1

I was wondering how hackers hide their identities while hacking? For instance, consider an attacker who wants to hack a website that has a SQL injection vulnerability. If the attacker uses automated tools to send malicious payloads, the admin of the website can check the payload sender's IP and readily find who sends these payloads.

What is it required for attackers to change their IP addresses or use proxy tools every time they want to attack a website?

3
  • 2
    Depending on how advanced the defensive tools are on the victim site, simply using a VPN or Tor can keep your identity safe if you are going to manually execute the attack. Alternatively, relying on public WiFi at a coffee shop can work as well.
    – dFrancisco
    Jan 26 '18 at 19:05
  • So you say that every time a hacker wanna hack, he should use VPN or something like this? I think the connection speed will be slow with using VPN or TOR. Or he should go to the places which have public WiFi? It doesn't make sense! @dFrancisco
    – Patris
    Jan 26 '18 at 19:14
  • 2
    It is all variable. It depends on the skill level of the attacker and the size of the victim as well as the quality and damaging effects of the attack. A mediocre attacker will do what I discussed above, professionals would hijack computers and enslave them as proxies etc. Plus, VPN's are not always slow. I have a paid VPN I use for personal stuff (not hacking things) which has maximum a 10% performance penalty with respect to download and upload speed.
    – dFrancisco
    Jan 26 '18 at 19:44
2

You can do a lot of things to hide your public IP address. You can:

  • Purchase a VPN or VPS (preferably in bitcoin)
  • Route your traffic through the tor network
  • Use a proxy service

These are all well and good, but often, tor nodes and VPN IP addresses are flagged and banned from accessing some sites and services. In this case, you can:

  • Hack a website and use that server to launch an attack
  • Buy an "RDP session" to a residential network on the dark net
9
  • I think the connection speed will be slow with using VPN or TOR etc.
    – Patris
    Jan 26 '18 at 19:19
  • 1
    Not necessarily (I have a VPS running right now that's getting about 250 mbps up and down). Tor nodes will vary.
    – Mrdeep
    Jan 26 '18 at 19:23
  • 4
    Also keep in mind not all styles of attack require big bandwidth. You could successfully attack a web app via a dial-up connection with XSS or SQL Injection.
    – dFrancisco
    Jan 26 '18 at 19:48
  • 1
    VPN provider could handover logs in case of investigation.
    – elsadek
    Jan 26 '18 at 20:07
  • 1
    @dFrancisco "good one's" are good for themselves, that is keeping their business safe.
    – elsadek
    Jan 26 '18 at 21:31
2

Phineas Fisher suggested the following approach which is a pretty good example:

  • Use Tor to hide the location of your origin
  • Use a breached machine to connect to Tor so connection hours cannot be correlated

Link to his explanation of hacker team breach: https://gist.github.com/jaredsburrows/9e121d2e5f1147ab12a696cf548b90b0

Using Tor is going to limit what you can do so you will want to a shell to another machine after that to launch network intensive operations such as NMAP. Also, Tor network protocol will be known and a list of nodes blacklisted so all you want to use it for is to hide where you have connected the attacking box.

Some VPNs are pretty rubbish and leak information or use rubbish encryption so beware of that. https://www.theregister.co.uk/2016/02/26/ssl_vpns_survey/

2
  • pastebin link died :(
    – mTvare
    Feb 24 at 10:41
  • @mTvare updated with another link. Its too large to post in here in full
    – McMatty
    Mar 1 at 2:07

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.