Re^3: ARP Lookups

It's a tool. Granted, that dopey ASCII art thing is pretty dumb, but I got over it, and it's a valuable addition to my toolbox.

You may not realise that to do lots of useful things, you need to be root. Had a look at ping(1) recently? It's setuid root, because only root may issue icmp packets.

And your firewall will of course block any egress attempts from the host on which you run this program, right? I doubt there's a rootkit in there, but I haven't looked closely. I imagine that if there was anything fishy going on, we would have heard about it by now.

• another intruder with the mooring in the heart of the Perl

Comment on Re^3: ARP Lookups

Replies are listed 'Best First'.
Re^4: ARP Lookups by oko1 (Deacon) on May 26, 2008 at 02:44 UTC
I'm not sure what it is that you claim you "got over". The risk of having your system back-doored by a program of unknown reliability? Nope. The legal risk of having that system used as, say, a botnet director or a spam mail server? No. I could go on, but I assume you get the point. As to 'ping' - I know where mine comes from (my Linux distro), and I trust it with good reason. You, on the other hand, are giving root access to a program for which you have no chain of trust whatsoever - and that, in fact, specifically implies (via that ASCII graphic) that its author violates other people's systems and is gleeful about it. Good luck "getting over" that. > I imagine that if there was anything fishy going on, we would have heard about it by now. A pious wish, backed by absolutely nothing. Imagine having to rebuild your system from scratch because you installed this thing. Would you report it here, especially after having been told that it's not the smartest thing you could do? I seriously doubt it. -- Human history becomes more and more a race between education and catastrophe. -- HG Wells	[reply]
Re^5: ARP Lookups by Anonymous Monk on Jun 01, 2008 at 11:03 UTC
That is a very weak argument, as every program you're using is of equivalent reliability. http://www.openbsd.org/cgi-bin/cvsweb/ports/net/thcrut/#dirlist http://insecure.org/presentations/Defcon13/html/	[reply]
Re^6: ARP Lookups by Anonymous Monk on Jun 01, 2008 at 11:10 UTC
In this discussion http://seclists.org/nmap-dev/2005/q1/0132.html, nmap developers endorse thcrut	[reply]


"be consistent"
	PerlMonks