WEBVTT

00:00:01.440 --> 00:00:05.360
Before jumping to the demos, let's first understand what I'll be doing here.

00:00:06.240 --> 00:00:08.850
I divided the demos into two different use cases.

00:00:09.940 --> 00:00:13.480
In the first demo, you'll learn how to obfuscate incoming traffic,

00:00:13.510 --> 00:00:17.260
which can be useful to hide your IP address and bypassing protections.

00:00:18.240 --> 00:00:18.670
So again,

00:00:18.680 --> 00:00:20.950
you're a red team specialist and you're trying to

00:00:20.950 --> 00:00:22.760
attack the Globomantics corporation.

00:00:23.840 --> 00:00:26.860
Traditionally, you could start attacking your victim right away,

00:00:26.940 --> 00:00:29.560
like running port scans or whatever you want to.

00:00:30.540 --> 00:00:32.320
However, when you do that,

00:00:32.330 --> 00:00:35.340
the Globomantics firewall will be able to see your source IP,

00:00:35.340 --> 00:00:38.860
meaning they can track down and figure out who you are,

00:00:39.540 --> 00:00:40.760
and we don't want that.

00:00:42.440 --> 00:00:42.770
So,

00:00:42.780 --> 00:00:45.360
instead of sending the traffic directly from my attacker

00:00:45.360 --> 00:00:47.480
machine to the Globomantics server,

00:00:47.490 --> 00:00:51.350
I will use a proxy on the internet to tunnel my traffic through it.

00:00:52.340 --> 00:00:52.990
In this way,

00:00:52.990 --> 00:00:57.650
the Globomantics defense systems will see the proxy IP as the source IP,

00:00:57.650 --> 00:01:02.060
and because of that, they will not see the real IP address of my computer.

00:01:03.240 --> 00:01:06.950
And actually, this is really useful, not only to hide your real IP,

00:01:06.950 --> 00:01:10.920
but this is also useful in case the victim server is

00:01:10.920 --> 00:01:12.840
blocking your IP for some reason.

00:01:12.840 --> 00:01:14.280
With this technique,

00:01:14.280 --> 00:01:17.260
you can easily change your source IP by just

00:01:17.260 --> 00:01:19.460
changing the proxy you're connected to.

00:01:19.460 --> 00:01:20.960
Pretty cool, right?

00:01:20.960 --> 00:01:22.690
Now, enough of theory.

00:01:22.870 --> 00:01:25.960
Let's go to our lab environment and see how this is done in real life.

00:01:29.540 --> 00:01:30.190
Hey there!

00:01:30.190 --> 00:01:31.660
Welcome to our lab environment.

00:01:32.140 --> 00:01:35.030
As I mentioned, I have here my attacker machine,

00:01:35.170 --> 00:01:39.070
which is a Kali Linux version 2021.

00:01:39.070 --> 00:01:40.250
In this first scenario,

00:01:40.250 --> 00:01:46.090
I want to hide my source IP so the victim cannot track my actions.

00:01:46.090 --> 00:01:48.670
Here, let's access this page called whatismyip,

00:01:48.670 --> 00:01:52.490
and as you can see, we have here my real IP address,

00:01:52.490 --> 00:01:55.580
which is actually the IP address of my office.

00:01:55.590 --> 00:01:59.810
So, I don't want to show to my victim what my IP address is.

00:01:59.810 --> 00:02:03.450
For that, I can forward the traffic through an external proxy,

00:02:03.450 --> 00:02:08.509
so then the victim will see the proxy IP instead of my real IP.

00:02:08.509 --> 00:02:13.220
In your case, you could use any proxy you want.

00:02:13.220 --> 00:02:16.600
In here, I will use one of the most famous web proxies out there,

00:02:16.600 --> 00:02:18.540
which is the Tor network.

00:02:18.540 --> 00:02:20.570
If you've never heard about it before,

00:02:20.570 --> 00:02:24.150
I do recommend you doing a quick research on it.

00:02:24.150 --> 00:02:27.910
So, let's install the Tor proxy client here on my machine.

00:02:27.910 --> 00:02:37.160
For that, I will open the terminal, and then use sudo apt‑get install tor,

00:02:37.160 --> 00:02:38.600
and that's about it.

00:02:38.600 --> 00:02:44.540
After finishing this installation, I can use this Tor client with my ProxyChains.

00:02:44.550 --> 00:02:46.280
Basically, when I run the Tor client,

00:02:46.280 --> 00:02:49.520
it will create a tunnel between my machine and the Tor network.

00:02:50.160 --> 00:02:54.690
And this tunnel will be accessible on my local machine via port 9050.

00:02:56.060 --> 00:03:02.200
So, what we have to do now is tell ProxyChains which proxy I want to use.

00:03:02.200 --> 00:03:09.110
For that, I use sudo vim, and then the file /etc/proxychains4.conf.

00:03:12.900 --> 00:03:15.780
In this file, we have tons of configuration,

00:03:15.780 --> 00:03:18.710
and I will let you explore them on your own.

00:03:18.710 --> 00:03:20.580
They have a lot of interesting features,

00:03:20.580 --> 00:03:23.510
like using multiple proxies at the same time,

00:03:23.510 --> 00:03:25.290
but in here, in this course,

00:03:25.290 --> 00:03:29.810
all I want is to tunnel my traffic through the Tor network.

00:03:29.820 --> 00:03:33.340
So, let's scroll all way down to this file.

00:03:33.350 --> 00:03:34.770
And as you can see,

00:03:34.770 --> 00:03:39.490
ProxyChains already has a pre‑configuration for the Tor network.

00:03:39.500 --> 00:03:43.020
So, let's understand what this line does.

00:03:43.030 --> 00:03:47.990
First, I have to define the type of proxy that I'm using.

00:03:47.990 --> 00:03:52.810
In here, the Tor client creates a socks4 type of proxy.

00:03:52.820 --> 00:03:56.550
Then I have to put the IP address of the proxy.

00:03:56.550 --> 00:03:57.460
And remember,

00:03:57.460 --> 00:04:00.170
our Tor client connects to the Tor network and

00:04:00.170 --> 00:04:02.750
creates a port in my local machine.

00:04:02.750 --> 00:04:10.900
For this reason, I have here my loopback IP, which is 127.0.0.1.

00:04:10.900 --> 00:04:16.399
After that, we have to define which port is being used for the SOCKS proxy.

00:04:16.399 --> 00:04:22.250
And again, in our case, the Tor client uses the port 9050.

00:04:22.260 --> 00:04:23.340
So, we're all good here.

00:04:23.340 --> 00:04:24.940
There is nothing to change.

00:04:24.940 --> 00:04:27.370
Let's close this file,

00:04:27.370 --> 00:04:32.390
and then it starts the Tor client by using the command tor.

00:04:32.390 --> 00:04:34.950
And this might take a few minute,

00:04:34.950 --> 00:04:41.110
so I'll speed up this video to save you some time.

00:04:41.110 --> 00:04:41.300
Perfect!

00:04:41.300 --> 00:04:41.880
Take a look.

00:04:41.880 --> 00:04:43.890
It says Bootstrapped 100%,

00:04:43.890 --> 00:04:48.230
meaning the connection to the Tor network is now up and running.

00:04:48.230 --> 00:04:51.560
And now we are finally ready to use the ProxyChains.

00:04:51.560 --> 00:04:54.220
The good news is that after all this configuration,

00:04:54.220 --> 00:04:57.470
it is really easy to use ProxyChains.

00:04:57.470 --> 00:05:01.920
For example, if I want to tunnel my traffic from my Firefox through this proxy,

00:05:01.920 --> 00:05:07.030
I can just type proxychains and then firefox,

00:05:07.030 --> 00:05:08.400
and that's it.

00:05:08.410 --> 00:05:09.970
This will open Firefox,

00:05:09.970 --> 00:05:15.060
and all the traffic from my Firefox will go through our Tor proxy.

00:05:15.060 --> 00:05:16.370
Here, take a look.

00:05:16.370 --> 00:05:19.970
Let's go to the whatismyip page.

00:05:19.970 --> 00:05:20.960
See here?

00:05:20.960 --> 00:05:26.870
It shows my IP as Amsterdam, and remember, I currently live in Canada.

00:05:26.870 --> 00:05:27.760
Pretty cool, right?

00:05:27.760 --> 00:05:33.910
I was able to hide my IP, And this is not only useful to open pages.

00:05:33.910 --> 00:05:34.390
For example,

00:05:34.390 --> 00:05:39.760
let's say you compromised a server and you got SSH credentials to it.

00:05:39.770 --> 00:05:44.140
Now, we can SSH into the server using ProxyChains.

00:05:44.140 --> 00:05:51.530
For that, I will simply use proxychains and then my regular ssh command.

00:05:51.530 --> 00:05:51.830
Awesome!

00:05:51.830 --> 00:05:52.580
Take a look.

00:05:52.580 --> 00:05:54.980
We are now logging into the server.

00:05:54.980 --> 00:05:56.880
And if we use the command who,

00:05:56.880 --> 00:06:02.040
we can see that our SSH connection is coming from the IP in Amsterdam.

00:06:02.040 --> 00:06:05.400
And this is really good for us because if the client tries to check

00:06:05.400 --> 00:06:08.140
the logs to figure out who accessed the servers,

00:06:08.140 --> 00:06:10.400
they will find out it's an IP from Amsterdam,

00:06:10.400 --> 00:06:14.260
which is not my real IP, so then they cannot trace back the attack to us.