Welcome to our additional module for basic exploit development.
This time we're going to show you how to use a technique called Tor over VPN to improve your privacy.
Offensively scanning or crawling vulnerable web applications.
Tor over VPN is an anonymous technique that provides extra measures of security.
First, a VPN session is initiated and then a TOR sessions open through that VPN session.
It has four advantages, at least.
It hides the use of the Tor session from your internet service provider.
It hides from the Tor node, your actual IP address, because we're dropping the Vpn's IP address in
this place.
It may evade egress, filtering, other blocking techniques preventing you from using TOR, much like
the way that you would use a portable transporter with Tor.
It also hide your traffic from your VPN provider.
Let's look at a diagram of offensive scanning.
So here's my IP address from home is actually 71, 70, 54, 53.
It's not my actual IP address, but we're just going to use this as an example.
However, my VPN endpoint is located at 40 59148119.
When we run a scan using something like IMAP or Go Buster or some sort of web application scanner and
we proxy it through Tor, we are actually getting much different IP addresses from the Tor endpoint
that's hitting these vulnerable services, such as a web server on Port 80 or a web server on a four,
four, three or a proxy on AT&T.
It would show up to the victim.
That's 15223117 240 a tor node endpoint instead.
Additional advantages of using TOR over VPN is that it helps you crawl websites about revealing your
identity using various proxy aware or transparently proxy firewall tools such as t socks or proxy chains.
Now you can run MF Scarce with impunity, but the availability for that through TOR over VPN is just
a connect scan where if formed, creates the full TCP handshake during the scan.
It may evade FBI network investigative techniques such as the playpen bus, where the FBI actually embedded
malicious JavaScript code within a web website just to enumerate visitors.
So when you were to be hit by FBI in I.T., it may just drop your Vpn's endpoint address instead of
your real IP address.
So let's demonstrate how that works.
Let me shut down my original VPN.
And we're going to use OpenVPN, one of my VPN profiles.
Oh, my God.
I forgot to.
Sort of calisthenics.
I'm going to cut this video and go straight to the Twitter VPN.
All right.
Welcome back.
I actually got everything.
Running capabilities is running right here.
And I am going to show you the tour over VPN scanning technique.
So learn to do is pseudo open VPN.
And now we're going to test our actual IP address from the VPN endpoint.
It is a server located in the Netherlands, us acting as my VPN endpoint.
This is actually a bulletproof hosting VPN, by the way.
So it means that in general they don't really respond to, you know, inquiries to an IP address.
All right.
So the first thing you want to do is configure proxy chains.
We need to have this line right here.
Socks for localhost 1958 because that's where A is looking at.
And let's see.
Service tour start.
And we also need to do a modification to proxy chain's application because it's actually using old DNS
resolver that is a bit wonky.
Locate the proxy resolve.
Nano proxy resolved.
Make sure you have this proxies of DNS.
1.1.1.1 usually by default is actually 4.2.2.2 and you'll run into DNS issues while you're trying to
do that.
So let's try using proxy chains to grab our IP address.
Our IP address is 15195237118.
Now let's try grabbing our VPN endpoint.
IP address.
45 9148109.
Now, from here, you can actually just browse anonymously, like proxy jeans or box google.com.
Usually tours of this slow.
It's loading.
Tor is not really something that you would use because it will be fast.
It's because that's very well anonymizing.
But I can do something like.
Oh, right.
She works.
There we go.
So from here, I'm not actually going to attack a website that will be illegal, by the way.
But let's say that I want to use proxy chains imap connect scam.
No pain to go e-comm.
I'm not going to do that by the way, but what I'm trying to explain is that you will always be dropping
a torrent endpoint IP address instead of your VPN endpoint.
And if there was an FBI network investigative technique, it would only enumerate your actual VPN IP
address, not your home IP address.