0

so I am currently following a few online courses about ethical hacking and really want to become a bug bounty hunter/penetration tester but most of them do not teach anything about stay anonymous online or staying anonymous when scanning so do ethical hacker really need to stay anonymous or not since they are granted permission to hack?

In addition to this, shouldnt they still stay anonymous in case the firewall triggers and get them in unecessary troubles or even real hacker messing with them? So I guess my main questions is do you guys stay anonymous during penetration testing/ vulnerability analysis,etc and what are the most popular way to do it.

Improve this question

3 Answers 3

Reset to default
3

When you find yoursel wondering whether something is or not ethical or reasonable in IT world, just try to transpose it in real life.

Searching for exploits or security flaws in an information system is like trying to enter into a closed building. Serious companies do hire specialists to show them possible problems in their security. But when they find someone that was not asked to do that trying to enter in their building, they call the authorities before asking the guy for his motivations.

Transposing it into the IT world means that if no bug bounty program was published, and you have no contract (whatever the legal form) that allows you to search for exploits into an information system, doing it is clearly an attack and can lead to legal action against you if you are caught. And only in that case you need anonymity.

Now for your question.

If you have a contract with a company to search security flaws in their system, anonymity does not really matter because they already know you. If there is a bug bounty program, anonymity will only make harder for them to retribute you. That is the real why anonymity is not really a concern for white hat hacking.

It is only in what I would call grey hat hacking: trying to find exploits more or less at random with no authorization even if with no bad wills. But as I said above, this is not allowed, is likely to be seen as offensive, and could lead to legal actions. My advice is to just avoid it.

Improve this answer
1
  • Regarding penetration testing without (written) permission: Imagine someone gets caught trying to break into your home and then tells you he's actually a good guy just testing your security - probably won't impress judge or jury. Also imagine someone coming up to you and telling you that he checked out your house and found some neat ways to break into it, maybe even asking for a reward for that information. It wouldn't be unlikely for some people to take this as a (legally actionable) threat.
    – René Roth
    Commented Jul 5, 2021 at 7:24
3

I detect a couple of questions in your post so I'll try to separate them and answer them individually.

Do I need to be anonymous when doing penetration testing?

No, you need the opposite: a signed contract. You will have a lot of contact with the client to establish scope, launch the test, report any problems encountered, and to deliver the findings. Same as any other job.

I think it's helpful to understand that "ethical hacker" is more of a cultural/political/economic term than a technical one and that might be leading to some confusion here.

Learning about anonymization typically won't be covered in an "ethical hacking" course because these courses are designed for professional development, and in the context of business you don't need anonymity.

How do I confuse a firewall about my identity in order to prevent getting blocked?

If you're talking about getting around a firewall, that wouldn't be "anonymity" but rather "evasion". When running automated tools you'll inevitably bump up against different kinds of firewalls which will block you. There are evasion techniques to deal with these but again this is evasion, not anonymity. Commonly you can evade firewalls by tweaking your tools or by spoofing or rotating your IP address. It would be good to learn about this so that you can learn how to get around common defenses.

How do I stay safe online?

You also mentioned "real hackers" which by context I understand you to mean people looking to cause harm to you online. This is where anonymization might really come into play.

Your defenses against people looking to cause you harm will depend a lot on who those people are: nation-states? an ex? attackers looking to take over your Netflix account? It also depends on who you are, where you live, and your tolerance for risk.

These aren't easy questions to answer but there are good resources out there to help. There are sites like Surveillance Self-Defense that can help you with creating a plan to help protect yourself online (also referred to as "Threat Modelling").

Improve this answer
1

I think you answered your own question. Most pentesters have permission, and the scope is well defined prior to an engagement. Being anonymous during a pentest normally isn’t a big deal and isn’t even needed unless it’s defined within the scope (ie. social engineering). Obviously, you wouldn’t be broadcasting this information, but I wouldn’t worry too much about being anonymous outside of just general good security habits.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .