When testing live web apps that allow / encourage security research & disclosure should I be routing my traffic through Tor?

Is there a good reason not to?

Does it imply a certain malicious intent that I'd be trying to mask the source of my traffic? Or is it a good precaution to take in case someone misinterprets my poking around?

I've been practicing on VMs locally and I'd like to start testing on some of these sites that aren't hostile to security research but I'm not sure if there's a certain etiquette to follow (beyond their posted guidelines).

  • I assume you mean testing sites like google and facebook. If thats the case, tor will only slow you down, theres no good reason to use it if you arent breaking their bug bounty program Ts&Cs
    – NULLZ
    Jun 26, 2013 at 0:21
  • Sites like those listed here: bugcrowd.com/list-of-bug-bounty-programs
    – MTLPhil
    Jun 26, 2013 at 0:37
  • 1
    Keep in mind that some sites might block traffic from known Tor exit nodes.
    – Dracs
    Jun 26, 2013 at 0:41
  • The reason you use TOR when hacking sites is to avoid getting caught when doing something naughty. As long as you stick to their guidelines (read them and make sure you understand them) you should be fine. A VPN would mask your identity somewhat and help you hide, while not reducing your speed to much. It can still be tracked back to you depending on the provider but at least its a layer inbetween
    – NULLZ
    Jun 26, 2013 at 0:42

1 Answer 1


Websites with bounty programs allow live exploiting, to some extent. Be sure to read up on their guidelines on this before proceeding. I think it's better to not use Tor, since Tor usually signifies malicious intent, especially when coupled with attempts to exploit the system. And they may not take kindly to that (especially if you are using things which link you to your real account while trying to exploit the system like an API key). Just use your normal browser, and if they come a-knocking, show them the details of the exploits you tried.

Sites like Google block most Tor exit nodes, so this is usually a moot point.

  • Note Google doesn't block Tor exit nodes as a matter of course, but it does get a lot of requests from them so they get hit with the usual rate-limiting captchas.
    – Michael
    Jun 27, 2013 at 17:44
  • @Michael Yeah, I know :) Jun 27, 2013 at 18:35

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.