Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

When testing live web apps that allow / encourage security research & disclosure should I be routing my traffic through Tor?

Is there a good reason not to?

Does it imply a certain malicious intent that I'd be trying to mask the source of my traffic? Or is it a good precaution to take in case someone misinterprets my poking around?

I've been practicing on VMs locally and I'd like to start testing on some of these sites that aren't hostile to security research but I'm not sure if there's a certain etiquette to follow (beyond their posted guidelines).

share|improve this question
    
I assume you mean testing sites like google and facebook. If thats the case, tor will only slow you down, theres no good reason to use it if you arent breaking their bug bounty program Ts&Cs –  NULLZ Jun 26 '13 at 0:21
    
Sites like those listed here: bugcrowd.com/list-of-bug-bounty-programs –  MTLPhil Jun 26 '13 at 0:37
1  
Keep in mind that some sites might block traffic from known Tor exit nodes. –  Dracs Jun 26 '13 at 0:41
    
The reason you use TOR when hacking sites is to avoid getting caught when doing something naughty. As long as you stick to their guidelines (read them and make sure you understand them) you should be fine. A VPN would mask your identity somewhat and help you hide, while not reducing your speed to much. It can still be tracked back to you depending on the provider but at least its a layer inbetween –  NULLZ Jun 26 '13 at 0:42

1 Answer 1

up vote 1 down vote accepted

Websites with bounty programs allow live exploiting, to some extent. Be sure to read up on their guidelines on this before proceeding. I think it's better to not use Tor, since Tor usually signifies malicious intent, especially when coupled with attempts to exploit the system. And they may not take kindly to that (especially if you are using things which link you to your real account while trying to exploit the system like an API key). Just use your normal browser, and if they come a-knocking, show them the details of the exploits you tried.

Sites like Google block most Tor exit nodes, so this is usually a moot point.

share|improve this answer
    
Note Google doesn't block Tor exit nodes as a matter of course, but it does get a lot of requests from them so they get hit with the usual rate-limiting captchas. –  Michael Jun 27 '13 at 17:44
    
@Michael Yeah, I know :) –  Manishearth Jun 27 '13 at 18:35

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.