1

What are the best tools to anonymize my port scanners and vulnerability assessment tools (like nmap , metasploit ) ...?

I have been using Backtrack and tor network with proxychains to do this, but tor has limits and I would like to know what other tools are there to do this. I want to run my tools and be hidden as possible.

i was studying in a penetration testing course so they ask us to test this in their lab so we get to know how bad guys (black hat hackers) work , this is just for learning and it is not about harming anyone

Improve this question
12
  • 11
    Why do I have a feeling you aren't doing this from an educational point of view...
    – Lucas Kauffman
    Commented Mar 15, 2012 at 18:08
  • 5
    Shadier than a 100 year old oak.
    – rook
    Commented Mar 15, 2012 at 18:14
  • @Ali - I'm having trouble seeing what possible use-case or scenario in which one would legitimately have this requirement. As others have mentioned, this seems to the result of unethical (black hat) activities. These are not welcome on our site.
    – AviD ♦
    Commented Mar 15, 2012 at 20:10
  • 3
    @curiousguy I voted to re-open. Censorship is wrong.
    – rook
    Commented Aug 11, 2012 at 20:39
  • 1
    @Rook You may want to chime in on Clarify our stance on black hat questions
    – Gilles 'SO- stop being evil'
    Commented Aug 12, 2012 at 18:48

2 Answers 2

Reset to default
3

I'll assume you want to know what techniques the bad guys use to help defend your self against such threats.

Nmap has at least two anonymous port scanning methods. The two that I know of are are TCP Idle Scan and the FTP bounce scan. Both of these involve using a 3rd party to facilitate the scan. The nmap book is pretty awesome.

For metasploit you need a real connection to your target. Tor is a good choice, war driving and breaking WEP/WPA is another method (though usually illegal). Getting a list of anonymous proxies is a classic, tools like Charon and YAPH can help. These tools will tell you if the proxy supports TLS and if it is in fact anonymous, or if it spills information about the client (such as the x-forwarded-for http header).

Improve this answer
5
  • 1
    Erh war driving is considered illegal...
    – Lucas Kauffman
    Commented Mar 15, 2012 at 18:22
  • @Lucas Kauffman so is using proxy servers that you don't own, oah and why do you want to be anonymous in the first place? Shadier than a 100 year old oak, unless of course you want to know what techniques the bad guys are using.
    – rook
    Commented Mar 15, 2012 at 18:24
  • 2
    There is a difference with stating something is a possible method and suggesting it as a good solution to a problem. I think the answer is correct I just think the phrasing isn't well chosen :).
    – Lucas Kauffman
    Commented Mar 15, 2012 at 18:28
  • 1
    I don't think anyone in this thread is an attorney. To answer the original question though, I concur with Rook: Using an anonymous proxy that has good TLS 1.2 support/configuration and using Tor to connect to that proxy (whether on the Internet or as a Tor hidden node), is a very ideal way to anonymize your traffic. Just make sure the proxy doesn't pass any unwanted headers or timing information. You also have to worry about your client-side getting owned, so take all of the necessary precautions (using a browser such as links(1) or programming your own HTTP using dynamic/managed code)
    – atdre
    Commented Mar 15, 2012 at 18:55
  • "infect anonymous" lol. Seriously, if I upvote this answer, do I need to upvote the question?
    – curiousguy
    Commented Aug 11, 2012 at 19:35
2

Pivoting through a 3rd party would provide anonymity, which is basically with Tor does, but a true pivot would hide your scans behind your already compromised host.

Metasploit allows you to do this by adding routes to the msfconsole.

Through the pivot, you can even run an nmap scan.

Once done, the logs of the 3rd party host can be purged.

Improve this answer
3
  • oh - and I, too call 'shady'
    – schroeder ♦
    Commented Mar 15, 2012 at 19:02
  • What do you mean by " hide your scans behind your already compromised host"?
    – Pacerier
    Commented May 5, 2015 at 0:55
  • 1
    @Pacerier run the scan from a host you have compromised.
    – schroeder ♦
    Commented May 5, 2015 at 3:02

Not the answer you're looking for? Browse other questions tagged .