			< >S< >E< >A< >R< >C< >H< >E< >R< >
				    VERSION 8.0

This nifty tool is designed for a better world.... maybe.

After you hacked a host and become root, you will install some backdoors,
modify logs, install a sniffer (if possible) and check the admins' $HOME.
Yepp, but it's hard work to check all $HOMEs - maybe Gigs of infos - and
look for interessting information... and if NFS (or similar stuff which
check access permission via UID) is used... hehe, let it be.
So I decided to write this tool to search for the most interessting files,
scan the users' e-mail for predefined words, scan the Syslog-Logfiles for
given patterns and/or do the SuperSearch to scan all files in the users'
home direc. for given patterns.
Uuahh, I'm too lazy to write a full documentation... here is the stuff
ripped out of the source code:


Usage:	searcher [-a] [-r] [-n] [-f] [-m <word-list>] [-i] [-v]
^^^^^^		 [-g <group name>] [-s <word-list>] [-l <word-list>]
		-a: shows all files in the home-directories. (not recommended)
		-r: lists infos about all files _beginning_ w/ ".rhosts"
		-n: lists infos about all files _beginning_ w/ ".netrc"
		-f: lists infos about all files _beginning_ w/ ".forward"
		-m: scans the users' mbox-file/M|mail-dir./Spool-file for words
		    defined in <word-list>
		-i: if given, searcher will ignore locked users (see LOCK_IND)
		-v: verbose; print a bit more (useless) infos
		    If this option is given twice and the -m option is also
		    given, then the lines, which match the pattern for mail
		    scanning, will be printed to stdout.
		    Yeah, and if -v is given 3+ times ALL lines will be
		    printed.
		    All non-printable (i.e. PGP Mail) characters will be shown
		    as decimal number included in brackets "[]".
		-g: search only in the $HOMEs of users in group <group>
		-s: super search: serach the words specified in <word-list>
		                  in ALL files located in $HOME
		-l: log-search:	scan the log files given in SYSLOG
			        for words defined in <word-list>
				ALL log files will be examined, not only the
				log file for "auth.*".
				BUT don't forget the "loghost", e-mail,
				"/dev/console", etc.
				This prog. can't hack the "loghost" for you,
				can't blow up the monitor and I'm too lazy to
				scan the e-mail (now), ;) it's your turn.
				Hm, but it's a good idea. I will try to solve
				this "problem"... later.

Notes:		! ALL comparisions are case _in_sensitive. !
^^^^^^		! ALL words in the wordlists must end with a <CR> !
		! Searcher expect one word per line !
		! The word should not be longer than 80 chars !

Disadvantages:	Very CPU/Time/HD consuming.
^^^^^^^^^^^^^^	If NFS is used, then the program produce heavy net-load.

Atuhor:	TICK (t_i_c_k@hotmail.com)
^^^^^^^
Last Update: 1997/06/25
^^^^^^^^^^^^



EOF