Before jumping to the demos, let's first understand what I'll be doing here.
I divided the demos into two different use cases.
In the first demo, you'll learn how to obfuscate incoming traffic,
which can be useful to hide your IP address and bypassing protections.
So again,
you're a red team specialist and you're trying to
attack the Globomantics corporation.
Traditionally, you could start attacking your victim right away,
like running port scans or whatever you want to.
However, when you do that,
the Globomantics firewall will be able to see your source IP,
meaning they can track down and figure out who you are,
and we don't want that.
So,
instead of sending the traffic directly from my attacker
machine to the Globomantics server,
I will use a proxy on the internet to tunnel my traffic through it.
In this way,
the Globomantics defense systems will see the proxy IP as the source IP,
and because of that, they will not see the real IP address of my computer.
And actually, this is really useful, not only to hide your real IP,
but this is also useful in case the victim server is
blocking your IP for some reason.
With this technique,
you can easily change your source IP by just
changing the proxy you're connected to.
Pretty cool, right?
Now, enough of theory.
Let's go to our lab environment and see how this is done in real life.
Hey there!
Welcome to our lab environment.
As I mentioned, I have here my attacker machine,
which is a Kali Linux version 2021.
In this first scenario,
I want to hide my source IP so the victim cannot track my actions.
Here, let's access this page called whatismyip,
and as you can see, we have here my real IP address,
which is actually the IP address of my office.
So, I don't want to show to my victim what my IP address is.
For that, I can forward the traffic through an external proxy,
so then the victim will see the proxy IP instead of my real IP.
In your case, you could use any proxy you want.
In here, I will use one of the most famous web proxies out there,
which is the Tor network.
If you've never heard about it before,
I do recommend you doing a quick research on it.
So, let's install the Tor proxy client here on my machine.
For that, I will open the terminal, and then use sudo apt‑get install tor,
and that's about it.
After finishing this installation, I can use this Tor client with my ProxyChains.
Basically, when I run the Tor client,
it will create a tunnel between my machine and the Tor network.
And this tunnel will be accessible on my local machine via port 9050.
So, what we have to do now is tell ProxyChains which proxy I want to use.
For that, I use sudo vim, and then the file /etc/proxychains4.conf.
In this file, we have tons of configuration,
and I will let you explore them on your own.
They have a lot of interesting features,
like using multiple proxies at the same time,
but in here, in this course,
all I want is to tunnel my traffic through the Tor network.
So, let's scroll all way down to this file.
And as you can see,
ProxyChains already has a pre‑configuration for the Tor network.
So, let's understand what this line does.
First, I have to define the type of proxy that I'm using.
In here, the Tor client creates a socks4 type of proxy.
Then I have to put the IP address of the proxy.
And remember,
our Tor client connects to the Tor network and
creates a port in my local machine.
For this reason, I have here my loopback IP, which is 127.0.0.1.
After that, we have to define which port is being used for the SOCKS proxy.
And again, in our case, the Tor client uses the port 9050.
So, we're all good here.
There is nothing to change.
Let's close this file,
and then it starts the Tor client by using the command tor.
And this might take a few minute,
so I'll speed up this video to save you some time.
Perfect!
Take a look.
It says Bootstrapped 100%,
meaning the connection to the Tor network is now up and running.
And now we are finally ready to use the ProxyChains.
The good news is that after all this configuration,
it is really easy to use ProxyChains.
For example, if I want to tunnel my traffic from my Firefox through this proxy,
I can just type proxychains and then firefox,
and that's it.
This will open Firefox,
and all the traffic from my Firefox will go through our Tor proxy.
Here, take a look.
Let's go to the whatismyip page.
See here?
It shows my IP as Amsterdam, and remember, I currently live in Canada.
Pretty cool, right?
I was able to hide my IP, And this is not only useful to open pages.
For example,
let's say you compromised a server and you got SSH credentials to it.
Now, we can SSH into the server using ProxyChains.
For that, I will simply use proxychains and then my regular ssh command.
Awesome!
Take a look.
We are now logging into the server.
And if we use the command who,
we can see that our SSH connection is coming from the IP in Amsterdam.
And this is really good for us because if the client tries to check
the logs to figure out who accessed the servers,
they will find out it's an IP from Amsterdam,
which is not my real IP, so then they cannot trace back the attack to us.