What are the best tools to anonymize my port scanners and vulnerability assessment tools (like nmap , metasploit ) ...?

I have been using Backtrack and tor network with proxychains to do this, but tor has limits and I would like to know what other tools are there to do this. I want to run my tools and be hidden as possible.

i was studying in a penetration testing course so they ask us to test this in their lab so we get to know how bad guys (black hat hackers) work , this is just for learning and it is not about harming anyone

  • 11
    Why do I have a feeling you aren't doing this from an educational point of view... – Lucas Kauffman Mar 15 '12 at 18:08
  • 5
    Shadier than a 100 year old oak. – rook Mar 15 '12 at 18:14
  • @Ali - I'm having trouble seeing what possible use-case or scenario in which one would legitimately have this requirement. As others have mentioned, this seems to the result of unethical (black hat) activities. These are not welcome on our site. – AviD Mar 15 '12 at 20:10
  • 3
    @curiousguy I voted to re-open. Censorship is wrong. – rook Aug 11 '12 at 20:39
  • 1
    @Rook You may want to chime in on Clarify our stance on black hat questions – Gilles 'SO- stop being evil' Aug 12 '12 at 18:48

I'll assume you want to know what techniques the bad guys use to help defend your self against such threats.

Nmap has at least two anonymous port scanning methods. The two that I know of are are TCP Idle Scan and the FTP bounce scan. Both of these involve using a 3rd party to facilitate the scan. The nmap book is pretty awesome.

For metasploit you need a real connection to your target. Tor is a good choice, war driving and breaking WEP/WPA is another method (though usually illegal). Getting a list of anonymous proxies is a classic, tools like Charon and YAPH can help. These tools will tell you if the proxy supports TLS and if it is in fact anonymous, or if it spills information about the client (such as the x-forwarded-for http header).

  • 1
    Erh war driving is considered illegal... – Lucas Kauffman Mar 15 '12 at 18:22
  • @Lucas Kauffman so is using proxy servers that you don't own, oah and why do you want to be anonymous in the first place? Shadier than a 100 year old oak, unless of course you want to know what techniques the bad guys are using. – rook Mar 15 '12 at 18:24
  • 2
    There is a difference with stating something is a possible method and suggesting it as a good solution to a problem. I think the answer is correct I just think the phrasing isn't well chosen :). – Lucas Kauffman Mar 15 '12 at 18:28
  • 1
    I don't think anyone in this thread is an attorney. To answer the original question though, I concur with Rook: Using an anonymous proxy that has good TLS 1.2 support/configuration and using Tor to connect to that proxy (whether on the Internet or as a Tor hidden node), is a very ideal way to anonymize your traffic. Just make sure the proxy doesn't pass any unwanted headers or timing information. You also have to worry about your client-side getting owned, so take all of the necessary precautions (using a browser such as links(1) or programming your own HTTP using dynamic/managed code) – atdre Mar 15 '12 at 18:55
  • "infect anonymous" lol. Seriously, if I upvote this answer, do I need to upvote the question? – curiousguy Aug 11 '12 at 19:35

Pivoting through a 3rd party would provide anonymity, which is basically with Tor does, but a true pivot would hide your scans behind your already compromised host.

Metasploit allows you to do this by adding routes to the msfconsole.

Through the pivot, you can even run an nmap scan.

Once done, the logs of the 3rd party host can be purged.

  • oh - and I, too call 'shady' – schroeder Mar 15 '12 at 19:02
  • What do you mean by " hide your scans behind your already compromised host"? – Pacerier May 5 '15 at 0:55
  • 1
    @Pacerier run the scan from a host you have compromised. – schroeder May 5 '15 at 3:02

Not the answer you're looking for? Browse other questions tagged or ask your own question.