Welcome to Part 11 of this module.
Well it's been a while but we're finally back in Cali in this video.
We're going to be taking a look at proxy chains proxy chains is yet another method of staying anonymous
while we do our work online.
They can be set up on any Linux system really but proxy chains comes pre installed on Cowley.
Proxy chains are a network of proxies that when properly configured will anonymize anything that you
are doing online.
B It s q well injection and map scan a brute force attack or even just browsing the web.
Now you might be wondering what is the difference between a proxy and a proxy chain.
Proxies are only used for browsers and won't tend to anonymous ize each TTP or web connections or whatever
you're doing in the browser environment.
Proxy chains on the other hand will anonymize all of the activity that you are doing online rather like
a VPN that can in fact be used in conjunction with tor for further anonymity which I will be demonstrating
towards the end of this tutorial.
I said not to use taurine Carly and I stand by that because it's really not what Carly is intended for
but this will add on some additional security and you can set up proxy chains.
As I said on any Linux distribution and yes it is possible to use Tor proxy chains and a VPN all at
the same time.
The question of whether or not it is a good idea to use a VPN with Tor was addressed in the last video
so I won't be covering that again here.
I do encourage you to do some research on that question and make your own decision because as was said
opinions do vary significantly.
Also keep in mind that when using proxy chains or a VPN in virtual box your host operating system can
still see whatever you're doing and its internet connection is not protected.
All right.
So the first thing we're going to do is we're going to open up a terminal window and before we get started
we need to configure the proxy chains themselves to do this.
We'll be using the proxy chains dot configuration file for that.
We're gonna be using the Nano editor but if you prefer a different editor.
Feel free to use that.
I know some people are oddly attached and touchy when it comes to their favorite Ed in Linux.
So assuming that you want to use nano we're going to do nano forward slash that's at C or ATC forward
slash proxy chains dot c o and F for config.
And do you remember its ATC because Kelly Linux is already in the root directory.
If you're doing this on a different distribution of Linux or if you installed proxy change somewhere
else your path may vary.
There we are now.
I suspect that most of you already know this but if you don't that's OK.
These pound symbols or hashes at the start of each line basically tells the code to ignore that line.
For those of you with some programming background these lines are effectively commented out so by removing
a particular hash and then saving the configuration file we can essentially activate that particular
feature.
All right so the first line that we're going to concern ourselves with is this one each Sox for Sox
5 tunneling proxy fire with DNS each TTP proxies.
I trust you are all familiar with the are used in the Tor Browser.
Sucks for is a very old method that is really not that popular anymore but it is offered and Sox 5 is
what we'll be using their not demise.
Everything that you are doing on the system on the Internet so using the down arrow.
We're going to move down to this entry here for dynamic chains dynamic chains basically creates a network
of change proxies all linked together.
This is your quintessential bouncing your connection about from one proxy to another.
These chains can change as you go.
Strict chain on the other hand would just stick to specific proxies in order and you might want to do
that instead.
If you have certain proxies that you trust such as those you set up yourself or if you pay for proxies
but for this demonstration we're going to go ahead and put a comment or hash or pound symbol if you
prefer in front of strict chains and then we're going to go up here and we're going to remove the comment
in front of dynamic chains.
And when I say comment I mean the hash symbol or pound sign.
And this is going to have the effect of turning dynamic chains on.
So basically what this will do is go through a series of IP addresses or proxies in different countries
and we will specify down below in the configuration section.
So now we're gonna scroll down even further to proxy DNS requests in this section here.
This is really where the beginners tend to make mistakes.
What I mean is usually when anonymized your system you can use a proxy but you also have to change your
DNS.
The mistake most people make is they use a proxy which changes your location maybe every 10 to 15 minutes
your connection is bouncing around the world but your DNS is still in the country that you're in now
a good VPN with a strong client is already correcting this and provided there are no leaks.
You should be good but this is not true by default with proxy chains.
So when you use a proxy in let's say Switzerland and then 10 minutes later you're using one in Belgium
and 10 minutes later in Germany but your DNS data is leaking all over the place and showing that you're
in the United States.
Let's say.
Well it's not hard for a Web site like YouTube to log your proxy IP while also seeing your host country.
And yes YouTube will probably already know that you're using a proxy because they can see that using
different eyepiece but can also see that your DNS is in one country.
So the moral of the story.
Sure that proxy DNS requests are not leaking data.
OK so now let's scroll down to the proxy format examples.
This is a list of proxy formats.
There are several examples given here and they're pretty straightforward.
We'll get into configuration down here at the bottom.
One thing we want to notice is that we are by default using socks for if we glance up at our examples
we can see that we have a socks 5 example and that is what we want to use.
We have the address for the proxy which could be changed the port which again also could be changed
and these examples are the user name and password.
If you actually buy a proxy or a proxy fire for proxy chain.
In most cases they will give you a user name and password and this is where you would enter them.
We'll be using Tor and proxy chains together in this demonstration and we'll be using whatever defaults
come with Cali Linux under the proxy list heading below the examples we can see the defaults have been
set to Tor.
However it is being used in socks for we could change this but instead let's go ahead and type in Sox
5.
We'll press the tab key wants to keep the format consistent will enter the same IP which references
ourselves and the same port 9 0 5 0 and last but not least we need to come up to the line Sox 4 and
we're gonna go ahead and we're going to comment it out with the hash or pound symbol and we're done.
So now we need to write the changes to do that.
If we're using nano we press control.
Oh and enter to confirm wrote sixty five lines good and in control X will allow us to exit Nano for
this next step.
We will be assuming that you have tor installed.
If you don't already have tor installed in Cali and it may not be by default you would simply type apt
dash get install tor hit enter say yes and allow Tor to install it'll probably take you about five minutes
assuming you have tor installed.
We need to check if the tour service is currently running so we don't want it to be currently running.
So what we're gonna do is we're going to say service tor status
and it's fine it's not running so now what we're going to do is we're going to start things off.
Fresh Service for start and this is going to start the tour service the way we test this is by typing
proxy chains.
We have started the tour service by the way.
Proxy chains Firefox or your browser of choice but Firefox is recommended when using Tor.
And then we will put in a Web site.
We'll just pick Duck Duck Go.
Dot com press enter and to be clear you can use any Web site you like.
Proxy change is going to start and it's going to open firefox to our intended Web site.
Keep in mind this is going to take a while because running it through proxy chains means that we're
forming a lot of connections and kind of bouncing them around.
So you have to be patient just like you are when you're using Tor.
And after a very long wait.
Firefox does eventually pop up.
So how do we know we're anonymous.
Well let's take a quick look at the terminal and you don't really have to be too concerned with the
output here.
However this is essentially a map of how our chains are working out so I'm going to minimize this once
again and keep in mind that if you closed the terminal Firefox will close that will end the session.
We're running this through the terminal.
So now we need to check for DNS leaks.
You can do this with your VPN provider as well if you feel so inclined.
As I said before any good provider with a solid client should not be leaking.
But if you set up your own VPN or if you're using something a bit sketchy then this is a good practice.
Either way we're going to search up check for DNS leaks.
There are quite a few sites to choose from but for this demonstration we'll just go ahead and use the
DNS leak test official site and just as an aside I realize I've used Google quite a few times in the
course of this class and some of you probably think I'm a bit crazy for doing so.
Duck Duck Go is a very nice search engine because it does not log your IP whereas Google tracks just
about everything you do.
At any rate here we have the DNS leak test dot com Web site and as you can see it thinks that I'm currently
in Liberia and it's presenting an IP address that is definitely not my own.
So we know that this is all working properly and with that in mind let's go ahead and start a standard
test.
And this is going to take a while when doing it through proxy chains.
So please keep that in mind.
So currently it's running several rounds of tests and I must stress very very slowly and now the test
to successfully complete.
And if we scroll down we can see that it thinks that I am in Germany so good.
I am definitely not in Germany.
And again you can run this test when you are using your VPN of choice to make sure that your DNS is
not leaking.
All right.
So if you'd like to take further steps to make sure this is working for you one more thing you can do
is close out of Firefox and return to the terminal window
then we're going to do service tor restart and once again we're going to do proxy chains Firefox
duck dark go
and we come back over to DNS leak tests dot com and we can see that we have a different IP and apparent
geo location this time in Germany.
All right.
Now I could repeat the test but it takes forever and I think you get the idea.
OK now the proxies that Carly is connecting to by default are pretty dodgy which is to say I have no
idea who is running them or why they are free which means that for all I know they are compromised.
So it isn't a bad idea if you want to use this method to investigate your own proxies either creating
them yourself such as through a virtual private server somewhere you pay for anonymously or purchased
anonymously from a reliable source if you just use whatever Carly is set up to connect to as the default
you are taking your chances for a penetration tester on a burner laptop using Tor and proxy chains from
let's say a coffee shop or something of the kind that's probably just fine.
I certainly would not suggest sending any personal data through any proxy that you don't trust and yes
as I said earlier you can add a VPN into the mix.
You can go full out VPN plus tor plus proxy chains.
And again I want to stress that you do need to do some research the various opinions of security professionals
about whether or not that is really the right approach for whatever you're trying to do are quite unique
and varied because there really is no right answer.
I know I keep repeating this but there is a big difference between the aforementioned pen tester in
a coffee shop doing illegal penetration test and a reporter in a hostile foreign country trying to avoid
mass surveillance with their life on the line.
The rule is simple If the proxy is free and or you don't know for sure who controls it.
Don't trust it at least not completely build your anonymous izing approach from a position of skepticism.
Balancing your connection between proxies under the cover of a VPN or Tor is some pretty darn good anonymous
housing and it would take a very powerful and very determined adversary to identify and track you.
And let's be honest for most of you that hopefully isn't ever going to be the case even so don't use
a proxy you don't trust to do your online banking.
Not that an online bank is likely to let you in using a proxy.
But you know what I mean.
Don't use Tor for your online banking either.
Understand the risks and limitations of these techniques and plan accordingly.
And you should be just fine.
And remember most places you connect to with proxy chains will most likely recognize the fact that you're
using a proxy.
At least they're likely to recognize one of the default proxies the proxy chains is using.
And any cyber defense worthy of the name should flag such proxies as being hacking related immediately.
Once again this is a good reason to track down better proxies.
And it is something to be aware of when you set up your own defenses for any company that you work for
using a widely known proxy is a pretty obvious dead giveaway that you're up to some kind of shenanigans.
So there we go.
Virtual Private Networks tour proxies and encryption the four corners of the anonymity square.
Use them wisely.