If I run an exploit like EternalBlue with Metasploit on whonix to a remote machine, do I remain anonymous? I think I do because it goes over tor but I am not sure. Am I right?

  • Whonix isn't the important part, but Tor is.
    – schroeder
    May 8, 2021 at 19:39
  • @schroeder so if my whonix connected to tor right, am i anonymous? :)
    – dumb guy
    May 8, 2021 at 19:43
  • Any traffic sent through Tor gets the protection of Tor.
    – schroeder
    May 8, 2021 at 19:55
  • thnx so the answer is yes?
    – dumb guy
    May 8, 2021 at 19:59
  • The answer is what I said. I can't say that simply using Whonix means that everything is going through Tor.
    – schroeder
    May 8, 2021 at 20:02

1 Answer 1


Whonix routes all of the network traffic via Tor, so theoretically speaking - yes. However, there are many other ways in which you can be de-anonymized. Just because you send your traffic over Tor, it doesn't necessarily mean you're 100% anonymous. For example, the actions you take on the hypothetical machine after the exploitation could de-anonymize you.

I would also advise against installing unnecessary things in Whonix since the process of downloading and installing the binaries could de-anonymize you in itself. This recommendation is also outlined in the Whonix documentation.

A better way of doing this would be to use Whonix for your host (so your traffic is networked via Tor), rent a server with XMR, SSH to that server over Tor, install Metasploit on that server and then use that server to launch your exploit. Then wipe the server entirely when you're done and burn any credentials, etc. Of course, this isn't 100% fool proof either. Since the actions you take on the server you're running the exploit from could also de-anonymize you even if you're using Tor and paid for the server in XMR.

As forest mentioned in the comments, it is also important to ensure that if you're going to SSH to an anonymously purchased server, you need to configure your SSH client such that it does not send all of your public keys, as any other public keys you have configured will also be sent to the server, thus potentially leaking your identity.

In such a case that you only need to perform this once, you could opt for using Tails (it also sends all of the traffic via Tor) over Whonix for the duration of the exploitation since it's an amnesic OS. But always ensure you purchase a server to carry out the actual attacks!

There's a lot of useful information about using Whonix correctly & safely in the Whonix documentation, I would highly advise you to read it. There's also some advice on general opsec practices.

  • 2
    You may want to point out that SSHing into an anonymously-purchased server is risky if your SSH client is set up to send it all your public keys (which by default, it is). That is, if you have public keys for both non-anonymous-host and anonymous-host, they will receive both public keys when you connect.
    – forest
    May 9, 2021 at 20:20

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .