Catch Invisible Friends On An Instant Messenger !!

So now I will tell you about something which will be very fun to try out.

So why are we here?  What is the fun thing...?

Hey I am just there....Many of us stay invisible in Yahoo Messenger, Gtalk etc to avoid unnecessary chat requests and spam. Yeah, I know you have many more reasons to stay invisible. But being in the ETHICAL side let us not discuss it here!! .

Here we will learn how I used to detect the status of my friends in IM's.I will be concentrating mainly on detecting the status in Yahoo and Google IM's.

Yahoo Messenger

Here I will give you some links and their uses. Using this method you cannot find out the invisible mode of the person. But it is easy to know the ONLINE or OFFLINE status of your friends. The main advantage of this method is that you never have to login to your account to know the status of your target.

http://mail.opi.yahoo.com/online?u=[Target's username]&m=g&t=0 

You will get a yellow smiley if the person is online and gray if the person is offline or invisible

http://mail.opi.yahoo.com/online?u=[Target's username]&m=g&t=1

This will fetch you a button with “Online Now” or “Not Online”

http://mail.opi.yahoo.com/online?u=[Target's username]&m=g&t=2

We will get an image with “I am Online send me a message” or “Not Online right now”

http://mail.opi.yahoo.com/online?u=[Target's username]&m=g&t=[number from 0 to 24]

Similarly you can change the [number from 0 to 24] to any number from 0 to 24 to get different icons displaying the status of the target.

http://mail.opi.yahoo.com/online?u=[Target's username]&m=a&t=0

Shows a text with “[Target’s username] is ONLINE or NOT ONLINE”

http://mail.opi.yahoo.com/online?u=[Target's username]&m=a&t=1

This will show a value “00” if person is offline and value “01” if he is online

NB: You will have to change the [Target's username] in the above shown URL’s to the yahoo ID you want to detect.  

For Eg: If my Email ID is “hackingwithswar”

So http://mail.opi.yahoo.com/online?u=[Target's username]&m=a&t=1

Will have to be in the form

http://mail.opi.yahoo.com/online?u=hackingwithswar&m=a&t=1

NB:

We can use these links discussed above to set or hide your status on your blog or site.Think How..?   

We cannot find out the real status of person who is in the “invisible “mode. It will be shown as  he is “Offline”. So in order to solve this problem we can use the method discussed below.

Yahoo Invisibility detection sites

While surfing the net I came across many sites which help us to get the real status of the person of our choice.

Feel free to click on the links to try it out yourself and have fun

Yahoostatus 

Detect Invisible 

Invizibili 

Detect Invisible

Invisible Scanner

Gtalk 

There is a simple trick to know if a Gtalk Friend is online or not

First login to the Gtalk application with your Gmail ID

Then activate the chat window of the profile you need to check the status in the Gtalk.

The Next step is to activate "off the record" function in the chat window of the Victim

Here you can see that you do not receive an  alert when you send your chat

Now we get two kind of responses depending on the status of the Victim.They are :

1) When the Victim is in invisible mode

  In the image displayed below ,you can see that no alerts are generated.So we can be sure that ,the Victim is Online,but in the Invisible Mode!!

2)When the Victim is really Offline

ICMP Scanning

This is mainly used for info gathering..When an ICMP request is sent the response is generated on the basis of the OS. So by analyzing this response we can know the OS of the target.For recording the data we can use recording or sniffing tools.

Main Uses :
Host detection
OS info gathering
Network topography detection
Firewall detection

Format of ICMP Message :

Type value              code value           Error message
       3                             3                  Port unreachable
       3                             2                  Protocol unreachable

Other ICMP Messages for OS Detection :

ICMP Message Quoting : Difference in the amount of data of info quoted in the errors generated is different for different OS's so we can use this to identify the target OS.

ICMP Error Message Quenching : This compares the reply sent . Refer RFC for more details

ICMP Error Message : Echoing integrity Difference in altercations made in the IP header.

General Countermeasures :
Individual monitoring and filtering of ICMP error message from untrusted network.
Chane default and settings of the responses generated by each system to avoid OS detection
Mislead the attacker by setting response of another OS.

Types of ICMP Scanning :

Host Detection :
 This is our simple ping tool.This can be used to find is a host is live or not.The attacker uses the ICMP echo request and the echo reply for the detection.
Uses:
Host detection
DOS attacks
Firewall detection
Countermeasures :
This attack can be filtered at the router level by using a simple access control list
access-list 101 deny icmp any any 8
To filter all the ping request except from the ISP we can use
access-list 101 deny icmp any any 8
access-list 101 permit icmp 0.0.0.255 any 8

Time Stamping:
This allows one system  to find out the system time of another system.But this is used nowadays for the OS detection.
The OS detection is done on the basis of the response recieved form the remote host.Different OS's have different responses.

Countermeasure :
to prevent the time stamping we can create an ACL
access-list 101 deny icmp any any 13

To filter all the Time stamping request except from the ISP we can use
access-list 101 deny icmp any any13
access-list 101 permit icmp 0.0.0.255 any13


Address Mask message technique:
This method was originally devised to detect the address mask of the remote host.But now we can use this for OS detection.
This method uses Address mask request and address mask reply for detection.
The working is similar to the Time stamping technique.The reply is analyzed to detect the OS.

Countermeasures :
ACL.
Firewalls.