Lets curate a list of lain hacker tricks for fun and mischievous purposes

post some of the ""hacker tricks"" you've picked up over the years while being the internet. That is: not exactly exploits or specific program vulnerabilities, but rather generic, small, (not necessarily) things that one can still do on the majority of the internet because its like an inherent flaw or simply not something thats so serious or that many people know about it. Doesn't matter if its insignificant or very specific. Just as long as its something that is cool or something most people dont realize you can actually do. I'll start: >unicode characters this is a well known one but pretty cool, easy and applicable almost everywhere. Basically if you dont know you can use special unicode characters on a website as input to your username, bio text, or post text. Some unicode characters like long dashes usually mess with the layout and can make your text or profile stand out quite a bit. You can also generally achieve alot of stuff with invisible characters. Like on alot of websites there is a character limit but if you just post a bunch really wide invisible characters you can easily make your comment box take up the whole screen and leave people confused. >user-agent / IP leaking through trusted third party forums This is pretty specific but if you ever want to get the IP of someone who is wary of clicking links you can usually get it through a third party site that your target trusts. I did this back in the day while playing runescape and wow private servers. Typically most servers would have a forum, and alot of the forum software allow third party image hosting. That means you can basically post images where the URL points back to your own server which logs the IP of the requester. Typically i'd embed a small invisible png into a direct message to the person i wanted the IP of. You can also put it as your forum signature and then upon a request make your own request to the website and parse the "who is currently watching this forum" section (if the forum has that enabled, most do), to slowly map out IPs of all users over time. additionally you can also generate dynamic signature posts based on IPs, and once you've mapped out user IPs you can generate specific signature images based on the requester. For example you can include the username of the requester in the image, their country and city, and IP, to freak them out a little. If you really want to get devious with this you can hook the system up to one of those leaked database search services and then if it finds a consistent amount of info on a certain IP and username then you can include that in the signature as well. I never personally went that far with it but imagine how scary it would be to come across a forum signature and see your real name and phone number lmao >webm container dynamic resizing picrel. Basically webm allows dynamic resolution resizing and alot of websites dont restrain this. Not sure if it works here on lainchan but it does on 4chan and other websites. >image exif data another boring one, but in case you dont know alot of image generators put metadata about the creator in the file. Sometimes this includes their real life location, name, etc. Most sites strip this these days tho. >Arabic reverse character you can hide file extension on windows by using arabic reverse characters. This works with UTF but should also work with other arabic text encodings. ArabicChar = [U+202E] So you can do songby_dj_3pm.exe songby_dj_[U+202E]3pm.exe = songby_dj_exe.mp3 This was patched in linux in most linux distros in 2003, still works to this day on Windows.

>>76403 This weekend I peek a guy in a Mcdonalds leaving login in the kiosks in peaks hours for recollect app points. Again and again... Not much cyberpunk but...

>>76403 >If you really want to get devious with this you can hook the system up to one of those leaked database search services and then if it finds a consistent amount of info on a certain IP and username then you can include that in the signature as well. Imagine went to Lainchain to dox people ... Omg. If you found that funny I would ask you to leave. Of course you can do that, but I would only do it retain for myself and for curiosity.

>>76417 That is still a breach of their privacy and not internet-pilled. If you are going to act like a glitterboy you might as well get some fun out of it.

I used ivre.rocks to scan the internet, pretty fun when you find unprotected login pages or a server with .env file or some soykaf like that lol.

>>76459 a lainon has written extensively about this sort of thing chaoscult.org/netrunner

>>76403 >IP leaking through trusted third party forums Alright. You just gave me a new fear :D That's nuts though! really wish I could try that myself back in the days. Really doubt this will work nowadays on most sites now, eh? >Most sites strip this these [EXIF metadata] days tho. Naaah. Don't take chances. Strip the data yourself whenever you post a picture online. My turn now. My sec teacher shared it to me, but If you ever worked in a company with too much free time on your hands infront of a Winblows machine, you probably already know this. Especially if you got a strict group policies and restrictions. If your company has a "no fun allowed" policy and won't let you install your own apps: Open up Excel or any office app that allows VB/VBA macros and write a little program to install it for you. For some reason you can use shell32.dll no problem. Or simpler yet, just use the func Process.Start("x:\path\to\exe") . I haven't used those tricks yet, I really hope they still work.

>>76417 shut the fuarrrk up, reddit

I remember a lot of IRC networks making it obnoxiously easy to scrape IPs, and they'd do a reverse lookup too where you'd be able to see the ISP and geographical region. Made it easy for channel operators to ban people (a ban evader could be dealt with via a small regional ban based on the ISP's granularity), but it also made it easy to track someone if you were so inclined.

>>77013 i tried the Excel macro. if you can't install a program with your current user permissions you won't be able to install it via Excel. Maybe i'm missing something but i don't think so.

>>76416 that's a cool idea, i'll do that next time i need free points and i'm hanging out there

>image exif data >another boring one, but in case you dont know alot of image generators put metadata about the creator in the file. Sometimes this includes their real life location, name, etc. Most sites strip this these days tho. >Most sites strip this these days tho. Not Discord and its videos Wish I had something to contribute here.

>>79012 You have contributed this image

Here are the ones I know of from my fellow hacker friends, although it would be irresponsible to use them so I don't. C:\Users\Lain>color 0a >C:\Users\Lain>tree read fast for immersion >C:\ >C:\Users\Lain\ >C:\Users\Lain\Documents\ >C:\Users\Lain\Documents\ihateschool.docx >C:\Users\Lain\Documents\minecrafthomework.docx >C:\Users\Lain\Documents\porn\ >C:\Users\Lain\Documents\porn\tricked you haha.png >C:\Users\Lain>echo HACKING IN PROGRESS >HACKING IN PROGRESS >C:\Users\Lain>shutdown /f /m \\labputer5 /c "kill yourself kenny" Be warned: my white hat ethical hacktivist classmate had his computer privileges taken away from him after doing this!!

I have a folder 'Look here if you have hacked me' which contains file 'HERE IS ALL YOU WANT TO KNOW' with plain text passwords.

>>77011 Are there other articles? How do I access the rest of the site?

I like looking up "This US Government computer is for authorized users only. By accessing this system you are consenting to complete monitoring with no expectation of privacy. Unauthorized access or use may subject you to disciplinary action and criminal prosecution." on search engines to get various unimportant classified files.

I have a shortcut on my work PC desktop that says “classified mirror”, disguised convincingly as a shortcut to a folder, including a realistic fake tooltip; this actually shuts the PC down immediately, filing “honeypot activated” as the descriptive reason for the shutdown in the event log. Not that I generally leave my work PC unlocked, or that I expect any of my coworkers are insider threats, but I thought it would be a fun little trinket

Not a hacker thing just dumb fun >key swap prank On someone's mechanical keyboard switch [n] and [m] keys with each other. Due to the similar letter shape and resulting alphabetical order anyone who isn't a fully touch typer will think it was always like that and get confused why they keep hitting the wrong key and spend way too long figuring it out.

```ascii NPCs are PCs of number N, running non-upgraded firmware with vulnerabilities. ████████▓▒▓█████████████▓▓▓ ████████▓████████▓███████▒▓ ███████▓█▓██████▓▓▒▓█████▓▓ ███████▓▒███▓██▓▓▒█▒█████▓█ ███████▓███▓▒█▓▒▒▓▒▓██▒███▓ ████████▒███▒▓▒▓▒▓█▒██▓███▓ ███████▓▓█▒█▒█▓▒▒█▓█▓▒▒▓██▓ ██████▓█▓▓▒█▒▓▓▒▓▓█▓▓█████▓ ██████▒█▓▒▓▒█▓▓█▓▓▓▒▓▓█▓█▒█ ██████▓▓▓▓█▓█▒▓▓████▒▒▓▓▓▓▓ ██████▒▓▒▒▓█████████▓▒▓██▓▓ █████████▓▓███████▒▓▒▓▓▓███ ███████▒▓▓▓▓█████▓▓▓██▓█▓██ ██████▓▓▓█▓▓███▒█▒▓███▒█▒██ ██████▓█▓█▓▓▒███▒▒███▒▓▓▒██ ██████▓▓▓█▓▓▓▒██████▓█▓█▒██ ██████████▓█▓▒▒███▒▒▒█▓█▓██ █████████▓▓██▒▓█▓██▓▓▓▓█▓██ ██████▓▒▓▓▓████▒▓▒▓▓█▓█▓███ █████▓▒█▓▓█▓▒▓█▓▓█▓██▓▓▒███ ███▓▓▓█▓█▒▓▒▓█▓█▓▓▓▒█▓▓▓███ █▓█▓▒▓█▓▓▓██▒▓▓█▒▓▓██▓▒████ ▓▒█▓▓█▓▒▒█▓▓▓█▓███▓▓▓▓▒▒███ ▒▒████████▓▓█▓████▓█▓▓▓▒███

>>76403 here are my "hackerman" tricks >osint trick leave IP/uagent tracker links into your unsuspecting text files, your home folder's files, your windows installation desktop or some place, your bookmarks, your phone's /data/sdcard0/, /mnt/storage/ or whatever it was using. put the links inside crafted PDFs, bait files named "bank account", on images as qr code, on your browsers [warning!] and you'll know which of your devices botnet/foss are compromised! on some cases phones would steal the clipboard and you might see which apps' datacenter is trying to access your copied links. no wonder my one-time download links would get broken few times (these fuarrrking rats lol). also did this on browser and found out browser like chromium official and pale moon would leak simply due to safebrowsing in around 2015 or so. they completely disabled it on 2016 and so I kept using pale moon simply due to that as firefox still uses and leaks to google (yes the links get clicked and is showing google datacenter IPs hitting my logs). fun way to tell who's trying to access your files also, you can also upload said bait files on your cloud data and see what kind of compromises they may have too! just make sure your links are not a known ip logging link or they will get ignored! you can host a logger yourself, fun way to datamine the dataminer! another easy trick is I usually check the files inside the source code or inspect element, used to do this for flash games. now they got a lot more clever with things like html blobs, you can somewhat bypass them through inspect element > network tab (reload) and you'll find the direct link to the file/content you want, encrypted ones typically are harder to deal with like those encrypted mpeg cenc. >>80363 nice powerdork! I remember I should scrape those files I found many months ago.

>>80628 >! you can host a logger yourself, fun way to datamine the dataminer! found this https://github.com/KasRoudra/IP-Tracker

>>76403 I'll share one with you if this site doesn't consider me "flooding" because this place has no traffic. You can embed a SMIL track in a QuickTime .mov file which will reach out and ping a url whenever the media is played.