PDA

View Full Version : super snooper


w0rm
4 Jun 2006, 20:59
how does this super snooper work? (u can get it @ www.blamethepixel.com, search for "snooper" and u'll find it..)

ok i tried to build such a snooper with visual basic (this snooper was also build in vb) and i can connect, set nickname and do the USER command, but then i get an AUTHPING that looks like that:

AUTHPING wormnet.team17.com$2 66D7E8DAE2E4379B0D89DE817E9C106B70A610E9

on normal irc servers (wormnet is an irc server) you just have to use the PONG command like this:

AUTHPONG wormnet.team17.com$2 66D7E8DAE2E4379B0D89DE817E9C106B70A610E9

but when i do that in wormnet, i get the error "ERROR blabla (Authentication failed) and then i get disconnected :/

the right AUTHPONG would look like this (wwp sent this to wormnet): AUTHPONG wormnet.team17.com$2 EC782DDE8C15803E0B94240CEAEA8F1C45A30F68

the snooper doesnt even get this AUTHPING command

so my question: how does the snooper connect to the wormnet without getting the authping and how do i know the string, i have to send to the wormnet? (like EC782DDE8C15803E0B94240CEAEA8F1C45A30F68)

M3ntal
4 Jun 2006, 22:41
A good idea would be to download a packet sniffer such as Ethereal and watch what data is being sent and received by W:A/Snooper, then try to imitate it. I made a PHP script myself once, that logs into WormNET, joins #AG, and displays the chat in a browser, but i doubt Team17 would appreciate me posting the precise details you need on their public forums ;).

w0rm
5 Jun 2006, 12:18
A good idea would be to download a packet sniffer such as Ethereal and watch what data is being sent and received by W:A/Snooper, then try to imitate it. I made a PHP script myself once, that logs into WormNET, joins #AG, and displays the chat in a browser, but i doubt Team17 would appreciate me posting the precise details you need on their public forums ;).

i logged it with wpe pro and sent exactly the same packets, that the snooper sends to wwp, with my own program and it still auth-pinged me :/

KRD
5 Jun 2006, 14:24
Snooper doesn't send anything to WWP, it's designed to work with WA.

From what I've read, WWP has a rather tougher protection against external clients than WA. Don't think anyone has found out how exactly it works so far.

M3ntal
5 Jun 2006, 17:58
Ah, WWP. That changes things indeed.

w0rm
5 Jun 2006, 20:22
oooooooooh i thought it is for wwp :o :o :o :o

sorry guys!!