The year is 1995. The ARPANET has decommissioned, the NSFNET has given way to commercial internet exchanges, and the World Wide Web is exploding across the globe. You are an underground hacker in the golden age of cyberspace.
You saved cash from phone phreaking, grey-market hardware flips, and dial-up consulting to purchase your very first colocated server: a dedicated SunOS 4.1.4 SPARCstation bolted into a noisy rack facility at Netcom in San Francisco, connected directly into a 10 Mbps unmetered optical pipe to the MAE-East backbone.
From your blinking root prompt, the entire wild frontier of the early internet awaits. Discover unknown networks, war dial corporate PBXes, infiltrate academic mainframes, harvest zero-day vulnerabilities from underground FTP vaults, plant persistent rootkits, and establish your dominance over autonomous rival hackers.
👁 1. Reconnaissance & Discovery THE WIRE
The internet does not have search engines or hand-holding. You explore by querying nslookup, probing finger daemons for administrative plans, tracing router hops with traceroute, and reading leaks on Usenet newsgroups (alt.2600, comp.security.unix).
War dial entire telephone prefixes (wardial 415-555-xxxx) to discover hidden acoustic carrier tones, secret corporate PBXes, and rogue dial-in modems.
🛠 2. Tools & Underground Archives ARSENAL
Connect to public mirrors and underground repositories (ftp bbs.mindvox.com, underground.phrack.org) to download source tarballs, dictionary wordlists, and security philes.
Unpack with tar -xzf, compile with gcc, and build a specialized toolkit: port scanners (nmap), password crackers (crack), and Ping of Death payloads (pod).
🔓 3. Gaining Root & Infiltration EXPLOIT
Target historical 1995 vulnerabilities: Sendmail 8.6.12 DEBUG wizard bypasses, NCSA Mosaic buffer flaws, SunOS rlogin trust tables, default telecom credentials, and DES shadow password cracking.
Execute targeted exploits (exploit <host> <vuln>), drop into root shells, plant persistent backdoors with rootkit install, and sanitize access trails in /var/adm/messages with syslog.
⚔ 4. Living Network Rivals & Defense SURVIVAL
Autonomous hacker syndicates roam the wire: ChaosSyndicate (ruthless zero-day raiders), PhreakPhun (telecom dialers), and CERT-IR (incident response teams actively patching holes).
Harden your systems: install TCP Wrappers (/etc/hosts.allow, /etc/hosts.deny), configure scanlogd to detect port scans, verify files with tripwire, and patch vulnerabilities before rivals retaliate!
The Endgame: Colocation Server Warfare
PERMANENT VICTORY & DEFEATEvery player and rival owns a colocated server in the network. If a rival faction locates your colo IP, they will retaliate with Ping of Death probes, port reconnaissance, and targeted exploits.
Infiltrate a rival's colocated server, obtain root privilege, and execute an endgame takeover. When a player or rival's colo is conquered, their handle is permanently seized and retired into cyberspace lore, cementing the victor's supremacy on the global backbone!
Experience the authentic V.32bis handshake whistle, DTMF dialing, carrier tone, and frequency negotiation generated in real time using the Web Audio API.
Connection Gateway: Plug Into The Net
AUTHENTICATION & ACCESSAfterlink supports both in-browser instant play via WebSocket terminal and native command-line access via direct SSH or Telnet. All player accounts, files, compiled binaries, and discovered network nodes are persistently stored in the server's database.
💻 Method 1: Web Terminal (Instant Play)
Play immediately in your browser right here on this page without installing any software or configuring keys.
- Full xterm.js terminal with keyboard shortcuts & command history.
- Simulated baud rate throttling (14.4k, 28.8k, 9600, or instant broadband).
- Configurable green, amber, cyan, or white phosphor with CRT scanlines.
- No account pre-requisite: interactive registration wizard built in!
🔑 Method 2: Native SSH Access
Connect directly using your operating system's native terminal (Linux, macOS, Windows Terminal, or PuTTY).
Connect directly to afterlink.us on the standard SSH port (22).
Account Registration & Identity Creation
HANDLE CREATIONGuest accounts are disabled to protect the persistent network state. When connecting for the first time:
- Connect as user
new(via SSH or the Web Terminal). - Enter your desired hacker handle (3-16 alphanumeric characters).
- Set a secure passphrase for your shell account.
- Your account is provisioned with a private home directory (
/home/<handle>), an initial mail spool, a Bourne shell environment, and your starting colocation server profile. - From that moment on, all tools you compile, hosts you discover, and access rights you acquire belong permanently to your handle.
Modem Baud Rates & Line Speed Simulation
PERIOD HARDWARE ACCURACYAfterlink includes an authentic line speed throttler that calculates character delays based on vintage telecom standards:
1,440 cps. The quintessential 1995 consumer internet experience. Perfect balance of nostalgia and playability.
2,880 cps. Cutting-edge mid-90s hardware. Fast text streaming without missing the CRT character crawl.
Slow, methodical teletype pacing for retro purists exploring vintage university mainframes.
Bypasses baud delays for immediate full-buffer rendering.
1995 Underground Field Manual & Command Reference
CORE CAPABILITIESEvery command in Afterlink executes entirely inside a deterministic, simulated UNIX operating system and virtual internet model. Use this manual to navigate, scan, exploit, and defend.
🔍 Network Reconnaissance & Information Gathering
| Command & Syntax | Description & Behavioral Details | Example |
|---|---|---|
nslookup <domain> |
Query simulated DNS name servers to resolve domain names to IP addresses. | nslookup cunix.cc.columbia.edu |
finger <user@host> |
Probe remote systems for logged-in users, administrative plans, and sensitive operational notes. | finger postmaster@mercury.sdf.org |
ping <host> |
Send ICMP Echo requests to measure round-trip latency and confirm remote host availability. | ping 128.59.39.2 |
traceroute <host> |
Trace the IP router path across intermediate gateway hops to discover internal backbone routers. | traceroute saturn.cerf.net |
nmap <host> [-sS] |
Port scanner. Identifies active services (Telnet, FTP, SMTP, Finger, DNS, HTTP, IRC) and banner signatures. | nmap 198.6.115.2 |
wardial <prefix> |
War dial telephone exchange prefixes (e.g., 415-555-xxxx) to detect acoustic carrier tones and PBX switches. | wardial 415-555-xxxx |
💣 Exploitation, Cracking & Persistence
| Command & Syntax | Description & Behavioral Details | Example |
|---|---|---|
exploit <host> <cve> |
Execute targeted historical attacks (e.g. Sendmail 8.6 DEBUG bypass, NCSA HTTPd overflow, SunOS rlogin trust). | exploit saturn.cerf.net sendmail |
crack <hashfile> <words> |
Dictionary password cracker implementing UNIX crypt(3) DES hashing to recover administrative passphrases. | crack /etc/shadow /pub/words.txt |
pod <target_ip> |
Ping of Death raw exploit tool. Sends malformed oversized ICMP fragments to crash unpatched stacks. | pod 199.171.21.99 |
rootkit <install|status> |
Embed persistent root backdoors into compromised hosts to maintain unauthenticated return access. | rootkit install |
syslog <audit|scrub> |
Inspect intrusion footprints in /var/adm/messages or sanitize your connection logs. |
syslog scrub |
🛡 Host Hardening & Defensive Countermeasures
| Command & Syntax | Description & Behavioral Details | Example |
|---|---|---|
tcpd <allow|deny> |
Manage Wietse Venema's TCP Wrappers access control lists (/etc/hosts.allow and /etc/hosts.deny). |
tcpd deny in.telnetd 199.171.21.0/24 |
scanlogd <on|off|status> |
Port scan detection daemon. Detects SYN stealth sweeps, alerts in syslog, and automatically blocks hostile IPs. | scanlogd on |
tripwire <init|check> |
File integrity monitor. Computes cryptographic hashes of critical binaries to identify unauthorized trojans. | tripwire check |
patch <service> |
Apply official vendor security errata to eliminate known vulnerabilities on your servers. | patch sendmail |
📡 Communications & File Transfers
| Command & Syntax | Description & Behavioral Details | Example |
|---|---|---|
ftp <host> |
Interactive FTP client. Browse remote archives, upload payloads, and download files using get and put. |
ftp ftp.cerf.net |
telnet <host> [port] |
Connect to remote shells, SMTP mail daemons, or BBS nodes. Supports session nesting and escape characters. | telnet bbs.mindvox.com |
irc [channel] |
Join real-time IRC chat on #afterlink. Communicate with online players and interact with autonomous rivals. |
irc #afterlink |
news |
Usenet newsgroup reader (rn/tin style). Read postings on alt.2600, alt.hackers, etc. |
news |
mail |
Interactive RFC 822 mail reader. Check incoming administrative notifications and player correspondence. | mail |
scp <src> <dst> |
Transfer files securely between hosts across your compromised network. | scp exploit.c root@saturn:/tmp/ |
Network Directory & Target Dossiers
THE 1995 TOPOLOGYThe Afterlink network simulates over 40 distinct hosts across universities, telecommunication carriers, underground BBSes, research contractors, and government nodes. Below are known key targets:
mercury.sdf.org
saturn.cerf.net
cunix.cc.columbia.edu
bbs.mindvox.com
underground.phrack.org
gw.sdf.org
core.afterlink.mil
Autonomous Network Factions
LIVING ADVERSARIESChaosSyndicate
Aggressive black-hat collective (notable handles: coron4, acid_burn). They actively scan subnets, plant trojan rootkits, probe player colocated machines, and retaliate with Ping of Death packets.
PhreakPhun
Old-school telecommunication phreakers (notable handles: phiber, captain_crunch). Masters of tone dialers, PBX bypasses, 2600 Hz trunk seizure, and war dialing.
CERT-IR (Incident Response)
Computer Emergency Response Team defenders (notable handles: cert-watch, admin-sys). They monitor malicious network probes, audit compromised hosts, and patch vulnerable daemons across public servers.