Subject: RE: [hackers-il] how to get e-mail address in smtp header on tcp packet

From: "Arik Baratz" <[email-masked]>
Date: Tue, 7 May 2002 15:06:30 +0200

This is slightly off-topic, but I'll answer it anyways.
 
First of all, some inaccuracies that you have:
 
1. The standard SMTP port is 25, not 23
2. The SMTP RFC number is 821. You shouldn't care much for RFC822, it makes sense if you want to examine the message itself, but you are interested in the envelope.
 
Now, since the address is not at a fixed offset, and not necessarily in the first packet, and may be fragmented over packets, you need to do a full tcp reassembly on the packets you listen to. You can do it yourself, but then you have to learn a lot of TCP (RFC 793 IIRC). There is a library that can do it for you, it's called "libndis" IIRC.
 
Once you assembled the incoming TCP stream (the one which destination port is 25), it's fairly easy to search for the commands that contain the address, namely the MAIL command and the RCPT command, for sender and recepient(s), respectively. Go to RFC821 for more details. There's another RFC for the ESMTP protocol, but it's mostly irrelevant if you're only interested in the senders / recepients.
 
I sure hope you're not going to use your program for spamming. I guess that if you're a spammer it wouldn't stop you if I didn't help, but if you are, remember that it is illegal in most countries today. It is also pretty easy to find out where spam came from. An internet provider recently won a large lawsuit against a company that used his internet connection for spamming.
 
Take care!
 
-- Arik

-----Original Message-----
From: praveenjohri [mailto:[email-masked]]
Sent: Tuesday, May 07, 2002 1:19 PM
To: [email-masked]
Subject: [hackers-il] how to get e-mail address in smtp header on tcp packet

hi ,

i have struck with a problem how to find an e-mail adress in a tcp paket

i am making a packet tapping device which have a function to tap the tcp connection

or the packets containing a perticular e-mail adddess supplied by the user.

my problem is i dont know how the smtp is carried on tcp and where the e-mail add.

lies in packet.

is it so that e-mail address is always at aperticular offset in the packet
i
 n that    case searching will be easier.

is is possible that if i capture all packets comming/going from tcp port23

and search for a perticular string in tcp data to get the address......but if it is 

possible then also it will be a time consuming process consuming my cpu and

obstructing the packet capturing engine to do its work and will also be consuming a large amount of memory also.

hey guys show me our intelligence and give me some good information and suggestion

right now i amtrying to read the rfc 821 and 822 to get some info......

its urgent man!!!!!! help me

with regards 

praveen johri

  _____  

Get Your Private, Free E-mail from Indiatimes at  <http://email.indiatimes.com> http://email.indiatimes.com
Buy Music, Video, CD-ROM, Audio-Books and Music Accessories from http://www.planetm.co.in 

Yahoo! Groups Sponsor	

ADVERTISEMENT
 <http://rd.yahoo.com/M=226014.2032696.3508022.1829184/D=egroupweb/S=1705006764:HM/A=1000239/R=0/*http://ads.x10.com/?bHlhaG9vaG0xLmRhd=1020771260%3eM=226014.2032696.3508022.1829184/D=egroupweb/S=1705006764:HM/A=1000239/R=1> 	
  <http://us.adserver.yahoo.com/l?M=226014.2032696.3508022.1829184/D=egroupmail/S=1705006764:HM/A=1000239/rand=738514647> 	

To unsubscribe from this group, send an email to:
[email-masked]

Your use of Yahoo! Groups is subject to the Yahoo! Terms of Service <http://docs.yahoo.com/info/terms/> . 

********************************************************
This email has been scanned by Port Authority.

********************************************************

---

From: "Arik Baratz" <[email-masked]>
Date: Sun, 12 May 2002 10:26:42 +0200

Hello Johri
 
This is your third question to the list.
 
From your questions, you clearly have not bothered to read the documentation that comes with libnids (I know, because I have, and I know it answers your questions in full).
 
I think I speak for the rest of us when I say that we wish to help only those who help themselves, and therefore will not answer any of your questions anymore.
 
Please don't be offended but take it as a hint: Go do the research before you ask stupid questions.
 
Regards,
 
-- Arik

-----Original Message-----
From: praveenjohri [mailto:[email-masked]]
Sent: Saturday, May 11, 2002 8:12 PM
To: [email-masked]
Subject: Re: RE: [hackers-il] how to get e-mail address in smtp header on tcp packet

hi,

can anybody just tell me that does libnids can take input fo tcp reassembly from

user defined socket fd i.e. my lsf socket .

since i am capturing all packets arising -tcp with src/dst por 25 and i want to make

out from these packets that wether they contain required email address or not

bit for this i want reassembly to be done on those packets provided on my socket

and if many streams have to be build to track the connections then also for every stream the input of packets should be from my socket only otherwise if libnids try

its own ways then what is the use of making my own filter its all in vain.....

with regards

praveen johri

  _____  

Yahoo! Groups Sponsor	

ADVERTISEMENT

 <http://rd.yahoo.com/M=194081.2053425.3521449.1829184/D=egroupweb/S=1705006764:HM/A=1046314/R=1/*http://www.ediets.com/start.cfm?code=3225> 	
 <http://rd.yahoo.com/M=194081.2053425.3521449.1829184/D=egroupweb/S=1705006764:HM/A=1046314/R=2/*http://www.ediets.com/start.cfm?code=3225> 	 
Height:	   4 5 6 7 ft  0 1 2 3 4 5 6 7 8 9 10 11 in	
Weight:	  	
Sex:	   F  M	

  <http://us.adserver.yahoo.com/l?M=194081.2053425.3521449.1829184/D=egroupmail/S=1705006764:HM/A=1046314/rand=774754240>