Hello everybody and welcome to this tutorial. I'm just gonna pick off from
where I left off in the previous one. Anyway, in the previous one, as the last
part, I have posed the question, and you should have answered it before you
started listening to this tutorial. In any case, as I said before, you have a
type of proxy here and you always want to be using socks5. You don't want to be
using HTTP because they're not really that safe, and socks4 doesn't support a
lot of options. Anyway, this is the IP address of the proxy server we will
enter a few of them manually later on, and this here is the port number on
which the proxy server is listening, the port that is open. And over here, these
two words, now what some proxy servers, especially paid ones, will always have a
username and a password. So you can just type them here in plain text,
unfortunately, but it is assumed that only you and you alone have access to
this computer, and besides this file not everybody can read this file,
anyway. So if you just type in the username here and password here, you will
gain access to a certain proxy that you have chosen or that you have paid for.
Anyway, these are just examples. We won't actually be using these proxies, or
anything of a kind. We need to go down below, and here is the end of the file. So
if I just press ENTER a couple of times, there we go.
So there is only one proxy active at the moment, it's socks4, and all traffic is being
routed here, so our tor it says defaults set to tor. Now tor by default listens
on this port, and our connections will be going through tor now, but just in case I
want to add socks, and you should really do this, socks5, press tab, and type in exactly
the same ip address, by the way this 127.0.0.1 is the loopback address of
your computer. So this is for inter device communication, and if you ping
this address, you're pinging yourself, basically, and
usually people ping this address in order to make sure that the IP protocol
is set up correctly, even though they don't have internet connectivity. So,
let's just type in 127.0.0.1, same port numbe,r space here
no tabs, 9050. There we go.
Press ctrl o to save a file, press ENTER, and by the way you don't need to use
Nano to edit this file. You can also use VI or some other text editor in order to
edit it. I like using nano. It's practical and it's fairly simple, it's a lot
simpler than VI. I know how to use VI as well but it's a bit more complicated, so
I prefer to keep it out of tutorials. Anyway, do ctrl o to save as I've done
just a moment ago. It doesn't hurt, you can press it as many times as you like, it
doesn't really matter, and then press ctrl X to exit. There we go.
Now we have the file saved. Clear the screen. You always want to make sure
that you are working in a very neat environment, so to say. Then go ahead and
type in service tor status to see if tor is running. Tor is not running so it
gives you an answer, and what we want is to start tor up. So service tor start,
press ENTER, there we go. Now the tor service has started, and it is up and
running. So the next thing that we need to do is use proxychains in combination
with our tor, and in combination with our internet browser, in order to be able
to access a third party in order to verify that all is working properly, and
that we are anonymous. A lot of people do the configuration, and they type in
service tor start, and yeah, that's it. They don't verify these settings. They
start to scan and what happens? Of course they get detected because they most
likely misconfigure something, so that's really a bad idea. What
you want to do is go ahead and type in proxychains, so proxychains.
Now this is, you do not want to browse the Internet as root, we're just going
to use it to verify our proxychains settings, and I'm going to close the web
browser. So I'm just using it for that purpose, and we will use proxychains
later on for a different kind of purpose, for scanning, and so on, and so forth, and
then we can use it as root, but for a browser it's not a good idea, for
security reasons. Anyway, proxychains and then type in Firefox, or
you can type in any favorite browser that you have. I think Firefox works
the best with proxychains since that is the default browser of Kali
Linux. Even though it says iceweasel, it's Firefox, trust me. So type in
proxychains Firefox, and we can type in the web site that we wish to visit, so let's
just type in www.duckduckgo.com. Now duckduckgo is a search engine that is also anonymizing you.
You will have a far greater extent of anonymity than you do when using Google, or an equivalent
popular search engine, as they do record your traffic, they do record your IP
addresses, and that can be problematic in itself, especially when you're doing some
sort of footprinting, you do not want to be recorded anywhere. Anyway,
let's just go ahead and press enter, and the web browser is loading. You can
see that the loading time is definitely not the fastest, it's a bit slow, but it
has loaded it up. We will just go ahead back to our terminal and see, excellent, so you
see that the link has been established here. There are some problems as it says
denied somewhere but that's ok, you're bound to encounter errors here, a bunch
of them, especially when you're using custom chains. You will see
there will be more error messages than there will
be okay messages, such as this one. But, believe it or not, the connection still
manages to pass through somehow, and still manages the function in spite of
that. Anyway, I'll just go back and open up our web browser once again, and you
can use pretty much a lot of services out there to do this sort of thing, so
just type in check for DNS leaks, and press Enter.
Wow, this was fast! Okay, so, DNS leak test, excellent! Let's go
ahead and click there and see what happens.
Hello, this is my this is my public IP address now, to 217.13.197.5,
and it says that I am from Germany. I assure you I am not from Germany. If you
want to verify all of this you can open up a new
terminal and type in service tor stop, and then open up your regular web
browser without the proxychains command, do the same test again, and you will see
that you will get a completely different IP address which will be your real IP
address. So, anyway, it says hello, this is me from Germany. I'm gonna do a standard
test, I'm not gonna do an extended test, same thing pretty much. This one does
more rounds but you get the same information, more or less. So it goes
query one, excellent! This is my DNS, this is my ISP provider. So
look this is what they have concluded in regards to my DNS: it's level 3
communications, and it says the country United States. Makes no sense
whatsoever. So I am anonymous now, I can't be detected, which is a very good thing
to have indeed. Now this IP address will change from time to time.
Let's just go ahead, ok, if you remember 217.13, let me just copy it, and I am
gonna go ahead and show you that it actually does change. So, accessories,
I'm pretty sure it has a text editor here, excellent! So I'm just
gonna paste this IP address, and now what I'm going to do is go ahead and close
this browser, and I don't need this, so service tor stop, it's stopping it, service
tor start, it's starting it. So you don't need to actually write start/stop,
you can also do service tor restart, and it's gonna do the whole process for you.
So you can save a little bit of time there and let's just repeat everything,
and I'm just gonna go ahead and type in proxychains Firefox, and I will
request the same search engine as well. Will it open? Now don't be
discouraged if it doesn't open it straight away. If it says, ok, you don't have
connectivity, or the website is not available, or something of a kind, just
try typing in the service tor restart command a couple of
times over again until you get it. Because sometimes certain IP addresses
are blocked and you need to be assigned the one that is not, so just don't
immediately jump to a conclusion. Oh, it's broken, or what I'm what am I gonna do?
It's gonna take forever to fix this, how am I gonna do this? No, just try resetting
it a couple of times and you will resolve the problem, primarily because a
different IP address will be assigned to you. So, anyway, let's just go ahead and
type in again, check for DNS leaks, press Enter, and here we go. I'm just
gonna use the same website, it's DNS leak, or whatever, dnsleaktest.com, that's the
name of it, excellent! So you see now I don't even need to compare the IP,
obviously it's different. So this one is 217.13, this one is 91.109, so completely
different IP address here, and from a completely different place. Now it says
that I am from the United Kingdom, apparently somewhere in London. I'll just go ahead
and issue a standard test to see what sort of resolutions will I get here. This
might take a while. That's why I'm doing the standard test, because it's
a lot faster, but you see the last one was rather fast, this one is a bit slower.
It depends on the distance. I suppose I'm a bit closer to Germany than I am to
United Kingdom, I don't know. I suppose this depends on the speed of the
server's as well. Anyway, you can see my DNS resolutions
here, it's level 3 communications again, I have stated nothing from the United States.
Yeah, I am completely anonymous with this. Not likely to be detected by pretty much
anything. Just to give you an example, if you wanted for example
to use proxychains with nmap, I'm not going to go into great detail now I will
show you this when we get to the ,map section, but before we do we can see some
verbose output here how this is actually functioning. So, there are certain domains
which are being contacted, you can see pretty much everything that is going on
here no problems, not a bad idea to sometimes go through this sort of
information especially if you do not have connectivity, or you wish to
understand better exactly where is your traffic going, where it is ending up, and
how is it spinning around. Anyway, let's just go ahead and
clear the screen and use, let's say, proxychains nmap, and this is all that you
would need to do in order to route all of nmaps traffic through proxychains.
This is pretty much true of any application. Just invoke the
application as you would, so normal nmap invocation would be nmap, and then
some IP address here, and then a port number here, and some arguments as well
to go along with it. But instead of just typing it like that, you can use proxy
chains and hide yourself. Also, just type in how
would you invoke a browser on a regular basis? You would type in firefox,
press enter, and that would of course open up a Firefox browser. So, any
application that you can start through your terminal, and you can start all of
them through your terminal, just type in proxychains in front of it, and all the
network information generated by that application will be routed through your
current, through the proxychains. Now will it use a preset of proxies or will
it use tor, that is up to you, how you have
configured it. And there will be a part three to this. I will show you how you can
import custom chains of proxies, and how you can use those proxies to access
things on the net, or to hide your activity behind them. In any case, I bid
you farewell and I thank you for watching.