{
  "title": "AOL-era tools and their predecessors",
  "status": "Published metadata and original synthesis; no full original source texts hosted",
  "checked_at": "2026-10-16",
  "counts": {
    "entries": 28,
    "aol_ecosystem": 11,
    "earlier_and_contemporary": 17
  },
  "coverage": "Selected historical catalog, not exhaustive. Includes official and benign utilities alongside clearly classified abusive tools.",
  "limitations": [
    "Dates distinguish releases, announcements, copyright evidence and approximate eras.",
    "Original ToneLoc manual not retrieved; attribution/version caveats retained.",
    "Archive-generated metadata can be unreliable; author papers and dated announcements preferred.",
    "AIM-Files403 respected; no bypass. No binaries acquired, inspected or executed.",
    "Links are contextual sources, not software safety endorsements; linked pages may offer historical downloads."
  ],
  "records": [
    {
      "name": "AOHell",
      "date": "January 1995",
      "date_precision": "Creator dates phishing functionality, not every release",
      "attribution": "Koceilah Rekouche (Da Chronic)",
      "platform": "Windows / AOL",
      "category": "Credential theft and disruption",
      "description": "Automated impersonation and password/card theft distinguish this suite from harmless chat customization. The creator retrospectively dates its phishing mechanism to January 1995.",
      "source_url": "https://arxiv.org/abs/1106.4692",
      "uncertainty": "Priority claims remain the creator’s retrospective, not an independently established first.",
      "id": "historical-tool-390af586a0926bcc",
      "collection": "AOL ecosystem",
      "checked_at": "2026-10-16",
      "provenance": "Parent research packet; original concise synthesis; no binaries acquired or executed",
      "availability": "Documentation cited; executable safety, compatibility and availability not assessed",
      "rights": "No redistribution clearance established for this catalog. No binaries, original code or source media hosted. See contextual source and version-specific terms."
    },
    {
      "name": "Fate X / Fate Zero",
      "date": "Late 1990s",
      "date_precision": "Era only; Fate-X2.5/3.0 and final Fate Zero branch",
      "attribution": "MaGuS and FunGii",
      "platform": "Windows / AOL",
      "category": "Mixed chat add-on",
      "description": "Extra chat functions and features discouraged by AOL coexisted in this family. Fate Zero’s external text-art collection illustrates the overlap between visual creativity, programming competition and disruptive behavior.",
      "source_url": "https://patorjk.com/blog/2012/05/03/cracking-magus-fate-zero-encryption/",
      "uncertainty": "Participant retrospective; exact releases and complete feature inventory unverified.",
      "id": "historical-tool-643b5718fa03f470",
      "collection": "AOL ecosystem",
      "checked_at": "2026-10-16",
      "provenance": "Parent research packet; original concise synthesis; no binaries acquired or executed",
      "availability": "Documentation cited; executable safety, compatibility and availability not assessed",
      "rights": "No redistribution clearance established for this catalog. No binaries, original code or source media hosted. See contextual source and version-specific terms."
    },
    {
      "name": "API Spy",
      "date": "Late 1990s",
      "date_precision": "Creator’s era statement; version unknown",
      "attribution": "Patrick Gillespie (PAT or JK)",
      "platform": "Windows / Visual Basic",
      "category": "Developer utility",
      "description": "Windows API inspection and code generation helped add-on programmers interact with client interfaces. Developer tooling does not establish that every resulting extension was malicious.",
      "source_url": "https://patorjk.com/blog/category/aol/",
      "uncertainty": "Original release/version not confirmed.",
      "id": "historical-tool-014ddf098af7806f",
      "collection": "AOL ecosystem",
      "checked_at": "2026-10-16",
      "provenance": "Parent research packet; original concise synthesis; no binaries acquired or executed",
      "availability": "Documentation cited; executable safety, compatibility and availability not assessed",
      "rights": "No redistribution clearance established for this catalog. No binaries, original code or source media hosted. See contextual source and version-specific terms."
    },
    {
      "name": "Find That Bas",
      "date": "AOL proggie era",
      "date_precision": "Era only; interview published 2025",
      "attribution": "Patrick Gillespie (PAT or JK)",
      "platform": "Visual Basic",
      "category": "Code comparison",
      "description": "Compared Visual Basic .bas modules for reused code. It documents concern about authorship and copying in an ecosystem that circulated shared programming modules.",
      "source_url": "https://music.amazon.com/podcasts/d7e2c310-52fb-46fd-a444-a97952204f77/episodes/5fa9a521-1a48-4028-92b3-70ea034a8b48/aol-underground-pat-or-jk---api-spy-find-that-bas-fate-zero-encryption",
      "uncertainty": "Interview synopsis supports purpose; original release year unknown.",
      "id": "historical-tool-1bd8f6773950d59e",
      "collection": "AOL ecosystem",
      "checked_at": "2026-10-16",
      "provenance": "Parent research packet; original concise synthesis; no binaries acquired or executed",
      "availability": "Documentation cited; executable safety, compatibility and availability not assessed",
      "rights": "No redistribution clearance established for this catalog. No binaries, original code or source media hosted. See contextual source and version-specific terms."
    },
    {
      "name": "Jaguar32.bas",
      "date": "Late 1990s",
      "date_precision": "Era only;32-bit module",
      "attribution": "Ben Stone, credited by Patrick Gillespie",
      "platform": "Windows / Visual Basic",
      "category": "Reusable code",
      "description": "A shared module used in AOL add-on development. Such reusable support code helped programmers learn and build client utilities before today’s package-manager conventions.",
      "source_url": "https://patorjk.com/blog/2022/04/19/what-the-github-story-on-aol-hacking-culture-left-out/",
      "uncertainty": "Participant reports correspondence with author; original release and API inventory unverified.",
      "id": "historical-tool-15de5d8c7c8c859d",
      "collection": "AOL ecosystem",
      "checked_at": "2026-10-16",
      "provenance": "Parent research packet; original concise synthesis; no binaries acquired or executed",
      "availability": "Documentation cited; executable safety, compatibility and availability not assessed",
      "rights": "No redistribution clearance established for this catalog. No binaries, original code or source media hosted. See contextual source and version-specific terms."
    },
    {
      "name": "The Vader Fader",
      "date": "1999 or earlier",
      "date_precision": "Reported archived-site existence, not proven first release",
      "attribution": "Attributed to Mark Zuckerberg on preserved personal site",
      "platform": "Windows / AOL4.0-era",
      "category": "Chat customization",
      "description": "A Visual Basic text-color add-on in the fader tradition. Preserved screenshots and later inspection place it in creative message decoration rather than credential theft.",
      "source_url": "https://patorjk.com/blog/2013/04/09/was-mark-zuckerberg-an-aol-add-on-developer/",
      "uncertainty": "Researcher initially framed identity cautiously; retain attributed identity and date caveat.",
      "id": "historical-tool-4455370cf9eecaac",
      "collection": "AOL ecosystem",
      "checked_at": "2026-10-16",
      "provenance": "Parent research packet; original concise synthesis; no binaries acquired or executed",
      "availability": "Documentation cited; executable safety, compatibility and availability not assessed",
      "rights": "No redistribution clearance established for this catalog. No binaries, original code or source media hosted. See contextual source and version-specific terms."
    },
    {
      "name": "AOL4Free",
      "date": "1995",
      "date_precision": "Archive-assigned year; v4",
      "attribution": "Happy Hardcore, per archive",
      "platform": "Classic Mac OS / AOL2.6 /68k",
      "category": "Billing circumvention",
      "description": "A Macintosh client patcher cataloged as defeating client-side billing assumptions. This is a distinct Mac branch of AOL abuse history, not proof of present-day effectiveness.",
      "source_url": "https://github.com/ssstonebraker/aolunderground-proggies",
      "uncertainty": "Archive-level attribution/date; original paperwork not verified. Similar filenames need not identify the same tool.",
      "id": "historical-tool-ed5b6778ab793e92",
      "collection": "AOL ecosystem",
      "checked_at": "2026-10-16",
      "provenance": "Parent research packet; original concise synthesis; no binaries acquired or executed",
      "availability": "Documentation cited; executable safety, compatibility and availability not assessed",
      "rights": "No redistribution clearance established for this catalog. No binaries, original code or source media hosted. See contextual source and version-specific terms."
    },
    {
      "name": "FDO IDE",
      "date": "17 November 2003",
      "date_precision": "Dated beta announcement",
      "attribution": "Slushie",
      "platform": "AOL/FDO development",
      "category": "Developer utility",
      "description": "An editing environment intended to make AOL form/interface development easier than raw text editing. The preserved announcement describes a working beta.",
      "source_url": "https://wiki.nina.chat/wiki/Portal:AOL-Files/News",
      "uncertainty": "Announcement date, not necessarily first development; original beta link marked unavailable.",
      "id": "historical-tool-cbf190d7db66d06c",
      "collection": "AOL ecosystem",
      "checked_at": "2026-10-16",
      "provenance": "Parent research packet; original concise synthesis; no binaries acquired or executed",
      "availability": "Documentation cited; executable safety, compatibility and availability not assessed",
      "rights": "No redistribution clearance established for this catalog. No binaries, original code or source media hosted. See contextual source and version-specific terms."
    },
    {
      "name": "FDO (de-)compiler",
      "date": "30 January 2004",
      "date_precision": "Dated announcement; version unknown",
      "attribution": "Slushie",
      "platform": "AOL/FDO development",
      "category": "Compiler/decompiler",
      "description": "Standalone interface-language compilation and inspection tooling announced before completion of the larger IDE. Its underground context does not make compilation inherently malicious.",
      "source_url": "https://wiki.nina.chat/wiki/Portal:AOL-Files/News",
      "uncertainty": "Hacker Smacker is the news-post title, not a verified product name.",
      "id": "historical-tool-4595c91e13e8ce5c",
      "collection": "AOL ecosystem",
      "checked_at": "2026-10-16",
      "provenance": "Parent research packet; original concise synthesis; no binaries acquired or executed",
      "availability": "Documentation cited; executable safety, compatibility and availability not assessed",
      "rights": "No redistribution clearance established for this catalog. No binaries, original code or source media hosted. See contextual source and version-specific terms."
    },
    {
      "name": "ndec",
      "date": "5 November 2003",
      "date_precision": "Dated announcement;2.03f",
      "attribution": "Slushie and Ras",
      "platform": "Windows AOL / Assembler and FDO",
      "category": "Credential exposure",
      "description": "A native extension described as a screen-name manager with stored-password recovery. Credential access makes it materially different from faders or interface editors; extraction procedures are not reproduced.",
      "source_url": "https://wiki.nina.chat/wiki/Portal:AOL-Files/News",
      "uncertainty": "Archived author announcement; no binary inspection.",
      "id": "historical-tool-f5a07a4b7d934c88",
      "collection": "AOL ecosystem",
      "checked_at": "2026-10-16",
      "provenance": "Parent research packet; original concise synthesis; no binaries acquired or executed",
      "availability": "Documentation cited; executable safety, compatibility and availability not assessed",
      "rights": "No redistribution clearance established for this catalog. No binaries, original code or source media hosted. See contextual source and version-specific terms."
    },
    {
      "name": "RAINMAN",
      "date": "Documented by 2001 archive",
      "date_precision": "Documentation era, not first release",
      "attribution": "America Online provider tooling; individual author unknown",
      "platform": "AOL information providers",
      "category": "Authorized publishing",
      "description": "Remote Automated Information Manager let information providers maintain service content through scripts. It supplies context for AOL development as official publishing infrastructure, not an underground intrusion program.",
      "source_url": "https://wiki.nina.chat/wiki/Portals:AOL-Files/Articles/Introduction_to_RAINMAN",
      "uncertainty": "Preserved documentation establishes purpose; release date unknown.",
      "id": "historical-tool-9e9ac7ff085eb494",
      "collection": "AOL ecosystem",
      "checked_at": "2026-10-16",
      "provenance": "Parent research packet; original concise synthesis; no binaries acquired or executed",
      "availability": "Documentation cited; executable safety, compatibility and availability not assessed",
      "rights": "No redistribution clearance established for this catalog. No binaries, original code or source media hosted. See contextual source and version-specific terms."
    },
    {
      "name": "Blue box",
      "date": "Circa1972",
      "date_precision": "Museum object dating",
      "attribution": "Steve Wozniak and Steve Jobs for this example",
      "platform": "Telephone hardware",
      "category": "Phreaking / toll fraud",
      "description": "Tone-generating hardware exploited telephone networks carrying control signals in the call audio path. The museum example anchors pre-PC history; many makers contributed to the broader category.",
      "source_url": "https://computerhistory.org/blog/steve-jobs/",
      "uncertainty": "Example-specific attribution, not inventors of the category. No frequencies or construction instructions.",
      "id": "historical-tool-0b3a78cbd99f4a7e",
      "collection": "Earlier and contemporary tools",
      "checked_at": "2026-10-16",
      "provenance": "Parent research packet; original concise synthesis; no binaries acquired or executed",
      "availability": "Documentation cited; executable safety, compatibility and availability not assessed",
      "rights": "No redistribution clearance established for this catalog. No binaries, original code or source media hosted. See contextual source and version-specific terms."
    },
    {
      "name": "ping",
      "date": "December 1983",
      "date_precision": "Creator’s month/year recollection",
      "attribution": "Mike Muuss",
      "platform": "BSD/Unix initially",
      "category": "Network diagnostics",
      "description": "Echo requests and responses made network reachability observable. Ordinary troubleshooting tools also became useful in security investigation without becoming inherently intrusion tools.",
      "source_url": "https://ftp.arl.army.mil/~mike/ping.html",
      "uncertainty": "Original program distinct from later implementations.",
      "id": "historical-tool-758d61f26a444483",
      "collection": "Earlier and contemporary tools",
      "checked_at": "2026-10-16",
      "provenance": "Parent research packet; original concise synthesis; no binaries acquired or executed",
      "availability": "Documentation cited; executable safety, compatibility and availability not assessed",
      "rights": "No redistribution clearance established for this catalog. No binaries, original code or source media hosted. See contextual source and version-specific terms."
    },
    {
      "name": "traceroute",
      "date": "1988",
      "date_precision": "Institutional timeline year",
      "attribution": "Van Jacobson",
      "platform": "Unix",
      "category": "Network diagnostics",
      "description": "Shows responding hops along a network path and their observed delays. It made routing faults more visible before consumer AOL’s peak.",
      "source_url": "https://cs.lbl.gov/about/history/",
      "uncertainty": "Later implementations differ; no exact release day established.",
      "id": "historical-tool-261063ce089e84d5",
      "collection": "Earlier and contemporary tools",
      "checked_at": "2026-10-16",
      "provenance": "Parent research packet; original concise synthesis; no binaries acquired or executed; depth expanded from directly reviewed institutional/project documentation on 2026-10-16",
      "availability": "The Berkeley Lab timeline and FreeBSD’s maintained traceroute manual were readable on 16 October 2026. The manual documents a later implementation and is used here for the conceptual mechanism and limitations, not as evidence of every feature in Jacobson’s first release. No original 1988 release package was acquired or tested.",
      "rights": "No redistribution clearance established for this catalog. No binaries, original code or source media hosted. See contextual source and version-specific terms.",
      "historical_context": "Berkeley Lab’s institutional timeline places Van Jacobson’s traceroute work in 1988. Its contribution was to make intermediate network behavior inspectable: an operator could investigate where a route appeared to stop responding instead of treating connectivity as a single yes/no result. The timeline establishes a year, not an exact release day.",
      "conceptual_mechanism": "The traditional implementation sends probes with progressively larger IP time-to-live limits. When a router exhausts that limit, an ICMP time-exceeded response can identify the responding hop. Timing those responses yields round-trip observations from the probing machine; it does not directly measure the delay of each individual link. A missing response can mean filtering or a silent router rather than a broken path. Routes and return paths can differ, so the output is a measurement from one vantage point, not a permanent map of the Internet.",
      "source_availability": "The Berkeley Lab timeline and FreeBSD’s maintained traceroute manual were readable on 16 October 2026. The manual documents a later implementation and is used here for the conceptual mechanism and limitations, not as evidence of every feature in Jacobson’s first release. No original 1988 release package was acquired or tested.",
      "depth_sources": [
        {
          "title": "Berkeley Lab institutional timeline: 1988 traceroute entry",
          "url": "https://cs.lbl.gov/about/history/",
          "supports": "Creator attribution and institutional timeline year"
        },
        {
          "title": "FreeBSD traceroute manual",
          "url": "https://man.freebsd.org/cgi/man.cgi?query=traceroute&sektion=8&format=html",
          "supports": "Later documented probe mechanism, response timing and interpretation limits"
        }
      ]
    },
    {
      "name": "tcpdump",
      "date": "Late 1980s",
      "date_precision": "Sources differ between1987 and1988",
      "attribution": "Lawrence Berkeley Laboratory researchers; original README credits Van Jacobson",
      "platform": "Unix and later systems",
      "category": "Packet analysis",
      "description": "Command-line network observation complements client-level inspection. Packet capture is useful for diagnosis but may expose private communications, so its historical role should not erase authorization and privacy boundaries.",
      "source_url": "https://github.com/the-tcpdump-group/tcpdump/blob/master/README.md?plain=1",
      "uncertainty": "Use qualified era; no software executed.",
      "id": "historical-tool-3096fd17ccf8ee00",
      "collection": "Earlier and contemporary tools",
      "checked_at": "2026-10-16",
      "provenance": "Parent research packet; original concise synthesis; no binaries acquired or executed",
      "availability": "Documentation cited; executable safety, compatibility and availability not assessed",
      "rights": "No redistribution clearance established for this catalog. No binaries, original code or source media hosted. See contextual source and version-specific terms."
    },
    {
      "name": "COPS",
      "date": "1990",
      "date_precision": "Institutional year",
      "attribution": "Dan Farmer under Eugene Spafford’s direction",
      "platform": "Unix",
      "category": "Defensive auditing",
      "description": "Computer Oracle and Password System automated checks for common configuration weaknesses. It made repetitive administrative security review more reproducible.",
      "source_url": "https://spaf.cerias.purdue.edu/firsts.html",
      "uncertainty": "Do not repeat the source’s broad first-scanner priority claim without qualification.",
      "id": "historical-tool-5cffdd8d7b240ad4",
      "collection": "Earlier and contemporary tools",
      "checked_at": "2026-10-16",
      "provenance": "Parent research packet; original concise synthesis; no binaries acquired or executed",
      "availability": "Documentation cited; executable safety, compatibility and availability not assessed",
      "rights": "No redistribution clearance established for this catalog. No binaries, original code or source media hosted. See contextual source and version-specific terms."
    },
    {
      "name": "Crack",
      "date": "1991",
      "date_precision": "Year; retrospective month disagreement",
      "attribution": "Alec Muffett",
      "platform": "Unix",
      "category": "Password auditing / dual-use",
      "description": "Password-strength checking grew from earlier Unix auditing code. Candidate generation and distributed work made weak passwords a testable administrative concern; modern use requires authorization.",
      "source_url": "https://alecmuffett.com/article/733",
      "uncertainty": "Creator’s retrospectives disagree on June 15 versus July 15; retain year only.",
      "id": "historical-tool-13d9f1e42ac56553",
      "collection": "Earlier and contemporary tools",
      "checked_at": "2026-10-16",
      "provenance": "Parent research packet; original concise synthesis; no binaries acquired or executed",
      "availability": "Documentation cited; executable safety, compatibility and availability not assessed",
      "rights": "No redistribution clearance established for this catalog. No binaries, original code or source media hosted. See contextual source and version-specific terms."
    },
    {
      "name": "TCP Wrapper",
      "date": "Documented September 1992",
      "date_precision": "Conference date, not definitive release",
      "attribution": "Wietse Venema",
      "platform": "Unix inetd services",
      "category": "Access control / logging",
      "description": "A network-service wrapper recorded connections and supported access control. An administrator’s need to observe hostile activity produced reusable defensive tooling.",
      "source_url": "https://ftp.nluug.nl/security/tcpwrappers/tcp_wrapper.pdf",
      "uncertainty": "Exact first public release not established.",
      "id": "historical-tool-bedcef4f12fccb76",
      "collection": "Earlier and contemporary tools",
      "checked_at": "2026-10-16",
      "provenance": "Parent research packet; original concise synthesis; no binaries acquired or executed",
      "availability": "Documentation cited; executable safety, compatibility and availability not assessed",
      "rights": "No redistribution clearance established for this catalog. No binaries, original code or source media hosted. See contextual source and version-specific terms."
    },
    {
      "name": "Tripwire",
      "date": "November 1992",
      "date_precision": "Month/year in authors’ paper",
      "attribution": "Gene H. Kim and Eugene H. Spafford",
      "platform": "Unix",
      "category": "File integrity monitoring",
      "description": "Compared a filesystem with recorded expectations to identify added, removed and changed files. It helped administrators notice unauthorized changes after compromise.",
      "source_url": "https://www.usenix.org/conference/usenix-1994-unix-applications-development-symposium/experiences-tripwire-evaluation-and",
      "uncertainty": "Original academic implementation differs from later commercial and open-source products.",
      "id": "historical-tool-9f53db24c9f1311f",
      "collection": "Earlier and contemporary tools",
      "checked_at": "2026-10-16",
      "provenance": "Parent research packet; original concise synthesis; no binaries acquired or executed",
      "availability": "Documentation cited; executable safety, compatibility and availability not assessed",
      "rights": "No redistribution clearance established for this catalog. No binaries, original code or source media hosted. See contextual source and version-specific terms."
    },
    {
      "name": "SATAN",
      "date": "1995",
      "date_precision": "Release year; March documentation demonstration",
      "attribution": "Dan Farmer and Wietse Venema",
      "platform": "Unix",
      "category": "Vulnerability assessment / dual-use",
      "description": "Security Administrator Tool for Analyzing Networks gathered system information to highlight weaknesses. Its publication sharpened debate over how capable public audit tools affect administrators and intruders.",
      "source_url": "https://ftp.zx.net.nz/pub/archive/ftp.funet.fi/pub/unix/security/mirrors/ftp.porcupine.org/",
      "uncertainty": "Author collection preserved by a mirror, not official hosting. March demo not full release date.",
      "id": "historical-tool-eed767c9e833fc62",
      "collection": "Earlier and contemporary tools",
      "checked_at": "2026-10-16",
      "provenance": "Parent research packet; original concise synthesis; no binaries acquired or executed",
      "availability": "Documentation cited; executable safety, compatibility and availability not assessed",
      "rights": "No redistribution clearance established for this catalog. No binaries, original code or source media hosted. See contextual source and version-specific terms."
    },
    {
      "name": "Netcat",
      "date": "1995–1996",
      "date_precision": "Range; version-dependent dates",
      "attribution": "Hobbit",
      "platform": "Unix originally",
      "category": "Networking utility / dual-use",
      "description": "A general-purpose reader/writer for network connections became a composable testing tool. Modern Ncat is a separate implementation inspired by it, not an interchangeable historical release name.",
      "source_url": "https://nmap.org/ncat/guide/",
      "uncertainty": "Ncat guide dates predecessor to1996; initial1995 dates require original announcement verification.",
      "id": "historical-tool-492271ca4314019c",
      "collection": "Earlier and contemporary tools",
      "checked_at": "2026-10-16",
      "provenance": "Parent research packet; original concise synthesis; no binaries acquired or executed",
      "availability": "Documentation cited; executable safety, compatibility and availability not assessed",
      "rights": "No redistribution clearance established for this catalog. No binaries, original code or source media hosted. See contextual source and version-specific terms."
    },
    {
      "name": "John the Ripper",
      "date": "1996",
      "date_precision": "Copyright year, not exact release",
      "attribution": "Solar Designer / Alexander Peslyak",
      "platform": "Unix and later platforms",
      "category": "Password auditing / dual-use",
      "description": "Password testing and recovery checks candidates against stored hashes. This differs technically and ethically from impersonating users to obtain their secrets; authorized auditing is its relevant contemporary context.",
      "source_url": "https://openwall.com/john/doc/LICENSE.shtml",
      "uncertainty": "Core GPLv2-or-later with exceptions; jumbo components have additional terms.",
      "id": "historical-tool-5e7a35f26ca851d3",
      "collection": "Earlier and contemporary tools",
      "checked_at": "2026-10-16",
      "provenance": "Parent research packet; original concise synthesis; no binaries acquired or executed",
      "availability": "Documentation cited; executable safety, compatibility and availability not assessed",
      "rights": "No redistribution clearance established for this catalog. No binaries, original code or source media hosted. See contextual source and version-specific terms."
    },
    {
      "name": "Nmap",
      "date": "1 September 1997",
      "date_precision": "Official day-level history",
      "attribution": "Gordon Lyon (Fyodor)",
      "platform": "Initially Linux",
      "category": "Network discovery / dual-use",
      "description": "A Linux port scanner published with a Phrack article grew into broader network assessment. It bridges the dial-up era and modern security practice, outside AOL client-specific utilities.",
      "source_url": "https://nmap.org/book/history-future.html",
      "uncertainty": "Do not project modern features onto the original release. Version-specific redistribution terms require checking.",
      "id": "historical-tool-8ecf2262720c1a28",
      "collection": "Earlier and contemporary tools",
      "checked_at": "2026-10-16",
      "provenance": "Parent research packet; original concise synthesis; no binaries acquired or executed; depth expanded from directly reviewed institutional/project documentation on 2026-10-16",
      "availability": "Nmap’s official history and scanning-basics chapter were readable on 16 October 2026. The history links its original Phrack article and old-release archives. Those links provide an archival trail, but this pass did not retrieve release packages or inspect or execute source code. The current manual explains the conceptual model; it is not evidence that all current scan states or features existed in 1997.",
      "rights": "No redistribution clearance established for this catalog. No binaries, original code or source media hosted. See contextual source and version-specific terms.",
      "historical_context": "The project’s history dates the first release to 1 September 1997 in Phrack 51, article 11. It describes a Linux-only port scanner, followed by version 1.25 four days later. OS detection arrived with version 2.00 in December 1998; it should not be projected onto the original release. This publication history connects a magazine-distributed program with a continuing software project, rather than treating today’s feature set as a single 1997 invention.",
      "conceptual_mechanism": "Port scanning interprets responses, refusals and silence to classify how a network service appears from the observer’s location. Nmap’s documentation distinguishes open, closed and filtered states and explicitly treats them as observations, not intrinsic properties of a port. Filtering can prevent a firm conclusion, and another vantage point may see something different. An open port alone does not establish a vulnerability or prove compromise; the historical change was more systematic service discovery, not automatic proof of intrusion.",
      "source_availability": "Nmap’s official history and scanning-basics chapter were readable on 16 October 2026. The history links its original Phrack article and old-release archives. Those links provide an archival trail, but this pass did not retrieve release packages or inspect or execute source code. The current manual explains the conceptual model; it is not evidence that all current scan states or features existed in 1997.",
      "depth_sources": [
        {
          "title": "Nmap project history",
          "url": "https://nmap.org/book/history-future.html",
          "supports": "First release, Phrack publication and later feature milestones"
        },
        {
          "title": "Nmap port-scanning basics",
          "url": "https://nmap.org/book/man-port-scanning-basics.html",
          "supports": "Meaning and vantage-point dependence of reported port states"
        }
      ]
    },
    {
      "name": "Ethereal",
      "date": "14 July 1998",
      "date_precision": "Dated announcement reproduced by creator;0.2.0",
      "attribution": "Gerald Combs and subsequent contributors",
      "platform": "Initially Linux and Solaris",
      "category": "Graphical protocol analysis",
      "description": "Interactive traffic browsing complemented textual packet dumps. Contributors expanded protocols and platforms. The1998 name was Ethereal; Wireshark followed in 2006.",
      "source_url": "https://www.wireshark.org/blog/2023-07-14-wireshark-is-25.html",
      "uncertainty": "Do not call the 1998 release Wireshark0.2.0. GPL/component notices require review for redistribution.",
      "id": "historical-tool-fb9a6f9ae8459567",
      "collection": "Earlier and contemporary tools",
      "checked_at": "2026-10-16",
      "provenance": "Parent research packet; original concise synthesis; no binaries acquired or executed",
      "availability": "Documentation cited; executable safety, compatibility and availability not assessed",
      "rights": "No redistribution clearance established for this catalog. No binaries, original code or source media hosted. See contextual source and version-specific terms."
    },
    {
      "name": "ToneLoc",
      "date": "Early–mid1990s",
      "date_precision": "Approximate era; manual not retrieved",
      "attribution": "Minor Threat; Mucho Maas attribution remains provisional here",
      "platform": "MS-DOS / modem",
      "category": "Dial-up discovery / wardialing",
      "description": "Automated telephone surveys looked for modem carriers and other responses. Jason Scott’s interview archive connects a co-author to BBS culture; such surveys could impose real costs and legal consequences.",
      "source_url": "https://archive.org/details/20040130-bbs-mthreat",
      "uncertainty": "Interview metadata supports Minor Threat and purpose;1.10/date/Mucho Maas need original manual confirmation.",
      "id": "historical-tool-f54a2d71c8033707",
      "collection": "Earlier and contemporary tools",
      "checked_at": "2026-10-16",
      "provenance": "Parent research packet; original concise synthesis; no binaries acquired or executed",
      "availability": "Documentation cited; executable safety, compatibility and availability not assessed",
      "rights": "No redistribution clearance established for this catalog. No binaries, original code or source media hosted. See contextual source and version-specific terms."
    },
    {
      "name": "THC-SCAN",
      "date": "By January 1999",
      "date_precision": "Contemporaneous author discussion;2.0",
      "attribution": "van Hauser / The Hacker’s Choice",
      "platform": "MS-DOS and compatible systems",
      "category": "Dial-up security surveying / dual-use",
      "description": "An author’s comparison with PhoneSweep documents the overlap between underground telephone-scanning tools and corporate security audits. This entry describes that historical debate, not scanning instructions.",
      "source_url": "https://seclists.org/bugtraq/1999/Jan/26",
      "uncertainty": "Exact Christmas1998 release not asserted; source is an author post in a public-list archive.",
      "id": "historical-tool-ac8979a5fafae2f3",
      "collection": "Earlier and contemporary tools",
      "checked_at": "2026-10-16",
      "provenance": "Parent research packet; original concise synthesis; no binaries acquired or executed",
      "availability": "Documentation cited; executable safety, compatibility and availability not assessed",
      "rights": "No redistribution clearance established for this catalog. No binaries, original code or source media hosted. See contextual source and version-specific terms."
    },
    {
      "name": "PGP",
      "date": "1991",
      "date_precision": "Origin year in creator-coauthored RFC;1.0",
      "attribution": "Philip Zimmermann",
      "platform": "Personal computers; version-dependent",
      "category": "Privacy / cryptography",
      "description": "Combined encryption and signatures for messages and files. It belongs to the hacker/BBS privacy tradition as protective software rather than an intrusion or theft utility.",
      "source_url": "https://www.rfc-editor.org/info/rfc1991/",
      "uncertainty": "RFC describes2.x while recording1.0 origin; obsolete releases are not current protection recommendations.",
      "id": "historical-tool-6cc6036cfafd30f5",
      "collection": "Earlier and contemporary tools",
      "checked_at": "2026-10-16",
      "provenance": "Parent research packet; original concise synthesis; no binaries acquired or executed",
      "availability": "Documentation cited; executable safety, compatibility and availability not assessed",
      "rights": "No redistribution clearance established for this catalog. No binaries, original code or source media hosted. See contextual source and version-specific terms."
    },
    {
      "name": "SSH",
      "date": "12 July 1995",
      "date_precision": "Creator’s dated-announcement recollection;1.0.0",
      "attribution": "Tatu Ylonen",
      "platform": "Initially Unix",
      "category": "Secure remote access",
      "description": "Encrypted remote login replaced vulnerable plaintext workflows. It provides a defensive counterpart to packet sniffing and password exposure in the same1990s network environment.",
      "source_url": "https://www.ssh.com/academy/ssh/port?hs_amp=true",
      "uncertainty": "Original SSH differs from later OpenSSH; historical version is not a current security recommendation.",
      "id": "historical-tool-01c4d3c21642b217",
      "collection": "Earlier and contemporary tools",
      "checked_at": "2026-10-16",
      "provenance": "Parent research packet; original concise synthesis; no binaries acquired or executed",
      "availability": "Documentation cited; executable safety, compatibility and availability not assessed",
      "rights": "No redistribution clearance established for this catalog. No binaries, original code or source media hosted. See contextual source and version-specific terms."
    }
  ]
}