HipCrime's NewsAgent

HipCrime's NewsAgent (v1.07)

An (ab)Usenet Control Client for The Common Netizen.

HipCrime's NewsAgent is a free and widely available Usenet Control Client which gives Common Netizens the same power and leverage that news administrators, newsgroup moderators, and censorship cabal members enjoy.

HipCrime's NewsAgent is a high-performance multi-threaded 100% Java application which is executable on a variety of systems because it has been transported through three of today's best Java compilers:

HipCrime's NewsAgent is a powerful tool for Spammers and AntiSpammers alike. It is a true double-edged sword, referred to by Chris Lewis as " the swiss army knife of Usenet abuse tools".

NewsAgent allows you to auto-CANCEL any (or all) articles from particular newsgroups or entire hierarchies. You can remove postings on the basis of Author, Subject, Organization, Message-ID, or Path; and it will loop forever, automatically watching for (then subsequently canceling) fresh posts. Not only can you remove postings, with NewsAgent you can also replace the bodies of existing articles with the text of your choice.

Additionally, your own message can be posted, and NewsAgent will monitor to see that note every time around its loop. In the event that your article gets cancelled by someone else, it will be "resurrected" or "reposted".

HipCrime's NewsAgent does all this, and much more. Sound interesting? Then read on...

Raison d'Etre - Reason for Existence

HipCrime's NewsAgent is a specialized client program used for interaction with USENET servers of the Network News Transfer Protocol or NNTP (a.k.a. Usenet). Once configured, it operates automatically, processing existing USENET news articles, then looping continously, processing new USENET news as it appears. For this reason, it is often referred to as a "bot". As in cancelBOT, floodBOT, spamBOT, supersedeBOT, resurrectionBOT, etc. All these terms partially describe NewsAgent's capabilities. A better, more polite, term is "agent", since the (ab)User will most likely release a team of NewsAgent's ControlAgents to act as his/her/its unattended watchdogs or agents provocateur, maintaining control over selected areas of (ab)Usenet.

To understand why one would want their own NewsAgent, one need merely ask the following questions:

If you answered YES to even one of these, then you need your own NewsAgent. To make best use of it, you should familiarize yourself with the so-called "Request For Comments" or RFC documents which define the NNTP (Usenet News) protocols, although even novices find NewsAgent easy to use. The most important of these is RFC-1036, as it sets the guidelines for article format, as well as control message format.

As can be seen from RFC-1036, there are many types of articles which the casual user doesn't really have access to. These include, but are not limited to:

Besides issueing these specialized control messages, NewsAgent can also post large amounts of normal (but highly customizable) news articles. Since content censorship revolves around checking for "identical" messages, NewsAgent can also thwart these attempts by randomizing its postings. You may be shocked to know that auto-censorship software is continuously running on highly connected servers, and its only objective is to inspect your personal postings and to subsequently censor those postings whose content fails to meet certain guidelines. This is called the Briedbart Index, and it forcibly silences those who like to repeat themselves. It is also the smoke screen that is used to cover-up the activities of the Usenet Censorship Cabal, a self-appointed group which regularly blocks Free Speech by declaring it "net-abuse".

HipCrime's NewsAgent is designed to offer a solution to these problems.

NewsAgent - the Parent Process

HipCrime's NewsAgent is multithreaded. That is, when you run it, you'll see a window for NewsAgent, which is the "parent" process, i.e. the one from which you create "child" processes which will actually do something to (ab)Usenet. These children are called ControlAgents, and you can launch as many ControlAgent threads as your machine can handle. The upper limit depends on your processor and/or memory size.

Each child ControlAgent will take a snapshot of its parent NewsAgent's settings at the instant it initializes, thus allowing you to run many ControlAgents with different parameters. This is the way to obtain the best performance. Simultaneously running five or ten ControlAgent threads each processing 100 or so newsgroups, while scanning & posting through different servers. Running NewsAgent like that can easily result in post counts reaching into the 100's of thousands. Easily.

In the main NewsAgent window, you'll see three sets of control widgets, that allow configuration of the three (3) categories of options, as follows:

<== Groups & Servers
      Pick the Newsgroups to be processed, 
      the Servers to be used, and set certain 
      server specific options.

<== Control Messages
      Define control messages (if any) that will 
      be sent and how the articles they effect 
      will be selected.

<== Article Postings
      Setup the articles (if any) that will be
      posted, flooded, and/or resurrected; 
      including all headers, bodies, and 

<== status messages appear in this green bar.

When this window has the input focus, the Function Keys are available..

NewsAgent - selecting Groups & Servers

Picking Newsgroups -

In the Group field, you can supply a single newsgroup name, a comma-delimited list of group names, a wildcard* name (if your scan server supports wildcards on the LIST ACTIVE command), or a flat text file name (*must* end with .TXT) which contains a list of newsgroup names, one per line.

Usually you'll want to process many groups, either by listing them explicitly or through the use of a wildcard. The resulting list can be as long as you like, but it's a good idea to divide the work evenly between many ControlAgent children. A lot depends on the speed of your connection and the relative responsiveness of the server(s) you're connecting to. More on that later.

Selecting Servers -

In the Scan and Post sets of fields, you can specify two (2) different NNTP USENET servers, one to "scan" article information from, and the other to "post" the cancels to. This allows you to read a full newsfeed from your dialup ISP, and then issue cancels via an open server somewhere else.

This will also allow you to read a rarely carried group (e.g. alt.sex.pedophilia or some such) from where ever you can find it, and subsequently issue cancels through some other (your ISP's) fast, closed, and widely propagating server.

HINT: there's a program called News Hunter 4, which is highly recommended for locating free, open, clean swervers. News Hunter reads any news spool and tries to connect to every server mentioned therein. It will find/test thousands of servers easily, making it a HipClone favourite.

Setting various server options -

Just to the right of both the Scan and the Post servers, there is a pull-down list that allows you specify some server-specific options. You can set the Port number to connect on, a count of the number of articles to Skip at the start of each news spool, a Limit on how many articles will be processed in each newsgroup, a Username/Password to use during the authentication for non-public servers, a Time-Out value to restrict wait times, a Socks proxy to make connections with, a Priority setting for allocating processor time to the various ControlAgents, and an Extra newsgroup to "hitch" a ride on.

Port is the TCP/IP "port" number that will be used for communication with this server. This is normally 119, but can be any port that the server chooses to interact on. You can set the Scan/Post ports separately.

Skip is an integer which defines how many articles will be skipped at the start of each group's spool, prior to processing. This applies only to the Scan server, and lets you skip over as many of the most recent postings as you'd like, which is a way to jump into the middle of a spool and begin cancelling there.

Limit allows you to control how deep into various news spools to process. Sometimes a newsgroup's spool is huge (like News.Admin.Net-Abuse.* or News.Lists.Filters which can be thousands of articles). You might only want to effect the most recent 100 or so. Or, you might want to limit the number of articles that you flood a given group with. Limit lets you do both. The Scan/Post limits are defined separately. Setting a Limit of Zero (0) causes ControlAgents to process every article on the given newsgroup's spool, or to post continuously without limit.

Username/Password will be used to issued a pair of "authinfo" commands to the given server. This will let you use NewsAgent with paid (throw-away) accounts on a closed, private server. You must fill in both for this to work.

Time-Out value is specified in seconds (default is 30) and indicates the amount of time that a ControlAgent will wait for a server to respond to it. If a server doesn't respond in time, the socket will be closed and another one opened. ControlAgents are fairly robust in this respect, and will keep banging away at unresponsive servers. This connecting and reconnecting also helps work around those volume limiting filters employed by some servers.

Socks is the name (or IP address) of a SOCKS4 compliant proxy server. If a value is supplied here, connections to that NNTP server will be carried out through the SOCKS4 proxy. This has the effect of masking the location of the machine that is running NewsAgent. You can also supply a text file name here (*.txt) to invoke the SOCKS chaining feature. See the section entitled Anonymity - Using SOCKS to hide your IP address for more info on SOCKS4 proxies and SOCKS chaining.

Priority is an option that is only in the Post Server's list. It sets the priority at which the ControlAgent thread will execute. This can be a number between 1 (minimum priority) and 10 (maximum priority). Setting this too high can cause the CancelAgents to eat up all the CPU. Too low, and they'll bog down. The default setting is 5 (normal priority), and that's a pretty good one. But if you find your system clogged up you might want to lower it to 3. Same applies if you're running in cybercafe mode, and therefore want to remain quietly in the background.

Extra is also an option that appears only for Post servers. It is quite important, and warrants its own section, next.

(ab)Using Extra Newsgroups -

It might happen that the "post" server you have chosen does NOT carry all of the newsgroups that you intend to cancel in, and as a result, rejects your attempts to post control messages there.

No problem.

In the pull-down list to the right of the Post server, there is an Extra option. In there, you can give one or more group names that the Post server *does* carry. If you put more than one group name in this field, remember, this list of groups must be delimited by commas with NO interveneing spaces (for example, alt.spam,alt.evil,alt.flame).

There are several ways to use this Extra groups option.

Firstly, you can use a well-propagated group that is one of the few carried by the (limited selection) Post server you've chosen. This will force the Post server to accept it, and will also help your articles get around, when you are posting through a badly connected server or have chosen to post into a fairly obscure group.

Secondly, You can give a "test" group (e.g. news.test) or "answer" group (e.g. gov.usenet.questions). This will bait the autoresponders that monitor such groups for postings. Similarly, you can post to robo/retro moderated groups for much the same effect. Some of the test groups have as many as three different autoreaders, so for each post cancelled/superseded, the original author will get three (3) Email messages.

This causes extra confusion, but also has the side effect of alerting self-appointed censor cabal members to the fact that NewsAgent has been brought to bear on some newsgroup. Many netizens will complain loudly, if you do this (for good reason, because if they post a lot, they'll get mailed a lot). Actually you may be doing them a favour by alerting these newbies that their real email address is available for robotic harvesting by email spammers. Did somebody say "munge"?

Alternately, you can use your favorite Extra group, to cause some crazy crossposting to occur (e.g. alt.fan.karl-malden.nose) and thereby raising the beloved article count (i.e. meow, snuh, and all that U.P.A).

Lastly, you can combine Extra groups with the Hitch option (described below) to get your cancels past moderators, modbots, resurrectors, reposters, and other administration tools.

This Extra field will also accept a textfile name (*.TXT). This file should contain newsgroup names (one per line), which will be rotated randomly and used as varying Extra groups. Again, adds to the chaos. Like Tinker Tom sez "Hasten the Apocalypse".

NewsAgent - emitting Control Messages

Control messages are one of the most interesting and controversial of all the possible postings to (ab)Usenet. They are defined by RFC-1036, but since that time their use has been extended beyond all recognition by various well-meaning souls. On today's (ab)Usenet, a Control message is nothing more than a suggestion that servers take a particular action. An Advisory. Most servers refuse one or more types of control messages. Very few run on auto-pilot anymore, but there are some exceptions. For them to work at all, Control messages need to be carefully formatted, and NewsAgent allows you to do this easily.

When processing a newsgroup, a ControlAgent will read up the news spool from the Scan server, loading the headers that it'll need. You'll see these scroll by. After this, it'll run through them, canceling them, replacing them, or affecting them in some other weird way. All this depends on how you configure the message headers described below.

Control Style -

Selects what kind of Controls to send. Initially it's set on No Controls, which means that only article posting) will occur. To invoke control posting, pull down the list and pick what kind you'd like:

  • Cancels - remove articles
  • Supercedes - replace articles
  • Customized - generate other controls

Ihave - the other way to Post

The Ihave checkbox will cause control messages to be posted using the NNTP IHAVE command (instead of the POST command). Not everybody has IHAVE access to their news server. This is really intended for server-to-server transfer of newsposts, but many users have asked for IHAVE support. Apparently there are a few paid servers which allow their users to upload articles in this manner. Occasionally, there are open servers which accept this as well (although they are rare). The beauty of posting by this method is that it allows you to set ALL of the headers, including the hateful NNTP-Posting-Host.

One thing to note: when using an IHAVE server, you must provide a Path header.

Hitch - a ride on other Groups

The Hitch checkbox will cause control messages to be posted only to the Extra newsgroup(s), described above. In other words, the cancel/supersede will not be posted to the original article's newsgroup, but side-posted to some other group. As it happens, the cancel will still take effect, since cancel messages are keyed on the original article's Message-ID, not its newsgroup. Hitching your cancels/supersedes through other groups can fool many resurrectors (like DtR, GtR, or Lazarus) into ignoring stuff they should repost and can also be used to bypass whatever moderation procedures might be in place. Yes Virginia, with Hitch, you can cancel articles in a moderated group.

$alz - Cabalish Message-IDs

Every Control message has a Message-ID, generated specifically to match the original article's format. The $alz checkbox will produce special cabal-type ($alz Convention) Message-IDs which begin with "cancel." or "supercede.". Some servers won't process Controls without this, some won't process them with it. Your call.

Bust - MD5 hash basher

Some servers apply hashing routines to posted articles and use this to inflict censorship of so-called "identical" articles. The Bust checkbox causes ControlAgents to append some random text after the body of each cancel/supersede/control. This will be a random number of "sentences" which are generated from pseudo-English sentence templates. These are added in order to avoid filters triggering on minimum length, repeat similar lengths, duplicate detection by hash codes, body content checking, etc. Bust is particularly effective in helping your controls propagate through these filter-censored newsfeeds.

For more information on filtering, how it works, and how to defeat it, see the section below, entitled "Censor Filters, Suggestions & Hints".

Control Body -

This field sets the single line which will appear in the body of the cancel/supersede/control message. This is inserted prior to the hash buster described above.

Pulling down the Control Body list will allow you to set values for other control headers, as described below. Leave any of them empty, to disable that header.

From header -

Pretty obvious. But if you put only a username into either From or Approve, then a random hostname will be created.

If From contains something, then the control will have a Sender header with the original poster's Email address (i.e. this simulates a spamcancel, bincancel, mmfcancel, etc).

Message-ID header -

If blank, a Message-ID will be created on the basis of the original article's ID (for cancels/supercedes) or at random (for all other control postings).

By filling in this header, you are providing a template for Message-ID generation, which must be a properly formatted Message-ID. That is, it should be enclosed in angle brackets (<>), contain an at-sign (@), contain some alphanumerics on both sides of the at-sign, and be less than 240 characters long. Like this:


The Message-ID building process replaces numbers with numbers, lowercase letters with lowercase letters, and uppercase with uppercase. All punctuation, the at-sign, and the "host name" (right hand side of the at-sign) remain unchanged. Like this:


This is exactly the way that an original article's ID is used to produce the Message-ID for subsequent cancels/supersedes.

Control header -

The Control header can be specified from here too, but ONLY when you have chosen a Control Style of Supersedes or Customized. This is because cancelling requires the programmatic creation of a "Control: cancel " header.

But, when superseding or customizing, you can set any Control that suits your fancy, such as:

  • version - requests server version
  • sendsys - requests "sys" file
  • senduuname - requests "uuname" output
  • rmgroup somegroup - removes a newsgroup
  • newgroup somegroup - creates a new newsgroup

If you want to cause an interesting "newgroup" flood, set a newgroup Control ending with a dollar-sign (e.g. newgroup ), and each time an article is posted, the "$" will be replaced with a random string. This causes lots of weird new groups to be created, of the form:

  • alt.hipcrime.dflaljfjalsjd
  • alt.hipcrime.nbcxfoueroiwb

Path header -

Preloaded Path headers is one the best ways to mask the location of where an article originated. Before the advent of the NNTP-Posting-Host header, inspection of the Path was fairly important. Nowadays, it's still swell, but the swelling's gone down. People often read the Path, but it's usually misleading anyway.

If the Path header you provide ends with the string "auto", then NewsAgent will automatically generate a properly forged path "tail". This "tail" will be appended to whatever Path you specified, in place of the "auto". The tail produced will contain the host name from the original's From with the user's name from the original sender's Email address. For example, with a post from Dejanews, it might look like:

  • Path: nnrp.dejanews.com!somebody

Other headers -

Approved, Organization, X-No-Archive headers can all be set here. These are all optional, can contain anything, or leave 'em blank and they'll be omitted

Extra headers -

You can give up to nine (9) extra headers, but they *must* be in the correct format (i.e. contain a ": " separator), like these:

  • X-Meow: don't forget to
  • X-Comment: No Comment Needed.
  • X-This-Post-Intentionally-Scrambled: You bet!

Cancel Rule -

This allows you to selectively cancel things, on the basis of header contents. Make no mistake. To use these settings to target particular posters is to Censor Usenet, Cabal Style. That's why the Cancel Rule is initially set to "Hit Everything!", which does exactly what it says. If one is censored, then all will be censored.

However, you can change it, to pick which header will be inspected, then the other two fields will become active. You can cancel postings on the basis of the From, Subject, Approved, Organization, Message-ID, or Path headers.

Note that not all servers will return all headers. In particular, some servers return every Path header as "(none)", in which case, you'll not be able to search on the basis of the Path (or you'll have to pick a better Scan server).

Once the Cancel Rule has been activated, you can choose the type of comparison to make (equals, not equal, contains, does not contain, ends with, does not end with, begins with or does begin with), and give some text in the lower box) to be used in that comparison.

All comparisons are case INsensitive (i.e. it doesn't matter).

Further, you can put a file name in this text field (it must end with ".txt"), and a list of comparison strings will be read from that file. This will allow you to search headers for multiple cancel criteria.

Only one item needs to match, and the article will be cancelled. Or, in the case of the "not equal", "not contains", etc rules, the header must NOT match ALL of the strings given.

There's many ways to use these controls, but a few ways spring immediately to mind. One is set them all blank, and the cancel will look like it came from the originator of the message (this is the best setup for supersedes as well). Secondly, you set them all, to emulate other mass cancellation tools such as net-monitor, cancel-goose, lame-cancel etc. etc. Lastly, you can fill out the headers with info of your own choosing, to "invent" new reasons for cancelling, such as kiddie-porn-cancel, meow-cancel, anti-nocem-cancel, and so on. HipClones at play.

NewsAgent - posting news Articles

HipCrime's NewsAgent can post regular News Articles in addition (or instead of) Control Messages.

Posting Style -

Selects what kind of Articles you'll be posting. Initially it's set on "No Postings", which means that only control posting will occur. To send regular news articles, pull down the list and pick the kind you'd like:

  • Single Article - send one article per group, then exit.
  • Flood Groups - post one per group, then loop back and do it again. Forever.
  • Resurrection - one per group, then repost if needed. (see below)

Ihave -

When checked, articles will be posted using the IHAVE command. See above for more info.


When checked, attachments (if any) will be MIME-encrusted, as described below.
If unchecked, then a simpler, inline, UUencoded attachment is produced.

Bust -

Check this to generate an MD5 hash buster, as already described.

Headers -

All the same header stuff mentioned elsewhere applies here.

Pull down the list to select which header to set.

Remember that you can use .TXT filenames to rotate lists of headers, and that even those lists can contain substitution strings for better customization. So in other words, Be Creative!

Body -

Normally this is the plain text body, but it's also possible to put HTML code in here. If you do, and if you have checked the MIME box, ControlAgent will notice that fact, and build a MIME message with an HTML type body capsule. This can be a cool idea, particularly if the HTML code references the File attachment. More on this, next section.

File -

Some articles need attachments. Both UUCP and MIME styles are supported.

Entering a file (or directory) name into the File field will cause postings to contain an attachment. The default arrangement is to produce inline, UUCP encoding. Checking the MIME box will produce a multi-part message, with Base64 encoding of the binary section (if any).

You can attach a wide variety of file types. For example, .HTM or .HTML hypertext, .GIF .TIFF .JPG or .JPEG images, .AU .AIF .WAV or .MP3 sounds, .EXE .COM executables, .ZIP .TAR archives, or indeed any OCTET-STREAM.

Attached files can produce some interesting (ab)Usenet effects.

You can use a plain text body, and MIME attach an HTM/HTML file, then ControlAgent will build a multi-part MIME with appropriate text and HTML body variants. This is a great way to produce articles which look nice on plain text newsreaders, but contain trick HTML that'll spring to life on MIME-enabled readers.

Similarly, you can use an HTML body, and MIME attach an image, sound, executable, etc. That HTML code should reference the attachment (by name). ControlAgent will build a multi-part message, but with an HTML portion which references the binary section. On HTML-smart newsclients, these articles will show their image, play their sound, or RUN THEIR EXECUTABLES as soon as the reader touches the message. This is a fun form of Usenet Performance Art, and a great way to propagandize, spamvertize, deliver virii, plant groupmines, etc etc.

In any case, if you check the Randomized box, then a hash busting paragraph will be emitted after the attachment (and outside the MIME encapsulation, if you're using the multi-part option). This confuses the BI cancelBots, but will not be visible to most MIME-compliant newsreaders.

Use of an attachment rotation directory can greatly increase the randomness of your postings, as described elsewhere.

NewsAgent - resurrecting Cancelled posts

One of NewsAgent's most important features is the "Resurrection" mode of posting. It is not uncommon for people complaining about their articles being cancelled by some 3rd party. No surprise, considering what this program (and The Cabal) does. The best way to protect yourself (and your postings) is to be prepared to repost your articles.

Once again, HipCrime's NewsAgent offers a solution.

Use of the "Resurrection" mode described above causes ControlAgent to monitor articles you have previously posted, ensuring that they appear on the Scan server's news spool. After each article has been seen, it must be seen every time around the loop, and if it isn't, then the article is reposted (with a new Message-ID). And the process starts over.

The only way to resurrect posts is to have a Scan server that will accept cancels, and a Post server that carries the group(s) you want your article to *stay* posted in.

In that setup, ControlAgent posts, then watches for propagation to the Scan server, then further watches for any cancellation, reposting via the Post server as necessary.

If you leave a ControlAgent running continuously with combined "Hit Everything" cancel mode and "Resurrection" posting mode, then you can cause the targeted newsgroup(s) to contain your article(s) only and *nothing* else. And you can keep it that way, even against the censorBots, flood posters, and regular users of those group(s) - except of course, on intelligent news servers that refuse to process cancels.

All that's a bit tricky to arrange, but not impossible. One very good approach is to setup your own server somewhere. That gives you the ultimate in accessibility, but also requires your attention to the Cabal Complainers. As always, tradeoffs are there.

NewsAgent - Function Keys

To simplify use, there are a number of Function Keys which NewsAgent responds to:

Hitting F5/F6 is equivalent to clicking the Pause/Abort button in each ControlAgent individually.

ControlAgent - the Child Process

Once you've setup all three sections in the NewsAgent window, you can startup a ControlAgent child process, by pressing the "Launch ControlAgent" button. A ControlAgent thread will start, and its window will appear:

<== Scan server status/speed

<== Post server status/speed

<== Newsgroup being processed

<== Message-IDs to process

<== Authors of those articles

<== Buttons drive this thread

<== status messages appear in this green bar

You can startup lots of these child threads, and they'll appear in cascading fashion, each with its own window.

ControlAgent - Observation and Operation

Each ControlAgent displays which server(s) it is using, the newsgroup it is currently processing, the lists of From and MessageID headers that it has loaded, and an average "speed" for each server.

Speed is expressed for Scan servers in "headers loaded per second" and for Post servers in "cancels sent per second". Obviously, higher numbers indicate more responsive servers. These are running averages, so it takes a little while for them to settle down to stable values. You need to get a big enough sample set before comparing between servers. Watch 'em for awhile and you'll get the idea.

Regardless of how many newsgroups are being processed, CancelAgent will work its way through each one, posting and cancelling as required. Once it reaches the end of its list, it'll start over, checking each newsgroup again and again, looking for new stuff to cancel, and making sure that the "posted article" is still there (reposting it as required).

There are four (4) buttons with which you can "drive" a ControlAgent:

Pause -

You can PAUSE any ControlAgent thread with the PAUSE button. Click once to pause, click again to continue. While paused, ControlAgent will close its sockets to the NNTP daemons so that you can disconnect your modem if need be. Upon resuming, it will reconnect and pick up where it left off.

All ControlAgents can be paused/continued simultaneously by hitting the F5 function key. Hitting F5 in the NewsAgent window is the same as clicking the PAUSE button in each ControlAgent.

Abort -

The ABORT button will terminate that ControlAgent thread. You have to click it twice for it to take effect (just a precaution against accidents).

All ControlAgents can be aborted simultaneously by hitting the F6 function key. Hitting F6 in the NewsAgent window is the same as clicking the ABORT button in each ControlAgent.

Avoid -

The AVOID button will cause NewsAgent to skip the next article. It has accumulative effects, in that if you click it once, it'll skip the very next article that's up for cancellation. Click twice, and you'll skip two. Thrice, three, and so on.

Occasionally you'll see a MessageID or From address that you don't want to cancel/supersede, so just hit AVOID to leave it alone.

Note that you can not AVOID an article whose cancellation is already in progress. That means that if the MessageID is highlighted in the ControlAgent list, then it is too late to AVOID it. You've got to look ahead in the lists, to use this correctly.

Slide -

The SLIDE button abandons the currently processed group.

It'll also remove that newsgroup from the list for future processing. Sometimes you feel like you've done enough in one group and want to move on, and SLIDE will do that.

You've got to click it twice for it to take effect and it won't immediately, in any case. NewsAgent will perform the SLIDE function at its next available opportunity (i.e. as soon as the current posting request is completed).

ControlAgent - AutoCustomizing Articles

As each article is posted, ControlAgent produces many randomized and otherwise synthesized headers. In order to better guide the creation of headers and the avoidance of filter/censorbots, several options exist:

Header Lists -

When configuring NewsAgent (prior to launching a ControlAgent), the header fields will accept filenames of the form *.TXT, which will cause a list of values to be loaded for rotation in that header.

If all lists are of the same length, then a single random index will be used in all lists (i.e. they "go" together). If the lists are of unequal length, then a different random selection will be taken from each (i.e. they "rotate" independently). Equal length lists trigger a sort of matched rotation, letting you rotate headers in unison. Using unequal length lists for each header increases the "randomness" of the postings, since a different random pick will be taken from each list (i.e. Control will mix'n'match).

This allows you to post with ever-changing Froms, Subjects, etc.

String Substitutions -

In all the various Header/Body fields, both for Control Messages and for News Articles, ControlAgents will substitute the appropriate arguments for the following parameters:

  • #scan - scan server name
  • #post - post server name
  • #date - article Date
  • #from - address in From header
  • #fromhost - server part of From address
  • #sender - address in Sender header
  • #msgid - original Message-ID
  • #organ - Organization header
  • #appr - Approved header
  • #group - current Newsgroup
  • #random - 4-8 chars, all lowercase
  • #RANDOM - 4-8 chars, all uppercase
  • #randip - random IP address
  • #randbi - 8 digit floating point (5.2)
  • #randnum - 10 digit decimal integer
  • #randhex - 8 digit hexadecimal, lowercase
  • #RANDHEX - 8 digit hexadecimal, uppercase
  • #randhost - random host name
  • #randname - random person's name
  • #randalph - 8-14 chars, alphanumeric
  • #randsent - a single hashbuster sentence
  • #canlock - a Cancel-ID or CypherText looking thingee

These strings will be substituted wherever found within Headers and/or Bodies. Sender and From are often the same, but maybe not, if you're pre-loading the From header. There's lots of ways to use these. A few examples should suffice to get your gears turning.

By substituting the Message-ID into the Body of a cancel/supersede, you can avoid having to use the hashbuster. Since Message-IDs must be unique, a Body like any of these is guaranteed to be hashproof:

  • remove: #msgid
  • #from is cancelling #msgid
  • #msgid cancelled by #sender

You can simulate some typical news readers, for example, Mozilla's headers look like this (include the X-Mailer in the extra headers for that added bit of realism):

  • From: "#randname" <#random@#randhost>
  • Path: #randhost
  • Message-ID: <#randhex.#randhex@@randhost>
  • X-Mailer: Mozilla 2.02E-SYMPA (Win16; I)

You can also create realistic looking (but totally bogus) X-Trace headers, with something like the following:

  • X-Trace: #date, #randip
  • X-Trace: #randnum #RANDOM #date
  • X-Trace: #random.net #randip #RANDOM (#date)
  • X-Trace: news.noc.cabal.int #random #randip (#date)
  • X-Trace: #RANDOM-#randnum-#RANDOM (encoded and logged)
  • X-Trace: NEWS.#RANDOM.EDU #randnum #randnum #randip (#date)

Or, these thingees will give that "official" look to 3rd party cancels:

  • X-Client-NNTP-Posting-Host: #randhost [#randip]
  • X-NNTP-Posting-Host: #randhost [#randip]
  • X-Original-NNTP-Posting-Host: #randip
  • X-Original-Trace: nntp.#randhost #randnum/#randnum (#date)
  • X-Original-From: #sender
  • X-Cancelled-By: #from
  • X-Cancel-ID: #canlock
  • X-Cancel-Reason: #random#random#random#random
  • Reply-To: #sender

They will even work inside message bodies, to generate pretend cypher text or encryption key signatures, that'll have Echelon spinning its wheels trying to decrypt:

    -----BEGIN PGP MESSAGE-----
    Version: 2.6.2i


    -----END PGP MESSAGE-----

Clever use of the headers can produce some very confusing, hard-to-trace articles. At best, The Cabal will be able to ascertain the injection point and attempt to get it closed down. Since they can mount a huge complaint-driven attack, they are almost always successful. Still, that's no reason to give up, since new servers and proxies come online daily.

Attachment Rotation -

In the File field (described above), you can give the path to a directory on your hard drive. This directory should contain only files of the permitted binary attachment types. In that case, ControlAgent will select one of these (at random) to attach to each article it posts. When combined with some of the other randomizing features, this option can produce a wide array of "non-identical" postings. Death to BI.

High-Use Server Spoofs -

Concerning spoofs, forgeries (such an ugly word), joe-jobs, or whatever you want to call 'em, there are several news servers which have their own idiosyncrasies and emit various unique headers. If the Path you specified (or which was auto-generated by a ControlAgent, or fetched by the Scan server) contains any the following names, then appropriate X-headers will be constructed:

  • ubc.ca (X-Trace, X-Complaints-To, NNTP-Post-Date)
  • aol.com (X-Admin, Organization)
  • psi.net (X-Server-Date)
  • ibm.net (X-Trace, X-Notice, X-Complaints-To)
  • best.com (X-Trace)
  • grid.net (X-Server-Date)
  • erols.com (X-Complaints-To, X-Trace)
  • webtv.net (X-WebTV-Signature, Organization)
  • replay.com (X-XS4ALL-Date, X-001, X-002, X-URL)
  • netcom.com (X-NETCOM-Date)
  • uswest.net (X-Report, X-Trace)
  • exit109.com (X-Trace)
  • prodigy.com (X-Auth-User, X-Post-Time, X-Problems-To)
  • demon.co.uk (X-Complaints-To, X-NNTP-Post, X-Trace)
  • mediaone.net (X-Trace, X-NNTP-Posting-Date)
  • dejanews.com (X-Article-Creation-Date, X-Http-Proxy)
  • global-one.at (X-Trace)
  • msfc.nasa.gov (X-Trace, X-Complaints-To)
  • supernews.com (X-Trace, Organization)
  • news.replay.com (X-NNTP-Host, X-XS4ALL-Date, X-Mailer, etc)
  • fluffy.meow.org (X-Server-Date)
  • newsfeeds.com (X-Authenticated-User, X-Abuse-Info, X-Report)

The X-Trace (and similar) headers will contain random strings, random usernames and random IP addresses. X-Date type headers will have the current system time in GMT. All others are exact copies of whatever text that server usually generates.

These are some real paths taken from actual posts, which will trigger the server spoofing algorithms:

  • fluffy.meow.org
  • shell3.ba.best.com
  • basement.replay.com
  • mail2news.replay.com
  • portc03.blue.aol.com
  • audrey03.news.aol.com
  • ladder03.news.aol.com
  • spg-tnt3s195.erols.com
  • usenet52.supernews.com
  • pax-ca8-04.ix.netcom.com
  • dfw-ixnews9.ix.netcom.com
  • ddialup83.dnvr.uswest.net
  • accs-as31-dp08.dlls.grid.net
  • newssvr04-int.news.prodigy.com
  • ip114.austin5.tx.pub-ip.psi.net
  • pool-207-205-163-152.nwrk.grid.net
  • ip13.state-college3.pa.pub-ip.psi.net

If anybody knows about (and/or wants) other servers to be emulated, just send me a copy of their headers.

ControlAgent - Censor Filters, Suggestions & Hints

Some mention of (ab)Usenet filtering is necessary at this point. There are several methods in use, the most common is the CleanFeed censorware program. Since it's written in PERL, the source code is always available.

Upon inspecting CleanFeed.PL, it was noticed that it will filter on the basis of "one & two point" words. Now this is a most blatant form of censorship. So remember, avoid these words in your headers and message bodies:

$one_point_words =
'teen|hot|$pics|sex|$free|credit|amateur|lolita|horne?y'. '|dildo|anal(?!yst)|oral|school.?girl|bondage|breast|vid(?:eo|s)|orgy|erotic|porn'. '|fetish|whore|nympho|sucking|password|membership|make.money|fast.cash'. '|barely.?(?:18|legal)|orgasm';

$two_point_words =
'fuck|sluts|puss(?:y|ies)|\bcum|(?:hidden|live|free|dorm|spy).?cam'. '|le[sz]b(?:ian|o)|tit(?!an|ch)|dick(?!.?berg)|blow.?job|cock|clit|pam(?:ela)?.anderson'. '|twat|cunt|hard-?core|[^x]xxx|facial|gangbang|(?:live|real|innocent).girl';

CleanFeed is so heavily anti-HipCrime, that it also filters any control message which contains "HipCrime" or "NewsAgent" in either the Control header, the Subject, the Organization, or the message body. Here's some snipettes from CleanFeed.PL:

if ($hdr{'Control'} =~ /(?:new|rm)group\s.*(?:hipcrime|hipclone|h1pcr1me)\./)
return reject ("Evil hipcrime control message", "Bad control message");

($hdr{'__BODY__'} =~ /HipCrime.*NewsAgent/) &&
(return reject ("Rogue cancel (HipCrime)", "Rogue cancel"));

(($hdr{'Organization'} =~ /HipCrime/) || ($hdr{'From'} =~ /HipCrime/)) &&
(return reject ("Rogue cancel (HipCrime)", "Rogue cancel"));

This "feature" of CleanFeed is yet another example of the self-appointed Censorship Cabal's fear of HipCrime's NewsAgent.

Other filter methods exist (e.g. line-counting and hashing) and NewsAgent will make attempts to avoid these. If you enable the BUST option for control postings and/or normal articles, HipCrime's NewsAgent (v1.07) will append a random number of random "sentences" to every article posted. These pseudo-English "sentences" are generated from a series of "mAdLibs"-like templates and a few small dictionaries of various parts of speech, names of some common computer objects, and a pantheon of various NANA* characters.

This "noise" will allow your articles to pass through filters unmolested by Cabal constraints.

CyberCafe - Using Public Access Points

CyberCafes, Libraries, Showrooms, and other public InterNet access points are fantastically good places from which to run NewsAgent. The open-access nature of these places renders the dreaded NNTP-Posting-Host header worthless. Tracebacks to the interNet equivalent of a phone booth aren't all that helpful.

The open source nature of HipCrime's NewsAgent (v1.07) makes using it on these public workstation easier than ever. You'll need only a single floppy disk in your pocket when you visit such sites.

This disk will contain the .CLASS files from any compilation of HipCrime's NewsAgent (v1.07). You can execute NewsAgent's Java Classes right from the floppy, like this:

Notice that you've executed NewsAgent *directly* from the floppy disk, thus leaving NO TRACE of it on the public machine.

Not only that, but if you hit Control-Alt-Delete and look at the task list, you'll see that there is nothing named NewsAgent. All that's visible is the WJView task.

Now that NewsAgent is running, setup 5 or 10 (or more) CancelAgents and get them going. Once you're satisfied that all are chunking away smoothly, click back to the main NewsAgent window, and hit the F8 function key.

NewsAgent and all its CancelAgents will enter CYBERCAFE mode. That is, their windows will vanish, and their buttons will be removed from the task bar. But, they will all stay running quietly in the background. Get up from your workstation, head on over to the counter, and pay for the short time you've used. NewsAgent will proceed to suck up all the extra cycles on that machine until it's rebooted or powered off.

In round-the-clock cafes, this has been known to run for days, literally until the Post server gets shut down. And even then, the gang of ControlAgents you started will continue to bang on locked doors.

Plus, many public workstations get their connectivity through a big ISP (e.g. AOL, CompuServe, EarthLink, MindSpring, NetCom, etc etc). That means that you'll have access to that ISP's closed news server, giving you the best of both worlds: useless NNTP-Posting-Host headers and the big server's fast propagation.

All in all, public access sites are a highly recommended way to go.

Anonymity - Using SOCKS to hide your IP address

Not everybody has a cybercafe close at hand, and since HipCrime's NewsAgent (v1.07) is one of the most controversial pieces of software on interNet, it's a good idea to make it difficult to trace. The Usenet Censorship Cabal will make every attempt to locate NewsAgent runners and get them shut down. Why? Because NewsAgent (v1.07) is a threat to the Cabal's power structure. It gives common netizens the same ability to "control" news traffic, just like any other adminstrator. This scares the hell out of the "real" admin crowd.

HINT: if you want to find lots of open SOCKS4 proxies, try Proxy Hunter, which can find/test thousands of servers easily, making it another HipClone favourite.

SOCKS4 proxies come in two flavours: 4 and 4A, the difference being that one accepts only IP addresses (4) and the other accepts domain names (4A). Since these proxies provide no herald message, it is impossible to tell one from the other. In the event that a proxy that you tested appears unresponsive, try giving it an IP address instead of a domain name.

You can use a single SOCKS4 proxy (as described above) to access some NNTP server for posting, but there's always that outside chance that the SOCKS in question has logging turned on. Some do, Some don't. Of course, the cabal has to get access to those logs, but that's another issue. In order to make log sifting even more difficult (if not impossible) HipCrime's NewsAgent (v1.07) can work through a chain of SOCKS4 proxies.

To do this, put a text file name in the SOCKS field for either server (or both). This file should contain the names (or IP addresses) of open SOCKS4 proxies, one per line. HipCrime's NewsAgent (v1.07) will read in that list of SOCKS and chain from one to the next, until at the end of the chain, it connects to the target news server. If even one proxy in that chain has inaccessible or unkept logs, then the source of the postings will never be found. It's a good idea to construct your chain so it loops the world a few times, e.g. from you to Wanadoo.FR to NetCom.CA to OzEmail to VSNL.net.IN to SkyNet.BE to Telus.NET to @Home to Demon.CO.UK to BigPond to Road Runner to the news server. A chain like that is easy to setup and quite probably impossible to back track.

Make the SOCKS chains as long as you can. In the course of traversing the chain, should one proxy fail to respond, HipCrime's NewsAgent (v1.07) will remove that link from the chain then pick up where it left off. Also, that last link in the chain is special, because it might be a proxy chosen specifically to give you an entre' into a "closed" server. This exciting new development is described in the next section ...

Closed Servers - Using SOCKS to get inside

The (ab)Usenet system is becoming "closed"; that is, the "powers that be" don't want you to post articles unless everybody can tell exactly where they came from. In the event they don't like what you posted, they will try get your ISP to close your account. Large numbers of people have lost PAID accounts because some self-inflated bigshot didn't like what they posted. Therefore, many news servers only accept connections from IP addresses within their netblock, i.e. they are "closed" to the interNet as a whole. Prior to SOCKS support, posting through these closed servers was impossible (unless you happened to reside in the proper netblock), but now, with the release of HipCrime's NewsAgent (v1.07), Usenet is your Oyster.

To get inside any closed server, all you need is a SOCKS proxy in their network address block. Might sound hard to arrange, but it's surprisingly easy. All you have to do is look at some existing posts, do a little Proxy Hunter run over the right address range, and you'll be eating Angels-on-Horseback.

Consider this X-Trace header, taken from a real news article:

X-Trace: news.uswest.net 6472946219 (Mon, 16 Jul 2001 23:26:20 CST)

Note that NEWS.USWEST.NET was willing to accept a connection from [], so what you need is an open SOCKS somewhere in that neighborhood. Proxy Hunter scanned the range from [] to [] in only 3 minutes, and came up with these:

dnvrapanas86poolb6.dnvr.uswest.net []
dnvrapanas87poolc80.dnvr.uswest.net []

Using either of these two SOCKS, you can now post through NEWS.USWEST.NET as easily as any open server. Just put NEWS.USWEST.NET into the Post server field, and one of those open proxies in the Post server's SOCKS field (or at the end of your SOCKS chain, see above). NewsAgent (v1.07) will connect to the Post server through the Socks proxy and everything will be hunky-dory. Watch the ControlAgent status line, and you'll see the server's herald message, welcoming you as one of its authorized users. No authentication required. Who.Who.Who.WhoWho.Who let the dogs in?

Where do you want to post today? With HipCrime's NewsAgent (v1.07), everywhere is open, even the oh-so-slow fortress of filter complexity known as SuperNews (as was recently demonstrated in News.Admin.Net-Abuse.Usenet).

HipCrime - NewsAgent Installation and Execution

Installation of the Micro$oft compilation of NewsAgent (v1.07)

Running HipCrime's NewsAgent (v1.07), as compiled by Micro$oft's Visual J++, is a simple one (or possibly two) step process.

To start, download and install the NewsAgent107-MS.exe self-extracting archive (~295 K). You can unpack NewsAgent107-MS.exe to *any* directory that you choose. It all depends on how you like to organize your system.

When you execute HipCrime's NewsAgent (v1.07) for the first time (as described below), you may discover that your Micro$oft Java Virtual Machine (VM) is not up to date. A minimum of version 5.00.3182 is required. If you're running Windows98/NT/2K, then you most likely meet this requirement; but if you're running Windows95, then maybe not. You can get the latest MICRO$OFT VM directly from Micro$oft. You'll only need to do this once (thankfully, since it weighs in at well over 5 M).

Installation of the SuperCede compilation of NewsAgent (v1.07)

Obtaining a copy of HipCrime's NewsAgent (v1.07), as compiled by SuperCede Java, is a slightly longer two-step process, as follows:

First, you *must* download and install the SuperCede Java RunTime System (~1.1 M). This is a self-extracting archive, which will attempt to place ten (10) DLLs in your \Windows\System folder. The location of the Windows System folder varies depending which version of Windows you are running:
Please direct the decompression into the directory that is appropriate for your operating system version, otherwise NewsAgent will not work correctly. You only need to do this once, the first time you bring NewsAgent onto your system. If you're upgrading from a previous version, you can skip ahead to the next step.

Second, download and unpack the NewsAgent107-SC.exe self-extracting archive (~367 K). This archive will also expand into the folder that it was launched from, but you can point it to *any* directory that you choose.

Installation of the GNU GUAVAC compilation of NewsAgent (v1.07)

HipCrime's NewsAgent (v1.07), has also been compiled by GUAVAC (GNU's Java Compiler, running under BeOS). These Java CLASS files have executed successfully under BeOS 5 (Personal Edition) and RedHat Linux 7 (Guinness). Rumour has it that they also run on a Mac, although details are sparse at this time.

First, you *must* download and install a Java Virtual Machine (Runtime Interpreter), which varies depending on your operating system:
Once you have a virtual machine for your operating system, download and install the NewsAgent107-BE.zip archive (~233 K). Expand this ZIP-compressed (.ZIP) archive into the folder of your choice.


Each compilation of HipCrime's NewsAgent (v1.07) provides you with complete Java source code, and two (2) sets of object code (Java's portable bytecodes and Windows' executable native code).
Running the native code executable (only under Windows95/98/NT/2K):

Simply instruct Windows to launch the NewsAgent.EXE file, using the Start button on the task bar, the Windows Explorer, or by creating a Short Cut to wherever you installed it.

Running the portable Java bytecodes (for BeOS, Linux, MacOS, etc):

The Java Class files supplied with both compilations have been run under the virtual machines supplied for both BeOS 5 (Personal Edition) and Linux 7 (Guiness). It's as simple as copying the relevant files (*.CLASS) onto the target system, then passing NewsAgent.CLASS to the local Java Virtual Machine for execution.

On Windows machines running the newer versions (Win98/2K), the Java Class files execute particularly well. Open a DOS shell, go to the directory where you stored the Java Classes, then execute this command to invoke Micro$oft's Java Runtime and feed it the main NewsAgent.CLASS:

  • WJview.exe /p /cp:p "<JAVAPACKAGES>" NewsAgent

But before doing so, you should be familiar with Usenet, NNTP servers, Message Headers, maybe even the ancient yet still pertinent RFC-977, RFC-1036, or the more modern RFC-2980. Still, there's lots of weird details, like the NNTP-Posting-Host header, and whatnot. In other words, RT(f)M !!!

HipCrime's NewsAgent (v1.07) is FREE, which means you can copy it and redistribute it at will, as long as you give credit to the original author. Similarly, the source is provided as reference and can be redistributed freely as well.

However, there are a few things that you're requested NOT to do with it:

Also, HipCrime's NewsAgent (v1.07) comes with no warranty and HipCrime International, unLtd. can't be held responsible for anything it does to your computer.

HipCrime - Phone, Web, and Email Contact Points

Even though the real life identity of HipCrime has never been established, the person(s) responsible are easily contacted, and welcome your communication. All messages will receive an appropriate response.

For questions, comments, technical support, or whatever, please contact:

HipCrime International, unLtd.

Fax/VoiceMail: 31-20-884-0905 (Holland)
Fax/VoiceMail: 1-503-217-9241 (United States)
Fax/VoiceMail: 1-888-392-4832 ext 291-302-9774 (Toll Free)



Want Privacy? Then please use this Pretty Good Privacy (PGP) public keys:

Version: PGPfreeware 6.5.3 for non-commercial use 


This is the information file for HipCrime's NewsAgent (v1.07),
the swiss army knife of Usenet abuse tools,
which was designed, implemented, and is solely owned HipCrime International, unLtd.

all rites reversed 1998-2001 use by permission only.