Title: Using XKEYSCORE to Enable TAO

Release Date: 2015-07-01

Document Date: 2009-07-16

Description: This NSA presentation from 16 July 2009 explains how the XKeyScore system supports the agency’s Tailored Access Operations: see the Intercept article XKEYSCORE: NSA’s Google for the World’s Private Communications, 1 July 2015.

Document: using-xks-to-enable-tao-p1-normal.gif:
TOP SECRET//COMINT//REL TO USA. AUS, CAN. GBR. NZL//20291123

Ait* tuv.

Using XKEYSCORE
to Enable TAO

Booz I AJIen l Hamilton SDS Analyst
16 July 2009

:RET//COMINT//REL TO USA. AUS, CAN, GBR, NZL//2029112:using-xks-to-enable-tao-p2-normal.gif:
SECRET //COMINT/,

Purpose of This Briefing

To show S2 Analysts how to use XKS to
enable TAO operations
The material covers some of the more
common searches in XKS, and shows you
how to retrieve valuable SIGINT data that
S3/TAO finds useful to exploit a target
It’s NOT designed to teach you about TAO
(there are many other briefings for that)

TOP SECRET/VCOMIMT/.'REL TO USA, AUS, CAN, GBR, NZLusing-xks-to-enable-tao-p3-normal.gif:
What TAO needs from analysts
TELNET Sessions in XKS
Identifying Browers
Web Forum Logins / Passwords
Webmail Logins / Passwordsusing-xks-to-enable-tao-p4-normal.gif:
What TAO needs from analysts

1 SECRET,‘COMINTr'.'F

TO USA, AUS, iusing-xks-to-enable-tao-p5-normal.gif:
TOP SECRET ,1 COMINT/;REL TO USA. AUS. CAN. GBR. NZL

What does TAO need?

Network Information

■ Logins and Passwords

■ Router configuration information

Software Information

■ Browser

■ Version Numbers

■ Operating Systems

■ NOTE: If target device is under a satellite hop, please
consult your TAO Liaison on how to proceed.

TOP SECRET/,'COMINT /.'REL TO USA, AUS, CAN, GBR, NZLusing-xks-to-enable-tao-p6-normal.gif:
TOP SECRET ,COMINT , REL TO USA. AUS. CAN. GBR. NZL

How Do We Get That?

Network Information

■ We target TELNET, FTP, etc for logins and passwords

Use a LOGIN and PASSWORD QUERY “TO' ports of interest
(21,23, 110, 69, etc)

■ WEBMAIL logins and passwords

Use LOGIN and PASSWORD QUERY “TO' ports of interest
(80, 3000, 8080) DO NOT use the login/password you find to
log in as your target in Airgap. Ever. Just record them and pass
to TAO.

■ Router configuration information

Use “Full Log DNI query” FROM port 23 and “From” IP of
interest

tod vrDrT,rniiiMT.'iDi:i min» aiiq rsu p.rr M7iusing-xks-to-enable-tao-p7-normal.gif:
TOP SECRET,'COMINT/, REl TO USA. AUS. CAN. GBR. NZL

How Do We Get That?

Software Information

■ Browsers

Use HTTP Activity Query and results are in the
“browser” field

■ Servers

Use HTTP Activity: HTTP “Response” traffic
contains web server information

■ Operating Systems or Version Numbers

Using FULL LOG DNI we can do “Banner Grabbing”
on content FROM port 23 and FROM the target’s IP
address

TOP SECRET,'COMINT'HEL TO USA, AUS, CAN, GBR, NZLusing-xks-to-enable-tao-p8-normal.gif:
TOP SECRET.7COMINT /REL TO USA. AUS. CAN. GBR. NZL

1001 I 001

OOljjoni inoi -

Agenda

V

CfgvOr

TELNET Sessions in XKS

TOP SECRET/,COMINT.'REL TO USA, AUS, CAN, GBR, NZLusing-xks-to-enable-tao-p9-normal.gif:
TOP SECRET VCOMINT /REL TO USA. AUS. CAN. GBR. NZL

me Understand Telnet

Administrator attempts to reach remote host using Telnet

From Port 3434

“Telnet 202

► To Port 23

To Port 3434 “Welcome to xyz router,
Apache 2.0 - Please
enter Login & Password”

From Port 3434 „, ,

Username: Admin

Password: Admin”

To Port 3434 “Flere’s your router

configuration information

From Port 23

► To Port 23

From Port 23

TOP SECRET/, COMINT,,'REL TO USA, AUS, CAN, GBR, NZLusing-xks-to-enable-tao-p10-normal.gif:
Administrator attempts to reach remote host using Telnet

From Port 3434

Let’s make a query
and target this traffic!

“Telnet 202.

“Welcome to xyz router,
Apache 2.0 - Please
enter Login & Password’

*

To Port 23

From Port 23

“Username: Admin
Password: Admin”

“Flere's your router
configuration information



To Port 23

From Port 23

I

i

TOP SECRET/'COMINT.REL TO USA, AUS, CAN, GBR, NZLusing-xks-to-enable-tao-p11-normal.gif:
loot 1 OÛJ tCCI
■ i 1

TOP SECRET'VCOMINT'/REL TO USA. AUS. CAN. GBR. NZL

Banner Grabbing

0! It

Search: Full I og

Qtjciry \.irnu:

liistiNcatinn:

3*udi roeULl server

Additional Justification:
Miranda Kumbor:

This is the
router's IP
address for
which you’re
trying to gain
access (mail
server maybe?)

Datetime: | 1 Week Start: 12009-Q7-Q9 Q| 100:00 stop: SO&X

Client IP: |______________________________________________

username: |

*ttrib-te Info:

[Popúlate vrith Fial

IP Address: |2l From V

IP Address: To ~

Port [23 From +|

TOP SECRET/,'COMIMTVREL TO USA, AUS, CAN. GBR, NZLusing-xks-to-enable-tao-p12-normal.gif:
TOP SECRET VCOMINT/.-REL TO USA. AUS.CAN, GBR. NZL

Banner Grabbing

i i ^



To Port 3434

“Welcome to xyz router,
Apache 2.0 - Please
enter Login & Password"

From Port 23

. s S«sgn|2 • ••
Date time Case Notation FiomlF' To IF f From Port To Port Ttrotocc

Hotunn Hex'.* (3) Mar» (6)

mm



Quiek Clldtî

'«C Session

à

J

a

«

Find opposite side of s^ss.
213H^^H23 ->
212

Find traffic cn
212
213

Find application

te rm i n al/t lní
AUTO FORMATTER: app_id- tenninol/telnet/from_server
Cisco Router end ?
This feature requires the one-tine us» of the usernsire •cisco"

with the password "cisco“. The default user nene and password have a privilege level of 15

Tienne ehs.’.gf n w p.»■. I.eiy
Here aefthe Cinco ICS ccnnanda.

credent in In using SDH or llie 103 CM.

uneraaae privilege 15 necret 0
ao usernone cisco

¡Replace and -iRiypassuorcl:- with the user none and'paesoord you want to use

for-iwa^einformation «tout St>H please folio» ti^-instruettons in the QUICK START
JUISI for^retic-router cr go to http://gggvcTSco.coir/go/8ttt.-

irser Access Ver IXic«tlcn

tTsernaae: .....lap

Tossvord:

TOP SECRETiCOMINT.’REL TO USA, AUS, CAN, GBR. NZLusing-xks-to-enable-tao-p13-normal.gif:
loot 1 OOI 1001
moi loo« moi

TOP SECRET VCOMINT//REL TO USA. AUS.CAN. GBR. NZL

Banner Grabbing (another example)

y-

* OI IOIDIO

To Port 3434

“Welcome to xyz router,
Apache 2.0 - Please
enter Login & Password”

From Port 23

Datobm* Cas* Notation From TP To tP From Port To Port ’
2000-07-11 04:22:^6 tjsfr '?oootczmtt 125^^1 ■ (■i China) 200^^| Cuba) \ 23 2132 j
Session 1 Hw : ¡) Mota (4) 1

AUTO







fcnfclr lex! lost

'«l|

Quitk Clicks

'tision

=>'it

200

a

200
125

J Find acplkatior ~3z~c none <
torrr njl/t«Inot/Tion_so

AUTO FORMATTER: aDD_'d- termlnol/telnel/from_senrer(port23) Viewar- ASCII format

IAI'3000 Intearated Access Device »

Copyright. 2002-2005 Muavei Technology. Co., Ltd.
Location Hane:

F hone Nuntien

TOP SECRET ,'COMIMTi.'REL TO USA, AUS, CAN, GBR, NZLusing-xks-to-enable-tao-p14-normal.gif:
1001 1 001 tool

tool tool imi
o r-\

TOP SECRET.VCOMINT//REL TO USA. AUS.CAN. GBR. NZL

101 »—

* 01 101



Banner Grabbing (another example)

D.ii nbmo


From IP

To tP

From Port To Port

2009-07-: Session 12 23:59:33 eraSZZ: h*k»*(3> M*t*(3) j^T.l-.7 61^^H|(BChina) 200 Cute) ¿3 2541
ifeülMi [auto • IIl 1— T Ihrt;,ill, F ■ : :j

Quirk Clit k%

Session

aSK

-«h

lick Saarct

61

200

Find traffic or
200
— 61
Fmd ac plication

termalAelnet/fro»n_se

ff a

* Oeleome to ZTE Tull Service Access Platform 8

# #

B Press Pjstura to aet started s

23 # i

|:2i # Cep-,Tight 2005-2009 . 2TZ Co., Ltd. a

If If

i.e-31 n:

TOP SECRET/,'COMINT,7REL TO USA, AUS, CAN, GBR, NZLusing-xks-to-enable-tao-p15-normal.gif:
TOP SECRET.VCOMINT//REL TO USA. AUS.CAN. GBR. NZL

Banner Grabbing (another example)

Datirtimti Casii Notation From ]P

2009-07-13 1? 35 52 ¡¿2 ■' * 200|

E Cuba)

To IP
2101

:■ :nma)

From Port To Port Proti
23 MZ1Q TCP

Sasston -*»3ir (3) Mat« (4)





Enter tail to eeaich

Quiik Clii k%

.’j£ SQSMOn

«i

AlllO FORMATTER: app_id~ terniinnl/telnet/froni_server(poi123) Viewer- ASCII formante'.

One-Click Searche

3

. , ’ Copyright(e) 1998-2006 Hunvei Technologies Co., Ltd. All riohts reserve«. »

j EiQ^oçigsjdeofieis T Bltbout tte ovaet.5 P£10E «itten coaMlltj

20C^^^^H2^> » no (jecoMfi 11 lng oc reverae-englneering shall be allowed. *

J Find fincerennt

sigdev/huawei Login authentication

mnc/mitwork/configura

210f

20C j

3 FirtC «3Plic«.ior

tormina Vtelnetyfrom_se

Username:,

Ujotnaw*:

Unername:

TOP SECRET ,'COMINT,,'REL TO USA, AUS, CAN, GBR, NZLusing-xks-to-enable-tao-p16-normal.gif:
TOP SECRET ,'COMINT.','REL TO USA. AUS. CAN. GBR. NZL

Help me Understand Telnet

r

Administrator attempts to reach remote host using Telnet

From Port 3434

“Telnet 202.

To Port 23

From Port 23

Let's make a query
and target this traffic!

To Port 3434 “Welcome to xyz router,

_____ Apache 2.0 - Please

enter Login & Password”

From Port 3434

“Username: Admin
Password: Admin”

To Port 23

From Port 23

To Port 3434 “Flere's your router

configuration information

TOP SECRET), COMINT ,REL TO USA, AUS, CAN, GBR, NZLusing-xks-to-enable-tao-p17-normal.gif:
TOP SECRET.VCOMINT//REL TO USA. AUS. CAN. GBR. NZL

Telnet Logins and Passwords

Search: I ogins and Passwords

Query Nome:

Justification:

Additional Justification:
Miranda Numbor:

cbinese t-ln-t sys *dmjLn login

p&iawocd

This is the
router's IP
address for
which you’re
trying to gain
access (mail
server maybe?)

Usor Name:
Password:
Domain:

:p Address:

:p Address: 202

Port:

Port: 23

Datetime: [~~1 Day *** | Start: 2009-07-14 - 00:CO ^ Stop

2009

[ FrorrT ~

To

From ^

iTo

TOP SECRET/.'COMIMTiVREL TO USA, AUS, CAN, GBR, NZLusing-xks-to-enable-tao-p18-normal.gif:
TOP SECRETf7COMINT//REL TO USA. AUS. CAN. GBR. NZL

Telnet Usernames and PWs

From Port 3434

“Username: Admin
Password: Admin”

To Port 23

Oatetime Case Notât an From IP TO IP From Port To Pc
2009-07-13 07-37-4? • Ak*_vJUs. Jv/S.v0 H 1— Temen) 202 IMZ 21
Session eattet (3) Wä(4)
‘EfriiiWtiitoJ AUTO

Quit k Clicks «

^Session

3 Fins cMcsita 5itfe of

AUIO l-OKMATTEK: app_id- temiinol/telne»/to_server(piirt',i'3) Vie»rer= ASCII forma

Tns-Click Searctiss

USER 123
TASS 321
(TYPE I

££Si fCRT 195,219,37,1RS,4
■ART A I.F*I>

24

:2 *J«IT

tprminal/lolnetAo.sorri

TOP SECRET)'COMINT,,'REL TO USA, AUS, CAN, GBR. NZLusing-xks-to-enable-tao-p19-normal.gif:
TOP SECRET ,COMINT' REL TO USA. AUS. CAN. GBR. NZL

Help me Understand Telnet

Administrator attempts to reach remote host using Telnet
From Port 3434 To Port 23

“Telnet 202.

From Port 23

To Port 3434 “Welcome to xyz router,
Apache 2.0 - Please
enter Login & Password”

From Port 3434

Let’s make a query
and target this traffic!

“Username: Admin
Password: Admin”

To Port 23

From Port 23

To Port 3434 “Flere's your router

configuration information

TOP SECRET)'COMINT.REL TO USA, AUS, CAN, GBR, NZLusing-xks-to-enable-tao-p20-normal.gif:
1001 1 001 tool

I

TOP SECRET.VCOMINT' REL TO USA. AUS.CAN, GBR. NZL

Router Confias

A. A .

-

Scorch: Full I orj

Quury Moiiiu:

Justification:

Additional Justification
MkumfJ Numbor

i r UI..HI. aoia tfilwt traffic

configs

Custom v Start: 2009-07-12 a| 21:00 V» Stop:

Attntjtft info:

1» Address
10 Addro-çç:
Port:

l£[

!To

From your target’s IP
From Port 23
Greater than 500 bytes

123

| | From -

Data Length: >500

TOP SECRET)'COMIMT/.'REL TO USA. AUS, CAN, GBR, NZLusing-xks-to-enable-tao-p21-normal.gif:
loot I OOI toot

TOP SECRETtVCOMINT'/REL TO USA. AUS. CAN. GBR. NZL

C ICiO
I ! 01 •

> 01 101
IIÔL

Router Configs

F

Datetme case cwn ip

2009-07-13 14:32:13 r \

iS Iran)

«¡*wlon | KVa!* (5)

ABC«

Quick Clicks

!
«

Find QMQsce sise a1 sess

ïs i0i

Firxi hnoorciir.t

Angerprint/roucer/ctew/

misc/n ctwo rk/cnnfigura
nr.g*q)nf*/rcoter/cisco
Find traffii
85

7i|

tcmwi af/tsinot/r c
interface EtkernecO
no ip addrais
shutdown



interface 3eri«IO
no Ip

ahutdovn

clock rate 3015232
no fair-queue

interface aerial!
no ip address
ahutdDvn

clock xata 2015232
no fair-queue

I

--Waif«-- .........

no ip addcas*
shutdown

clock rate 20152 32
no fair-queue

“Thanks for the router config”

-TAO

tnearfae* San*.2

interface 2«nal3
no lp address
shutdown

clock rate 2015232
no fair-qu^u*

I

interface SerialL;15
ip unma*>ered Fast Et tiecnetO
eneopstiloticT» ppp
la On switch-t7pc priwury-netS

Many times will contain
Access Control Lists (ACLs)
- VERY important pieces of
Intel. Copy/Paste out full
Config...

interface Sonal2îl5
tp utmuiiteied Fas*. El Ivcl nctO
rncapaulatIon pppusing-xks-to-enable-tao-p22-normal.gif:
Identifying Browsers

TOP SECRET'COMINT,7REL TO USA, AUS, CAN, GBR, NZLusing-xks-to-enable-tao-p23-normal.gif:
TOP SECRET1VCOMINT//REL TO USA. AUS, CAN. GBR. NZL

Identifying Web Browsers

Why?

□ TAO can exploit the browsers that lack
strong security

TOP SECRETiVCOMINTiVREL TO USA, AUS, CAN, GBR, NZLusing-xks-to-enable-tao-p24-normal.gif:
TOP SECRET//COMINT//REL TO USA. AUS.CAN. GBR. NZL

User Agent (Browser) pulls

Search: I IT TP Activity

This query targets foreign-based targets visiting known Jihadi
web forums to learn about what browsers they use.

Query Mame: web lorum browsers

Justification:

Adc cional Justification
Miranda Number

targets visiting Xr.oun jihadi
wet foLuim

OofBtiniB: Custom v 2009-07-12 3 00:00 |-$ Stop: 2009-07-15 \3 21:59

HTTP Type

Host- ... 'hanein~¡ri¿o. 'o: saM net ' « jr -i *!> \ Mutate nith URL Field Builderl

Browser: 0

country,: □ !UB AND !CB AMJ CA Aid !NZ AND !AU V | Froi i v Foreign ©


TOP SECRET,'COMINT,,'REL TO USA, AUS, CAN, GBR. NZLusing-xks-to-enable-tao-p25-normal.gif:
TOP SECRET//COMINT//REL TO USA. AUS.CAN. GBR. NZL

Web Forum Visitor profiling

9*



**

•J«

9*

HK1

WMMfcjMMluiet

.’l:|iinuluM

MAM^|iiun.Tu>=>l

MAM,*piMII.4UK)

klltftlirf)

HA*U>UllI"

WAW^i|imn.TuKl

NAW.-t1u>?t

WA*,.*Niiin,’lu>:i

WAWlMKillrfO

MAWjUtMlMl

ftnnJiMKiiiiifo

ha*A l.it't viri'i

lil4farni:r:

TBF

M>nl.v4.0 K>iu;cii:lv USE 7.0: Allows NT iMH>;*v4.Cilo:»)ms NT $.tSVll;SLCC1:-HIT
Nrtii2t8K2T.O 104.911 PiUk.MDP-2.1 C«ii|iir *i:IIkMÜ Mi^BteMSFLO-.YiXitfiat NT 5.1; SVt AsfcTflS.4*

W>ms4.0 tcong^rtMeMSC WrttoKw NT if; SLCC 1: .NET CLR2.9.5072?; U>4) Ce** PC 5J): J€ ICLR J.1W50S:
Mi,T»a6Jl MtMlTISlv1iU>.iPG»cfc>gOWOHeiSftt«w3AH

(««ii;.iir.lK USFLftWInkm* NT 5.1;SVtPC \
Wh-AWI) «..nn-Jßl« USE &0;Vfr>kiNt ♦♦♦♦♦♦♦♦ ♦ ;i ♦♦♦*:♦♦♦!# ♦♦♦♦♦'." ♦♦♦ »NT US

0j«a9Z5iWi(to*>5NI Ulten-

•Kt)

AI »1

Mi.nl.i U) KoiiiMBteMSE 7.U; rtnkws NT ♦.♦¡äCCI; J*I OR 2.0lS#72?; M+du CmM VC SA JC I (lfl 3.0.415«:
M)db4jD Koiiijotfile USE 6.0: AV»1o«s NT 5.1;SVti«T OR 2.0.50727)

Miala'jJ) (rtml»ws;UMl*'ASNI 5.1;eiMJST A|0lfW«>M525t9(KRIM US*lj«K0|Cl««»» 1.MS4JÜSN.K1525.
M)3lo-5.9 |UxM45tcU »DelUK OS X WJ.0; CIHKI A«>lrtW.K)l525.1 t.l iNHTML. IK- GwkOI V«ia* .11.2 S4tfl5
U)n»A4J) USE aO; Alr»io«s NT 5.1; SV1; JET CLR 1.1.4322; JET CLR 2.0.50727; »ft>y*$feK0 To«..» 4.5:

WiniAdJ) K>4i9diMK: USE UWMom r. ♦ r )!♦♦♦♦♦> i \i«fc

W).Tl.»W USE fu♦♦♦♦♦4SYll♦2S♦>*\»NI U SV

jaL.livt-i.ii X..L^.kIi l-AAAAAAAA ■ A IAAAuAA; .i ♦♦’CS» SV

This displays the
located), their IP,
browser

From Country (where target is
the website they visited, AND their

wi,T».r»i t

¡.WGIWKilSOfcGIlHi SlCCt.

H

j{3«s^Kiömfaaavai

tw) 7.i:MTMmHB«i.nM.’rm hw tu» HIiT (rtlNttt/CUH»: J* I Cl R

TOP SECRETiVCOMIMTi'.'REL TO USA. AUS, CAN, GBR, NZLusing-xks-to-enable-tao-p26-normal.gif:
TOP SECRET VCOMINT/VREL TO USA. AUS. CAN. GBR. NZL

HTTP Activity to find Browsers

r

r -rrrp Typo FmCou Host
•Ml CN m-ia.'iov.ii
9*1 XX mww.iiiu R WHVW.kllCIMJUVJI
oel AC www.1nb11.0ov.lr
9* PU eddJ>elKlaslit.0ov.s
IM« .B» vs. IM' at MWW.WOIIM* MJOV.ÍI
|WSI MX b.tieliilasin.gavJr
0*1 R www.khciMjovJi
0*1 PK cms.infn.yovb
mt AE www.niTa.oovji
0*1 R WWW.kllOL.JrtVJI
ool CH WWW.N.dll.lJOV.B
•jei R www.woine4LiKiv.il
ÍM1 EU www2.retah.oovJr
Ofrt R ll.MUi|>Olt4lir..V (Ml PK www.iiijnLijov.il
0*1 R www.wome4Lnov.il
• 1*1 It w ww.i .i7.w4nief>iovJi
POP Quiz:
Which browser are we see
0*1 It- wwW.Sora.ÿflV.r
(Ml K> WWW.lllillUIOV.il
•wl www l
Brows AT -

Mozillal.0 tcompatiik-: MSE fldúMudomMI SJi
Mosilla.4.0 Icmnp.iUilv: f.l>
rjo/iii.i 4.0 <i ■ i| > .it ■■ ii--. r.i'-
Mozilla 4.0 (coinpaMble: M‘

MozMa.4.0 |c empatille; M‘

Here’s another example where we
targeted the people visiting *gov.ir
websites

Mo/ilbi4.0 (compallife; MSE 6.0; Windows NT 5.1;FRFF; JET Í1R1.U1??)

Mn/ill.i J.O |coinpMll>lr, MS» fi.O; Windows NI 5.1; GTR6; JET Cl R 3.0.04506.64B: JET •
Mozaia.<4.0 (companbte; MSE 6.0: windows NT 5.i:svii

M071IU14.0 (cotnpatiite: mse 6.0: windows ni 5.1: svi: jikur i.o.3705: jet clr 1/
Mr-/ill.i 4.0 Icomp.Hiile: MSE 6.0; Windows NT 5.1; SV I; JICT CLR 1.1.4322)

MozilUi 4.0 (compatlile: MSE 6.0: Windows NT 5.1: SV I: JIET CLR 1.1.4322: JO CLR 2.<
Mo7111.1-4.0 K.omp.Viik: MSC 6.0: WindowsNT 5.1: svi: JIFT ci R 1.1.4322; JEI Cl R 2.1
Mo/ill.i-4.0 1ci.iii|i.iI«i|.-: MSC 6.0; Windows NI 5.1; SV 1; JET Cl R 1.1.4322; JET Cl R 2.1
Mozilla4.0 |comp.ita>le: MSC 6.0: Windows NT 5.1: SVI: JICT CLR 1.1.4322: JET CLR2.1
Mozilla4.0 »COinpatlile: MSE 6.0: Windows NT 5.1: SV1: JICT CLR 1.1.4322: JO CLR2.1
Mozilla4.0 (compaliite; MSE 6.0; Windows NT 5.1; SV 1; JIET CLR 1.1.4322; bifoPirtlL?)
M«/iil.i4.0 »cofnpali.le; MSE 6.0; Windows NT 5.1; SV 1; J1FT CLR 2.0.50727)

Mozilla4.0 (compatBile: MSC 6.0: Windows NT 5.1: SV1; JICT CLR 2.0.50727; .NCTCLR 1
Mi.7iii.i 4.0 (compatan*; MSE 6.0: windows ni 5.1: sv i: Jir t ci r 2.0.50727; .ni T ci r 1

14.0 (compatit le: MSE 6.0: Windows NI 5.I: SV 1: JO CLR2.0.50727: NI l CLR 1

14.0 (compaliile: MSE 6.0: Windows NT 5.1: SVI: JICT CLR 2.0.50727: NCT CLR 3

IUKbCUMC

TM7IJCI4.0 I.'.omp.lIBd*; MSE 6.0: Windows NT 5.1: SVI; JIFT CLR 2.0.50727; .NFT CLR 3
Mozilla4.0 (compatlik-: MSC 6.0: Windows NT 5.1: SVI: JICT CLR 2.0.50727: FDM!

1‘ ™7>7‘ *using-xks-to-enable-tao-p27-normal.gif:
HTTP Activity to find Browsers

s

d

.ÏC



cn fo o

X c
— —

CJ V

ï 5

N



mi

w> i/5

hi-»-

ill

â ¿ â

S S S

XXX

Si

d w5

c k
11
XX

d e d

■fi d -c

UMi U

I = 2

q g

■a <

* u

s I

O
CD
LLJ
CO

M

p

CD

b ;

o .-

CO i- ■

0

>

$

O

O. F

X

0

-C

i

I

g
;

s

u u u

ü I 2

0

c

v_

0

■4-4

C

3

a

_i

o

a c.

-j —

V
; g

a: c J

w V 3

ï S 1

t -».

5

U

I-

LU

*



“ 5

G 3

>— w

LL LJ

* z

+r

£ £

— - — « « M £

ï“ ïi 53 i

u
15 * 5 ? S11

.1 .1 7. N ÑT AT s N r*. A.* r^TA

rsscc;p:c!p:£î£r:p

^ 5 8 S M S ^ S ? 5

^ ^ ^ O o o s> © o « « c

^^•■«¡i'ÍKníví'Ííníí'Ia

5 5 5 5 5 55555“5

C w u w u ü u O © C i.

LL LJ Ui LJ JJ IL JJ LL LU LU LU L

aîzaî2;za;zz2îZ2;2

~ - ü ¿2 ¿2 ¿2 ¿2 ¿2 ¿2 ü ¿2 f

££££££ £££££



z

ï

I

5

Z Z

il

Z Z Z Z Z Z Z

£ U U U

£££££££

1

*************

3 3 3 3 3 S 5 XUUÊJtX

““S

U ± U
2 S Z

g *

d -fi
U U

i i

*: d g d g d d d g d g
■fi >fi d “fi ’fi rfi -fi -fi d -fi *
MiUMiUUUUUUUMî

sssisssiisssi

“T—T-T—?r-T—?T—Z—r“T—g—£—r—r—r—r—r—r—ç—r—*—£—g—g—ir

HnniHinnifflIlllll

O c c> c

T r» T rt

•9 1 1

o c. c q o q c s> c c> « c> q c. c o « q c

-5-S'5'7*5^^-5-:*5'5'5-5'S'5^';'5^
55 = 555=5 = 5=5 = 5 = 555 =

N y

iiiiii¿i¿i¿íiiiiii¿i¿i¿

« 5

± I

3

O

O

fc Z
L. V

i I

il

I III

In î

í 1 J i

fill

í i U

ï ï ; ï
s ® > s

Il i

£ 2 lé
d 3 ï . .

I I i 1 1

xfi
i I

I I

« « i

i

s

a S S 5 K B K

a X fi ï 2 2 a



liumilimiumumu

Mozilla 4.0 is NOT a browser .......................................................................................................................................—H».kit {.y», .....-•■mt

--------------------------------------------------------------------------FOMSkCHH .L’UMIHirHEt TO USA. AUS, CAN, GBR, NZLusing-xks-to-enable-tao-p28-normal.gif:
HTTP Activity to find Browsers

=■

*

Î ; 3 N 5 * i 4

fllflfiS * *

I

i ;

i

El. 11 i u i u h i i m i u i n H i

s

o

O

TOP SECRET),'COMINT ,'REL TO USA, AUS, CAN, GBR, NZLusing-xks-to-enable-tao-p29-normal.gif:
TOP SECRET1VCOMINT//REL TO USA. AUS, CAN, GBR. NZL

Mobile Browsers



I Ikl

Hrmv.cr *-
¡RAPP.1 5.0 NoM.iNDG-l I ?0; Series«
Moulljl.O (lotrvatiM« MSI 5.0; SrtiwG
Moan;» 4.0 (CBmpatlMef M5C 5.0:Seres#
MbzCVI.O (CMivaUbie: MST 5.0: S« Iw»
>1.0 (campodble: MST 6.0; SymU.»
Muiit .1 4.0 (cwnnitiWe: MSC 6.0; SvtiiM.ii
Momia 4.0 koiiukhim*: MSC 6.0: svmu.ii

Mu. «.i 4.0 (coilfidllbtt' MS» 6.0; svini «.U
Uoj*,.40 (campante: MST 6.0: SymU.»

MarHU'SO(SymlilniiOS.9.2;USSnlesMKl Ndtki«121>c5.11:4 nO.-l.nr>
MaataVO (SïtrtbianOSV.ï: U SoiieMJOO. **ia6120c«4tl iXH.-4.lii>
MaalaWMSytrtiMnOS.W; IfcSoiiwWKjJ Nrtia0120c«.51;ll«(feMD '

MMiiiai'50
*-» T* n rc> I - ..nr r\ t. i *. r*

? P.nlile.MinP-? 1 Confiqni.itioni'C.I DC-1.1

’2j6 Hoki*6030'5.03 ’I PivMe.MOP 2.0 CviifwumtivuCLDC. I.«
■2.0 Nokla930»KL53 >r«»e IMP 2.0 ConflÇWClDC-1.l)

1.1 Mo.kl.177104.10 ) Pione.UDP.24 CoflflguationODC-LO)
OS: Nokia 1170.5.06 3.3.0.1
OS: Nokia 1470.5.0? 3.3.0.1

OS: Nokia 1470.5.07 0.4.0.1

- - aiL-JaJ.MUl

If you have thousands of
results, try to “Group By”
to “dedupe” results

OS; Nokia 1470.6.07 7.3,0.1
OS: Nokia1170.5.07 1.4.0.1

l.k'. il iS.O |Sv«iiiumOS 0.2; 0:S*»i«tC0-ji lk*»5?00it«W«bKH413 IKHTML
Moi#a5.0 (SmiHiuiiiOS0.2; IfcS*«le*00 '3 Nc*u5700'3.83.1: io4*rtedP 2J) CoUkii»jIwii CLDC 1.11 A|it>kWt*>K»-4134HIITI.M
MorM.tSO (Spt«iK«lOS.0.7; U: Sc*leslHKl 4tc4(la1)7(IOt:i OC-1.1 » flp|XKII41ï (KHI
Me/MaSO (Syti IimiiôS 9.2; U{ So iesftO-3. IM(fci5700.5.11;Pi 4Ne*«P-20 C^ilguiJllOftCUXM.I ) A^iteWebKimiS (KHTML,

U l.k .-il i VO ISwîimiiOSO.2; (3:S«4l«fOOO Ik*I.Hi I H3H.Mq.ll11 3.5»; Pial»« Mil C 2.0 CoirtitM.Hioii'CUX: 1.1 ) ApiikWeliKH.-IIO irvniini. bko Mvcr.oi >*«1»
Moi#,>5.0 (SyntoonOS 9.2; U; Som*003 Ikki.ili120c 3.03; I olik«.m>P ¿J» C«riKji».ilion CU>C 1.1 » AM*W»bKil-413 IKHIML. like Gickol Srrton413
l.ki 'll.i’V 0 (SMrt'W'lOSi’9.2; I* 5«IPSWI I M.-*U>5120c4.21; I o4lle Mill

Sait Ascending
Sail Descending

^ Finit

Htetc-jram
PritX Data
Hiptrjurn i>mj

rK SficnwHide
FH auwfii column YGdtti

14

Watch for Mobile
browsers!

2AH.'JIIII\|tr.HIUin.LUV 1.1

UCK3E61-moo 3*to; Pfonie.MlDP-2 0Con#3uraw)iVCLDC-i 11*s*ne*?t - rf»i 3 ckhtml.Ike Gecko)Safanai 3

•Kill Ml , Ilk- Gecko) s.if.wi 4 13
.KHTMI. Ilk- Gecko) S.rf,«l413
IKHIML tet* Gecko) Safan-113
I ^in'ivTA’urjri IKHIML. hk« Gecko) Saian.413

I4nr«.>50 (SyMMnnOSi’9.2; ll; smesGrn N.*ME51.1?OOU j6:Pn*)le MIPP.2.0 coiinijiBanonClOC.M1 A|»HeWeli4Mu.'#.r5.(t (SyiiiiuiiiOS'9.2; 13. SeilesGOO. NcliuE51.1-304.34 56;PiUikML>l»-2.0CmHmmattend. DC 1.1 • AwteWMiM 413 {KHIML. like Gecko) S.*.biH3

» »»• -«'• - • «Bn»* m r - »....— -h- « n nr •

■• •■•••>« !•? ii/ii*»» tit.- r, #.

TOP SECRET ,'COMINT'REL TO USA, AUS, CAN, GBR, NZLusing-xks-to-enable-tao-p30-normal.gif:
SECRET Ü COMINT/,

Agenda

Web Forum Logins / Passwords

TOP SECRET/.'COMINTiTREL TO USA, AUS, CAN, GBR, NZLusing-xks-to-enable-tao-p31-normal.gif:
ooi loot

TOP SECRETiVCOMINT.'VREL TO USA. AUS. CAN. GBR. NZL

Web Forum Logins/PW

r

Search: Logins and Passwords

Query Mom«:

Justification:

torcigr. lihadJ. iceb focu* u=cr3'
logins p»«ssjcrds

Additional Justification
Miranda Number

Dotetline: 12 Pays * Stan: 2009-07-13 [Q| 100:00 fel Stop: [200907-15 Ig] [ÜÜ

User Name:
Password:

Domain: [♦moqaiwmh com or,al-shcM,sac
IP address

From

Countr, IU5 AND AND CA AND rC bNO I At

TOP SECRET/,'COMINT.REL TO USA, AUS,

Foreign ©using-xks-to-enable-tao-p32-normal.gif:
Smton HsrixO)_ veta (111 Attatfrwf.s <19)

AUTO

ErtartadtD acaren

Quick Clicks

Ui Wesson
d !(( attachments
J ? unknown
ä ? teta

=>Uí

errbedS*:J_b.Erí*6

errbed3e3__bo5«6

orrtocd3o3_Cüa6

errbed3e:JJ)d*?ó

unkf>©*n_5C0-'«-*

BrrbBd3e3_3ai«0
orrbcd3o3 baso6
errbed 303 „bacaf»
0rrfced363_b¿*e6
errbedse3_ba«ó
errded3e3_baseC»
0frdcd3O3_öa«o6
errbedS*3_ba$»6
Brr6edácá_boa«6
urrbüd3u3_b¿voC>

crröedCod_base6 —

orrbcdüo-jaaeab

errbedOM.beseó

j Frü coMi.ti int er x«

9k

AUTO FORMATTER; 3C0_jC= mall/wiftmsll/vtiullBtin /owor= ONI_PR£SENTER torrmtftcr. !nfo=


^ Display Information: HTTP-POST /Form-Data & 5£

IIS Web Form Display

*<
do

Li 1—

Form Fields



agree
pt5Word_nul5
pa* >\voi dconfn liijndJ
day 0

m.-.nrh 0

adduKiubcr

hrqr^v v. «..Hiii jiil iH*yliiuiiir‘ii.«iMu|»h|irMu-iiuriu

l

year

QSdliailK
password
pattwoi dconfn m
einmi

onaikonftnn

onaice*tanq>

uuagchusli

ioo.com
Igyalioo com

<1382 qy

b9"6c$ IP7b5ah.ee I3nl9ad2969958cl

TOP SECRET'VCOMIMTiVREL TO USA, AUS, CAN, GBR, NZLusing-xks-to-enable-tao-p33-normal.gif:
using-xks-to-enable-tao-p34-normal.gif:
Masquerade as user and read mail

■ Useful, but secondary to....

Potentially use Login/PW to get full access
to web server itself

■ Port 80 is useful, but....

■ Port 3000 has XDaemon traffic (woo hoo! Let’s
take a look)

TOP SECRET)'COMINT,,'REL TO USA, AUS, CAN, GBR, NZLusing-xks-to-enable-tao-p35-normal.gif:
TOP SECRET.,'COMINl'ïREL TO USA. AUS. CAN. GBR. NZL

IGOI 1 OO) 1001

Web Mail Logins XKEYSCORE

Search: I ogins ©nd Passwords

Quory Nomo:

ludlllcatlan:

Targeting foreign-based
(non-5EYES) Iranian
government webmail
users

Iranian based uetoiMLl.1 Servern
in irán.

on:

>er:

no: iwwk - star. acotKP-oa □ co:i Webmail Ports

IP Address.
IP Address;

Port: 1 Fron v

Port: [so or 3000 Of 8090 [T^ -

Users in and Duntry ]R or BR cr v€ or CO er SA er KW or 2A v From v
out of Iran
Country: lTo

TOP SECRET),COMINT,/REL TO USA, AUS, CAN, GBR. NZLusing-xks-to-enable-tao-p36-normal.gif:
TOP SECRET.',COMINT.'/REL TO USA. AUS. CAN. GBR. NZL

IOOI I 001 1001
IOOI loot IOOI
OlOOl ,0‘ >°°

0 10 01
I IOIOIOOO ,C”UI
> 01 IOIOIO _J0.

X'KEYSCORF C2C Session Vierter r
“■* 1** - 'm” ot ij

3»«iKimn Mouton

MC9-071311;S»:09

S-f-.-Jon Utm*» (3) (6)

________________mm

)«iirfc Click)

?(£ ’»»»ion

1.11 Ojnea)

TO IP
217 J

¡Iran)

r iom Port To Pori
Mi£3 82

PlOtOOOl I
TCP I

Ena» tot U :t>rch

'«If.

J

d

Find nncmtesigeot »eil
'• : :

tc

findPFCiV
21
193j

Find anciiMtinri
httn/t»o » _to_w; r> er/s
imdmun Jiaal;

C03j567i

Find ■-fcrntrc»:-rcr IP
19

AUTO FORMATTER: aap_id- hlt*/prox»_to_5Pr»rr/)Oul< jroxv Vie*e— 0PII_PRES1NTIR iorrvaRer. Irfo-

v Display Iniormalioa: HTTP GET

□^SflnaaAniKKsa

GET I0.nd_11sers.pl1p HTTP 1.0

Accept image gif. image 'x-xUtiiinp. image jpeg. image,pjpcg. «ppfccatioiu'x-sliocUwirve-flasb.

application vnd nis-poweipoait, applicationanil. ins-excel. application nissvoicl. '

Référer 1 ittp j/wvit vmf* gov. ir.lo go_t op_u* < r. php

Accepl-Liuigunge: f*

Ate epl-EiKoikig: gap. clcllnlc

User-Agent: Modi* 4.0 (compatible; MSIE6.0; Windows NT 5.1;SV1)

Host: wvisn. info. gov. ir

Cookie; azli:m> iuuic=—

Vk

admit seniat user
user I HR
username-—
place-deleted
f*iinNdclctcil

___utm»=238135644 2300P81863224871-100 I2.ÏOR-4-22 1243255420.11076857« 4

iilmz-238L35d44.110Td85“JS.4.4.iiliiKH—fniten alutmecr- ft pngef/lniks.plqi

1,1 tcatrcmouuaintcnKt-tPchc.coai3128 {wpiid2.d.STABLEl<5)

X-Forvvaided-For 193Jusing-xks-to-enable-tao-p37-normal.gif:
SECRET II C0MINT7,

Webmail Logins

More webmail examples.

1 SECRET.'COMINTi.'REL TO USA, jusing-xks-to-enable-tao-p38-normal.gif:
TOP SECRET//COMINT//REL TO USA. AUS. CAN. GBR. NZL

Chinese webmail users

Search: Logins and Passwords

(} unry \rnnn:

Justification:

Aiditional Justification:
Mir. mil.i Muriilii-r:

Chinese usbrrall logins

Start 2009-07-12

21 GO

C »

op.

User came:
Password:

Domain:

L

IP Address:

IP Address: 200

[From v-

(to ri\

Port: (From H

Port: 80 or 3000 (TO -

Country: CN

v [From ^

TOP SECRET)'COMINT ,'REL TO USA, AUS, CAN, GBR, NZLusing-xks-to-enable-tao-p39-normal.gif:
TOP SECRETiVCOMINT/.’REL TO USA. AUS. CAN. GBR. NZL

XDaemon Logins (webmail)

Ojtotimif C j-.o Notation From IP To IP From Port To Port
2003-07-11 10:08:42 .ZZ^JL^;*. .J !'■ Ornat 200^ Cuba) 104*5 omo i
SKiwn HiSite ¡3) Mst»i6) | Attiifima-ti [l)

AUTO

Enfctfcillo search

1)11 irk TKrks
& S«ss*3n
d XLAttachmeuK
d ? unknown
d ? eaxe

? ur4ro»in_621 x-*'w

j !«£ HE3H3E33E3!

- Prid aLpaar.i iiaafiKi.

6l.^^Hl944S ->
200

=> Fnd ttotfic an
200
6l|

d Fr.d.aaüiHtizR

http'coit.r’x-www-rorrTi-

AUTO FORMATTER 30pjd- http/post/x-mvw-forin urteeicoilF*) W*»- OM PRESENTER formatter. Info

TOP SECRET//« QMIM//20320108

II): 3ass_cr j_otoc Document lype:-ITTP-POSTi'Fcr'r-OBla

Oisplay Pav Data

► Document Information: Fie

CCDF

w f ontnnts (1)
hill: Jlfliat

0 htirl

Form Fields

ED fcuiflHt.ttli
^•0- Bexmc^aL

Leake »UatlimcRU
a



User

Password
Lonoii Autofinun

TOP SECRET/,'COMINTi'.'REL TO USA, AUS, CAN, GBR, NZLusing-xks-to-enable-tao-p40-normal.gif:


Justifient ion:

Additions! lu^f firntmn:
Miranca Numbor:

Chinese v*ebmail. logins

Dfilnt irrita : | Custom____Start:

2009-07-12 21:00 c Stop:

User Name:

Password:

Domain: ["126 com

IP Address: 1 From

I» Addr«««: To -1

Port: 1 From -1

Port: L To -1

Country: CM

TOP SECRET//COMINT//REL TO USA, AUS, CAN, GBR, NZL

From

-using-xks-to-enable-tao-p41-normal.gif:
ooi toot

TOP SECRET ,COMINT VREL TO USA. AUS. CAN. GBR. NZL

Webmail Logins PWs

Tr

Oetetime

2009-07-15 07:53:19

Cose Nocotion

From IP

10.34.35.45 (<2> Private AflBreu)

iChna)

From Pc*t To Peri
2255 SC

S®iUo«i «arjCO) Altarrtncnti (1)

EnKrtMltosoarci

Quick Click)

)£S*ffon
¿1 JHCAlUciments

AllTO FORMATTER: acp_d- mail/vccbinoil/carcinail '/ewer- DMI_PRESESTERformatter. Irfo-

k Onrumonf Infrm.cMna: ra

13

J 1 unknown
a ? text

? L*iknD>n_393x-ww

=4

a

a

a

Find oaoMitfi zsq at ¡biz

10.34 35.45 2745 ->

10.34.35.45

Effld.aaoLQaQai

mai/wefcrr.ai'/coremaT

▼ Content) (1) Elliu:
Filename File time Flic nilc Attadimcnt
0 htsrf -TTP-POST/Fnrm-Cata 123 0

■s' Display Information: HTTP-FOST/Form-Oata cof

UIS Web Form Display

savdotiii)
user

[ptsiword
rule

enteric hCiiA1/,

TOP SECRET),COMINT,VREL TO USA, AUS, CAN, GBR, NZLusing-xks-to-enable-tao-p42-normal.gif:


(?) Muthmenii :i) |



Quick (lick«

_____________iTmT ■■b^TTIrtfabn I i.iT'lii '________________

AUTO FORMATTER: at»_id- m«H/wek»«a/vbulletlnVBwer- ONt_PRFSFMTTR formatter tnfo-

session

d -H Attachm***
d ? unknown
d ? ttMC

? ufkncwn_W2.x-wv
d UC

d Find gsaoa-.ta ¡tie d an

d Fifri.dtcLtg^ta

mal/wnt-iailj'.tuletn

ID: ore pice Document type: HTTP-POSTF:-nOra

nKfil.iy Raw Dsra C.Cr.f

fc- Document Uformation: rlu H C.*c«rt

7 contonti (1) • ♦ (3 CiE2DS

t ill? norm; EilE.lm Fill! lilt Attachment!
£ ntml HTTP.POST/ForrrvOjta 158 0
^ Oisploy Information: Hill* POST/Torm Dots Ck SCI

UIS Web Form Display

TOP SECRET,'COMINT,,'REL TO USA, AUS, CAN, GBR, NZLusing-xks-to-enable-tao-p43-normal.gif:
SECRET II C0MINT7,

Identifying Servers

Web Servers run particular software

■ E.g. Apache, Microsoft IIS, Unix, et...

■ TAO has exploits for particular onesusing-xks-to-enable-tao-p44-normal.gif:
TOP SECRETfVCOMINT' REL TO USA. AUS. CAN. GBR. NZL

XKS query to find server info

This targets Jihadi web forums for their
Server information

Search: HTTP Acrh/ity

Qui-ry Ndnm:

Tiislilicdtiun:

additiorwl Jijstificatior:
Miranda Number:

51 had viett fan

Dotetime: 3 Day* v ! Start' 2tX»07-12 "3 03.CO C Stop: 2009-07-

HTTP Type: | rçrapcrr??

h i t: 'moquwmhcom 01 'al-siiouraaconr or'a)hur| •*„ Ti iiil.il
] Foreign ©
Count ry !U5 AKD !GB UJj !CA Aid *(Z AND IAU ~ To :

TOP SECRET:'COMINT,,'REL TO USA, AUS, CAN, GBR. NZLusing-xks-to-enable-tao-p45-normal.gif:
TOP SECRETf7COMINT//REL TO USA. AUS.CAN, GBR. NZL

XKS query to find server info

Search: I IT TP Activity

Query Name:

TuctiHratlnn:

Additional Justification:
Miranda Number:
Datetime:
HTTP Type:

ir rroa.3 web servers

This is the network to
which I'm trying to gain
access (IR MOIS).


12009-07-12 J 21:00 ■V c


response

IP Address:

req»x87\247M6[P-3M0-255;

Country: IUS AND I^B AAJD ICA AMD jMZ AND IAU v- |To v

Foreign ©

TOP SECRET,'COMINT,,'REL TO USA, AUS, CAN, GBR, NZLusing-xks-to-enable-tao-p46-normal.gif:
In the HTTP Activity results, you see the
servers listed

Server Type - Gi

Apache 2.2.11 (Unix) PHP/4.4.7 with Suhosin-Patch mod_ssl.2.2.11 OpenSSLO.9

Apache.2.2.11 (Unix) PHP/5.2.6 with Suliosin-Patcli moil_ssl.2.2.11 OpenSSL/O.9
Apache 2.2.11 (Unix) PI IP. 5.2.0

Apache 2.2.11 (Unix) PHP.5.2.8 with Suhosin Patcli mod_ssl.2.2.11 OpenSSL.O.9
Apache 2.2.11 (Unix) PHP 5.2.9

Apache.2.2.11 (Win32) DAV.2 mod_ssl 2.2.11 OpenSSL.0.9.8i mod_autoindex_cc
Apache2.2.2 (Unix)

Apache 2.2.3 (CentOS)

Apache 2.2.3 (Dehlan) DAV.2 moil_perl2.0.2 Perl.v5.8.8

m. n^ii.-a.cuu^_i_i.ruft j ...ai. n.t.i.___

TOP SECRET ,'COMINT'REL TO USA, AUS, CAN, GBR, NZLusing-xks-to-enable-tao-p47-normal.gif:
SECRET 'VCOMINT.'r

Summary



Many times when we task TAO we have
back/forth conversations about how to
exploit the target. These slides should help
you find the things that TAO needs from S2
Analysts. It’s difficult to cover all of the
examples of how XKS can help, but this is
a good start..

Good luck.

TOP SECRETi'.'COMIMTrVREL TO USA, AUS, CAN, GBR, NZL


Download Document

Using XKEYSCORE to Enable TAO (using-xks-to-enable-tao-p1-normal.gif)

Download Document

Using XKEYSCORE to Enable TAO (using-xks-to-enable-tao-p2-normal.gif)

Download Document

Using XKEYSCORE to Enable TAO (using-xks-to-enable-tao-p3-normal.gif)

Download Document

Using XKEYSCORE to Enable TAO (using-xks-to-enable-tao-p4-normal.gif)

Download Document

Using XKEYSCORE to Enable TAO (using-xks-to-enable-tao-p5-normal.gif)

Download Document

Using XKEYSCORE to Enable TAO (using-xks-to-enable-tao-p6-normal.gif)

Download Document

Using XKEYSCORE to Enable TAO (using-xks-to-enable-tao-p7-normal.gif)

Download Document

Using XKEYSCORE to Enable TAO (using-xks-to-enable-tao-p8-normal.gif)

Download Document

Using XKEYSCORE to Enable TAO (using-xks-to-enable-tao-p9-normal.gif)

Download Document

Using XKEYSCORE to Enable TAO (using-xks-to-enable-tao-p10-normal.gif)

Download Document

Using XKEYSCORE to Enable TAO (using-xks-to-enable-tao-p11-normal.gif)

Download Document

Using XKEYSCORE to Enable TAO (using-xks-to-enable-tao-p12-normal.gif)

Download Document

Using XKEYSCORE to Enable TAO (using-xks-to-enable-tao-p13-normal.gif)

Download Document

Using XKEYSCORE to Enable TAO (using-xks-to-enable-tao-p14-normal.gif)

Download Document

Using XKEYSCORE to Enable TAO (using-xks-to-enable-tao-p15-normal.gif)

Download Document

Using XKEYSCORE to Enable TAO (using-xks-to-enable-tao-p16-normal.gif)

Download Document

Using XKEYSCORE to Enable TAO (using-xks-to-enable-tao-p17-normal.gif)

Download Document

Using XKEYSCORE to Enable TAO (using-xks-to-enable-tao-p18-normal.gif)

Download Document

Using XKEYSCORE to Enable TAO (using-xks-to-enable-tao-p19-normal.gif)

Download Document

Using XKEYSCORE to Enable TAO (using-xks-to-enable-tao-p20-normal.gif)

Download Document

Using XKEYSCORE to Enable TAO (using-xks-to-enable-tao-p21-normal.gif)

Download Document

Using XKEYSCORE to Enable TAO (using-xks-to-enable-tao-p22-normal.gif)

Download Document

Using XKEYSCORE to Enable TAO (using-xks-to-enable-tao-p23-normal.gif)

Download Document

Using XKEYSCORE to Enable TAO (using-xks-to-enable-tao-p24-normal.gif)

Download Document

Using XKEYSCORE to Enable TAO (using-xks-to-enable-tao-p25-normal.gif)

Download Document

Using XKEYSCORE to Enable TAO (using-xks-to-enable-tao-p26-normal.gif)

Download Document

Using XKEYSCORE to Enable TAO (using-xks-to-enable-tao-p27-normal.gif)

Download Document

Using XKEYSCORE to Enable TAO (using-xks-to-enable-tao-p28-normal.gif)

Download Document

Using XKEYSCORE to Enable TAO (using-xks-to-enable-tao-p29-normal.gif)

Download Document

Using XKEYSCORE to Enable TAO (using-xks-to-enable-tao-p30-normal.gif)

Download Document

Using XKEYSCORE to Enable TAO (using-xks-to-enable-tao-p31-normal.gif)

Download Document

Using XKEYSCORE to Enable TAO (using-xks-to-enable-tao-p32-normal.gif)

Download Document

Using XKEYSCORE to Enable TAO (using-xks-to-enable-tao-p33-normal.gif)

Download Document

Using XKEYSCORE to Enable TAO (using-xks-to-enable-tao-p34-normal.gif)

Download Document

Using XKEYSCORE to Enable TAO (using-xks-to-enable-tao-p35-normal.gif)

Download Document

Using XKEYSCORE to Enable TAO (using-xks-to-enable-tao-p36-normal.gif)

Download Document

Using XKEYSCORE to Enable TAO (using-xks-to-enable-tao-p37-normal.gif)

Download Document

Using XKEYSCORE to Enable TAO (using-xks-to-enable-tao-p38-normal.gif)

Download Document

Using XKEYSCORE to Enable TAO (using-xks-to-enable-tao-p39-normal.gif)

Download Document

Using XKEYSCORE to Enable TAO (using-xks-to-enable-tao-p40-normal.gif)

Download Document

Using XKEYSCORE to Enable TAO (using-xks-to-enable-tao-p41-normal.gif)

Download Document

Using XKEYSCORE to Enable TAO (using-xks-to-enable-tao-p42-normal.gif)

Download Document

Using XKEYSCORE to Enable TAO (using-xks-to-enable-tao-p43-normal.gif)

Download Document

Using XKEYSCORE to Enable TAO (using-xks-to-enable-tao-p44-normal.gif)

Download Document

Using XKEYSCORE to Enable TAO (using-xks-to-enable-tao-p45-normal.gif)

Download Document

Using XKEYSCORE to Enable TAO (using-xks-to-enable-tao-p46-normal.gif)

Download Document

Using XKEYSCORE to Enable TAO (using-xks-to-enable-tao-p47-normal.gif)

e-Highlighter

Click to send permalink to address bar, or right-click to copy permalink.

Un-highlight all Un-highlight selectionu Highlight selectionh