1

I was wondering how hackers hide their identities while hacking? For instance, consider an attacker who wants to hack a website that has a SQL injection vulnerability. If the attacker uses automated tools to send malicious payloads, the admin of the website can check the payload sender's IP and readily find who sends these payloads.

What is it required for attackers to change their IP addresses or use proxy tools every time they want to attack a website?

Improve this question
3
  • 2
    Depending on how advanced the defensive tools are on the victim site, simply using a VPN or Tor can keep your identity safe if you are going to manually execute the attack. Alternatively, relying on public WiFi at a coffee shop can work as well.
    – dFrancisco
    Jan 26, 2018 at 19:05
  • So you say that every time a hacker wanna hack, he should use VPN or something like this? I think the connection speed will be slow with using VPN or TOR. Or he should go to the places which have public WiFi? It doesn't make sense! @dFrancisco
    – Patris
    Jan 26, 2018 at 19:14
  • 2
    It is all variable. It depends on the skill level of the attacker and the size of the victim as well as the quality and damaging effects of the attack. A mediocre attacker will do what I discussed above, professionals would hijack computers and enslave them as proxies etc. Plus, VPN's are not always slow. I have a paid VPN I use for personal stuff (not hacking things) which has maximum a 10% performance penalty with respect to download and upload speed.
    – dFrancisco
    Jan 26, 2018 at 19:44

2 Answers 2

Reset to default
3

Phineas Fisher suggested the following approach which is a pretty good example:

  • Use Tor to hide the location of your origin
  • Use a breached machine to connect to Tor so connection hours cannot be correlated

Link to his explanation of hacker team breach: https://gist.github.com/jaredsburrows/9e121d2e5f1147ab12a696cf548b90b0

Using Tor is going to limit what you can do so you will want to a shell to another machine after that to launch network intensive operations such as NMAP. Also, Tor network protocol will be known and a list of nodes blacklisted so all you want to use it for is to hide where you have connected the attacking box.

Some VPNs are pretty rubbish and leak information or use rubbish encryption so beware of that. https://www.theregister.co.uk/2016/02/26/ssl_vpns_survey/

Improve this answer
3
  • pastebin link died :(
    – mTvare
    Feb 24, 2021 at 10:41
  • @mTvare updated with another link. Its too large to post in here in full
    – McMatty
    Mar 1, 2021 at 2:07
  • So the attacker's computer connects to the previously breached machines without any protection in between and then thrugh them connects to tor?
    – Camilo
    Jan 23 at 5:50
2

You can do a lot of things to hide your public IP address. You can:

  • Purchase a VPN or VPS (preferably in bitcoin)
  • Route your traffic through the tor network
  • Use a proxy service

These are all well and good, but often, tor nodes and VPN IP addresses are flagged and banned from accessing some sites and services. In this case, you can:

  • Hack a website and use that server to launch an attack
  • Buy an "RDP session" to a residential network on the dark net
Improve this answer
9
  • I think the connection speed will be slow with using VPN or TOR etc.
    – Patris
    Jan 26, 2018 at 19:19
  • 1
    Not necessarily (I have a VPS running right now that's getting about 250 mbps up and down). Tor nodes will vary.
    – Dildo McButt
    Jan 26, 2018 at 19:23
  • 4
    Also keep in mind not all styles of attack require big bandwidth. You could successfully attack a web app via a dial-up connection with XSS or SQL Injection.
    – dFrancisco
    Jan 26, 2018 at 19:48
  • 1
    VPN provider could handover logs in case of investigation.
    – elsadek
    Jan 26, 2018 at 20:07
  • 1
    @dFrancisco "good one's" are good for themselves, that is keeping their business safe.
    – elsadek
    Jan 26, 2018 at 21:31

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .