Hey there.
Welcome to the course Defense Evasion with ProxyChains.
In here,
you'll learn how to bypass network defense systems using
one of the most famous red team tools.
So imagine that.
Imagine that you're a red team specialist,
and you're trying to attack the Bank ABC.
As you can see in this diagram, the network of the bank is fairly secure.
It has a firewall protecting the servers in the DMZ,
and it has network segregation to ensure that it cannot get into
the internal network from outside of the company.
So during your engagement,
you find a way to compromise one of the servers in the DMZ.
For example, you find a vulnerability,
and you're able to exploit and get a shell to the DMZ server.
Now think about that.
How can you go even further into the network?
If you try to access any internal server from the outside,
your traffic will be blocked by the firewall.
So then we have to think about something else.
And here is where ProxyChains can help you.
With ProxyChains,
we can tunnel our traffic through the compromised server and
reach other servers in the internal network.
With that,
we can then compromise other servers and use ProxyChains
again to go even further into the network.
Pretty cool, right?
That's why ProxyChains is one of the most used tools by
attackers and red team specialists.
It allows you to bypass firewalls and other network perimeter defense tools.
The ProxyChains tool is useful not only for defense evasion, we can
actually use across several phases of a red team exercise.
This tool was originally created by N3E7CR34TUR3.
And since then, it's had several major contributors.
If you're into red team tools, you should definitely check their GitHub,
and you'll find tons of cool scripts in there.
Basically,
ProxyChains is a tool that forces any TCP connection
from application to go through a proxy.
The ProxyChains is actually really famous because people use it
with the TOR service to an anonymize traffic.
But as you will see in this course,
we can use ProxyChains to bypass firewalls and network defense devices.
What I love about ProxyChains is that it's open source,
meaning that we can download the code, use it for free,
and even customize the code if you want.
You can find the source code at this GitHub page.
ProxyChains is one of the most well‑known tools for traffic redirection,
meaning that with ProxyChains, we can redirect the TCP packets from any tool,
like and Nmap, theHarvester, SSH, and etc.
And this can be really interesting to provide traffic anonymization.
For example, if I want to run an Nmap scan against the server,
but I want to hide my real IP address,
I can use ProxyChains to reroute the traffic
through some proxies on the internet.
Also, as we discussed in the beginning of this course,
ProxyChains can be used to bypass defense mechanisms.
For example, if I'm able to get initial access to one server in a company,
then I can use ProxyChains to access other internal servers
that are not exposed to the internet.
If you're familiar with the red team kill chain methodology,
we can use the ProxyChains tool anywhere from the recon
phase all the way to the action phase.
Any time we need to redirect traffic, the ProxyChains can be used.
However, in this course, we'll focus on the lateral movement and evading phases,
meaning that we'll use ProxyChains to move from one machine to
another one and evade any defense tools.
Also, if you're familiar with the MITRE ATT&CK framework,
we can map this course to the defense evasion phase.
In this phase, we focus on one main technique,
which is network boundary bridging.
So let's talk about our demos.
If you want to follow the demos of this course, you need two things.
First and most important, you need an attacker machine.
In here,
I'm using a Kali Linux virtual machine because it
already comes with ProxyChains installed.
But, you can actually use ProxyChains in any Linux distribution.
The installation process is really simple.
Also, you need a victim machine so then you can practice the attacks.
In my case,
I have one server in the DMZ that I can exploit and one server in the
internal network that only communicates with the DMZ server.
In my case, both servers are Linux, but it could be any kind of victim computer.