foreign host.
-\end{verbatim}
+</pre>
-\end{scriptsize}
-\subsubsection{Dumps}
+====Dumps====
-\begin{scriptsize}
+<pre>
-\begin{verbatim}
+:32:35.503903 IP 139.30.32.197.59424 > 193.99.144.80.http: Flags [P.], ack 1, win 8326, options [nop,nop,TS val 1091444 ecr 2443535463], length 47
-:32:35.503903 IP 139.30.32.197.59424 > 193.99.144.80.http:
 Flags [P.], ack 1, win 8326, options [nop,nop,TS val 1091444
 ecr 2443535463], length 47
 E..c.U@.@.:... ..c.P. .P......(... ........
 ...t..dgGET / HTTP/1.1
@@ Line 132: / Line 127: @@
 [...]
-:32:35.519615 IP 193.99.144.80.http > 139.30.32.197.59424:
+:32:35.519615 IP 193.99.144.80.http > 139.30.32.197.59424: Flags [FP.], seq 65:568, ack 48, win 1448, options [nop,nop,TS val 2443535486 ecr 1091444], length 503
 Flags [FP.], seq 65:568, ack 48, win 1448, options [nop,nop,TS
 val 2443535486 ecr 1091444], length 503
 E..+L.@.@....c.P.. ..P. ..)%...............
 ..d~...t Apache
-Location: http://blue4.wlan.uni-rostock.de/login.pl?action=
+Location: http://blue4.wlan.uni-rostock.de/login.pl?action=which_interface&destination=http://heise.de/%3f
 which_interface&destination=http://heise.de/%3f
 Connection: close
 Transfer-Encoding: chunked
@@ Line 149: / Line 141: @@
 </HEAD><BODY>
 <H1>Found</H1>
-The document has moved <A HREF="http://blue4.wlan.uni-rostock.de/
+The document has moved <A HREF="http://blue4.wlan.uni-rostock.de/login.pl?action=which_interface&amp;destination=http://heise.de/%3f">here</A>.<P>
 login.pl?action=which_interface&amp;destination=http://heise.de/
 %3f">here</A>.<P>
 </BODY></HTML>
-\end{verbatim}
+</pre>
-\end{scriptsize}

@@ Line 52: / Line 52: @@
 </pre>
-\subsection{Content-Manipulation: HTML-File and Images}
+===Content-Manipulation: HTML-File and Images===
-\label{lsting:UMTS}
+<pre>
-\begin{scriptsize}
-\begin{verbatim}
 <html>
 <body><img src="eins.png"></body>
 </html>
-\end{verbatim}
+</pre>
-−
 This content is contained in a file on a web server. It includes a graphic file. Acquired through the UMTS network of the German Internet service provider ``1\&1'', the file appears with the following content:
-\begin{verbatim}
+<pre>
 <html>
 <script src="http://1.2.3.4/bmi-int-js/bmi.js"
@@ Line 75: / Line 72: @@
 bmi_SafeAddOnload(bmi_load,"bmi_orig_img",1);
 //-->
-\end{verbatim}
+</pre>
-\end{scriptsize}
 \subsection{Connection-Manipulation: IP-Address-Spoofing}

@@ Line 26: / Line 26: @@
 The test was performed in February 2011.
-\subsection{Content-Manipulation: SMTP-EHLO}
+===Content-Manipulation: SMTP-EHLO===
-\label{lsting:smtp}
+<pre>
-\begin{scriptsize}
-\begin{verbatim}
 mail.gmx.net GMX Mailservices ESMTP {mp003}
 EHLO tralalal
@@ Line 39: / Line 37: @@
 -AUTH LOGIN PLAIN
 STARTTLS
-\end{verbatim}
+</pre>
 Using the Internet uplink provided by the Studentenwerk Rostock (test performed in September 2011), the answer changes:
-\begin{verbatim}
+<pre>
 *******************************************
 EHLO tralala
@@ Line 51: / Line 50: @@
 -AUTH LOGIN PLAIN
 XXXXXXXA
-\end{verbatim}
+</pre>
-\end{scriptsize}
 \subsection{Content-Manipulation: HTML-File and Images}

@@ Line 2: / Line 2: @@
 ===Connection-Reset: Baidu.cn===
 <pre>
 :45:11.197146 IP wlan033084.uni-rostock.de.11479 > 220.181.111.147.http:Flags [P.], ack 2789374741, win 65535, length 241
@@ Line 15: / Line 14: @@
 Accept-Language: en
 Connection: Keep-Alive
 :45:11.502060 IP 220.181.111.147.http > wlan033084.uni-rostock.de.11479:Flags [.], ack 241, win 7504, length 0
@@ Line 25: / Line 23: @@
 :45:11.503432 IP 220.181.111.147.http > wlan033084.uni-rostock.de.11479:Flags [R.], seq 4381, ack 241, win 2392, length 0
 E..(..@.~.u...o...!T.P,..B.1.J<.P.      X%...
-</verbatim>
+</pre>
 The test was performed in February 2011.