Re: Warnings on the download page

[James Muir <jamuir@xxxxxxxxxxxxxxx>]

H D Moore wrote:
> Thanks for the feedback! Keep in mind this is the first applet I have ever 
> written :-) Any information about the new API would be appreciated. Do 
> you happen to know what versions it is compatible with? Bizzare that they 
> would explicitly allow non-proxied connections. I used the Datagram 
> Socket was so that I could send requests directly to the DNS server and 
> not have to do any extra processing on the server side. 
>
> The next version of decloak should be able to avoid Java/Javascript 
> completely by loading up streaming media, PDFs, and so on within IFRAME 
> tags inside the HTML. These media files would reference the magic DNS 
> domain or custom services running on my server. An easy hack would be to 
> stick a fake SMB service on the server and then embed UNC paths into the 
> HTML. The tricky part is implementing enough of CIFS that I could extract 
> a unique identifier from client's request.

All versions since 1.5 (released Sept 2004) have it.  The current 
version is 1.6 (although now Sun is calling it Version 6).

The docs for the 1.5 API are here:

http://java.sun.com/j2se/1.5.0/docs/api/

Anyone who thinks it is safe to use Java with Tor needs to read this:

http://java.sun.com/j2se/1.5.0/docs/api/java/net/Socket.html#Socket(java.net.Proxy)

> Socket
>
> public Socket(Proxy proxy)
>
> Creates an unconnected socket, specifying the type of proxy, if any,
> that should be used regardless of any other settings.
>
> If there is a security manager, its checkConnect method is called
> with the proxy host address and port number as its arguments. This
> could result in a SecurityException.
>
>     Examples:
>
> * Socket s = new Socket(Proxy.NO_PROXY); will create a plain socket
> ignoring any other proxy configuration.
>
> * Socket s = new Socket(new Proxy(Proxy.Type.SOCKS, new
> InetSocketAddress("socks.mydom.com", 1080))); will create a socket
> connecting through the specified SOCKS proxy server.

In the 1.6 API, everything is the same.

You should read the Fort Consult White paper "Practical Onion Hacking" 
as some of things you mention (SMB, CIFS) are mentioned there, I think. 
 VB and ActiveX are probably worth exploring.

-James