Setting Up ProxyChains + Tor For Anonymity And Security

Hack anonymously is one of the important aspect of Information Security, if you want to conduct penetration testing on a remote computer then active connection is required which surely reveal your identity, sometimes you need to hide your identity while doing vulnerability assessment because of your anonymity and security. Proxy Chaining is a concept which is very helpful to hide an identity on the Internet.

Every time we send a packet to our intended target, that packet contains our IP address in the IP header. When we make a TCP connection, the target system will log our IP address as it logs all connections. If we set off any security alarms or alerts, our IP address will be logged. All of these events increase the possibility of detection.

The worst thing that can happen to any hacker is being detected by a security admin, the security technologies (IDS, firewall, etc.), or a forensic investigator.

In order to hack anonymously with the least chance of detection, we need to use an intermediary machine whose IP address will be left on the target system. This can be done by using proxies.These systems are designed to accept our traffic and then forward it on to the intended target. Of course, the proxy will likely log our traffic, but an investigator would have to get a subpoena or search warrant to obtain the logs.

What is proxy chaining?

Proxy chaining is a way of being anonymous on the Internet or to access information that is not accessible in your country/region. Though it wont make you 100% anonymous but still helps to protect your identity.

In Kali Linux proxychains is already configured but if you are using any other version of Linux you may download it from official website. Follow the command mentioned below to get proxychains via terminal.

Proxies are just ip address of different machines in different regions which passes your request and make the content available to you.

Basically in proxy chaining a user setup several proxies on his machine then he made a request on Internet from his own machine. Then the request will be sent to first proxy then second then third and when request reaches to last proxy it complete request and sent the data back to original machine.

Usually free proxies are very slow and they are down most of the time. Paid proxies are usually fast but in this case user might lost his anonymity if he pay electronically. Company may revel his real information if something goes against the law and police asks for that person information. Laws differ from country to country so try to use proxy of that country which doesnt have strict cyber laws.

A user can become absolute anonymous if he uses many proxies. As proxies are usually very slow then just to load a simple Web page it will take more than enough time you can give if you use many proxies.

If you are already using Kali, then Proxychains is already installed!

If not, type in the following commands into terminal:

sudo apt-get install tor proxychains

To check if Tor is running:

sudo service tor status

To start Tor service:

sudo service tor start

To stop Tor and use Proxychains with custom proxies:

sudo service tor stop

Find Some Proxies From An Updated List

Go to the search engine and find some proxies.

Select proxies from distinct locations. It’s not sensible to rely on proxies exclusively from one source.

An example of a site offering free proxies list is: https://www.free-proxy-list.net

Locate Directory Of Proxychains

Type the following command into terminal:

locate proxychains

Based on the above screenshot, you can see that the Proxychains configuration file is located in /etc/.

Moreover, we see that our PATH variable is /usr/bin/ which indicates that you can use Oroxychains from any directory you desire.

Configuring Proxychains

Modify the configuration file with a file editor such as leafpad or nano.

Type the following command into terminal:

leafpad /etc/proxychains.conf

See below for your options and what to modify.

Strict Chain

Strict chain is best deployed when the attacker requires that the appearance of origin of the attacks derive from particular locations that are fundamental to his aim. Essentially, every connection goes through your proxy list in order as you have listed them. Strict chain has merit when you know that the proxies you have selected are all working.

Proxychains default configuration has strict chain enabled. Hence, we can see that it is uncommented out in the configuration file:

Random Chain.

Its preferable that you use random chain if you value randomness since every connection goes through your proxy list randomly. Thus, there is no order to follow. When you utilize random chain, you don’t merely obtain a new IP address, but that your traffic will end up looking different to the target. This is exceptional since it makes it more difficult to track the traffic back to the original source which is you.

If you want to use random chain: uncomment "random_chain" by removing the pound sign (#) in front of it, comment both "dynamic_chain" and "strict_chain" with the pound sign (#) in front of them.

Also, you might decide to uncomment "chain_len" which establishes the number of IP addresses in the chain which are utilized in generating your randomized chain of proxies:

Dynamic Chain

Dynamic chain is basically like strict chain with the added exception that it actually skips to the next proxy in your list if the previous one stopped working for some unknown reason.

To use Dynamic chain, simply uncomment "dynamic_chain" and comment both "strict_chain" & "random_chain".

Adding Proxies

To use the proxies, you have to add them first to the Proxychains configuration file. Proxychains default settings utilize the Tor network.

If you havent already opened Proxychains configuration file, the following command in terminal will suffice to initiate modification:

leafpad /etc/proxychains.conf

If you notice that the first line in the proxy list: "socks4 127.0.0.1 1080" which indicates that Proxychains initially points the traffic through our host located at 127.0.0.1, port 9050:

If you choose not to use Tor since it can be quite slow, you must comment out this line by adding in a pound sign (#) in front of socks4

You can add your fresh proxies below "socks4 127.0.0.1 1080" as shown in the above screenshot.

Do remember to use the tab key rather than space key to steer away from any issues when using Proxychains later on.

Now that you know how to use proxychains, you can do your hacking with relative anonymity. I say relative, because there is no surefire way to remain anonymous with the NSA spying on all our activity. All we can do is make detection MUCH harder, and proxychains can help do this for us.

I hope you enjoyed this article.