Remaining anonymous and under the radar is essential practice for an attacker. In this article I will show the various ways this is done and demonstrate in detail the tools used to accomplish this.
A set of virtual tunnels that make up a network to help users to have privacy and added security on the internet.
How Tor works:
A Tor Button can be added to firefox that allows the user to toggle whether their browser is using the Tor network or not.
This allows a user to run any program through a HTTP or SOCKS proxy, for example through the tor-socks running on your machine when Tor has been installed.
Proxychains forces all connections to run through a user defined list of proxies.
A fast caching proxy server that can be used together with Tor network because it can connect with the SOCKS protocol.
Using them all together
Firstly download and install Tor from https://www.torproject.org/, guides on how to install correctly can be found there too.
Now download and install Polipo from http://www.pps.jussieu.fr/~jch/software/polipo/, again guides on how to install correctly can be found there too.
With Polipo running now download and install the TorButton Firefox add-on (Firefox browser must first be installed) from https://www.torproject.org/torbutton/index.html.en
Restart Firefox and now go into Tools -> Add-ons and then click the Preferences button on the TorButton add-on. Make sure the radio button for "Use the recommended proxy settings for my version of Firefox is selected.", is selected and that and the "Use Polipo" check box is ticked. Now click "Test Settings" to confirm that everything is working correctly.
So now you can click the TorButton button in your Firefox browser and you will be on the Tor network and anonymous! To test it's working further, toggle the TorButton on and click on this link to test if it's definitely on Tor: https://check.torproject.org/
Now I will show you how an attacker can use security tools in order footprint servers completely anonymously using proxychains.
Firstly add the Tor proxy address running on your machine to proxy list proxychains uses."the technique of gathering information about computer systems and the entities they belong to"
Now we want to resolve the IP of the target anonymously. To do we use a tool called tor-resolve. At a command line on a machine with Tor running enter
This will output the resolved IP address of the target server.tor-resolve <target>
Now we will use nmap through proxychains to probe the target anonymously. So at the command line enter:
proxychains nmap -sT -n -v -PN <target ip>This will take some time to complete, in order to speed things up add -p followed by port numbers you wish to probe separated by commas.
Now the attacker has successfully footprinted a companies server with them having no idea who he is! Now that the attacker knows what services are running on the target he will know if any of them are vulnerable to exploitation. He can now use Tor through his browser to exploit any vulnerabilities he has found or he can run his own exploits through proxychains, remaining anonymous throughout.
Metasploit can also be run through proxychains allowing an attacker to have a complete arsenal of attacks and still remaining unseen.