It is may be a simple question, but I was wondering how hackers hide their identity while hacking? For instance, consider an attacker who wanna hack a website which has SQL injection vulnerability. If he uses automated tools to send malicious payloads, the admin of website can check the payload sender's IP and readily find who sends these payloads. Now my question is that is it required for an attacker to change his IP address or use proxy tools every time he wanna attack a website?

  • 2
    Depending on how advanced the defensive tools are on the victim site, simply using a VPN or Tor can keep your identity safe if you are going to manually execute the attack. Alternatively, relying on public WiFi at a coffee shop can work as well. – dFrancisco Jan 26 '18 at 19:05
  • So you say that every time a hacker wanna hack, he should use VPN or something like this? I think the connection speed will be slow with using VPN or TOR. Or he should go to the places which have public WiFi? It doesn't make sense! @dFrancisco – Patris Jan 26 '18 at 19:14
  • 2
    It is all variable. It depends on the skill level of the attacker and the size of the victim as well as the quality and damaging effects of the attack. A mediocre attacker will do what I discussed above, professionals would hijack computers and enslave them as proxies etc. Plus, VPN's are not always slow. I have a paid VPN I use for personal stuff (not hacking things) which has maximum a 10% performance penalty with respect to download and upload speed. – dFrancisco Jan 26 '18 at 19:44

You can do a lot of things to hide your public IP address. You can:

  • Purchase a VPN or VPS (preferably in bitcoin)
  • Route your traffic through the tor network
  • Use a proxy service

These are all well and good, but often, tor nodes and VPN IP addresses are flagged and banned from accessing some sites and services. In this case, you can:

  • Hack a website and use that server to launch an attack
  • Buy an "RDP session" to a residential network on the dark net
| improve this answer | |
  • I think the connection speed will be slow with using VPN or TOR etc. – Patris Jan 26 '18 at 19:19
  • 1
    Not necessarily (I have a VPS running right now that's getting about 250 mbps up and down). Tor nodes will vary. – Mrdeep Jan 26 '18 at 19:23
  • 4
    Also keep in mind not all styles of attack require big bandwidth. You could successfully attack a web app via a dial-up connection with XSS or SQL Injection. – dFrancisco Jan 26 '18 at 19:48
  • 1
    VPN provider could handover logs in case of investigation. – elsadek Jan 26 '18 at 20:07
  • 1
    @dFrancisco "good one's" are good for themselves, that is keeping their business safe. – elsadek Jan 26 '18 at 21:31

Phineas fisher suggested the following approach which is a pretty good example:

  • Use TOR to hide the location of your origin
  • Use a breached machine to connect to TOR so connection hours cannot be correlated

Link to his explanation of hacker team breach: http://pastebin.com/raw/GPSHF04A

Using TOR is going to limit what you can do so you will want to a shell to another machine after that to launch network intensive operations such as NMAP. Also TOR network protocol will be known and a list of nodes blacklisted so all you want to use it for is to hidden where you have connected to attacking box from.

Some VPNs are pretty rubbish and leak information or use rubbish encryption so beware of that. https://www.theregister.co.uk/2016/02/26/ssl_vpns_survey/

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.