I have a client that wants me to begin doing research on finding the origin of a persistent attacker to their network and employees. I haven't gotten the specifics yet, but I'm trying to think of ways and what tools I would use to find the origin of an attack. I know of data-mining tools to use but these would be useless until I can pinpoint where this attacker is located. What is the best practice (using Kali Linux's toolbox) that would help figure out the end point?


2 Answers 2


If the attacker has any experience at all, you won't find them.

TOR is an anonymity proxy, designed to make clients untraceable. It takes a great deal of effort to trace a person when they are using very simply proxy or VPN methods - if they are using anything like TOR then you can forget being able to find them.

If the source of an attack belongs to an ISP's allocated client IP range, such as those issued to home broadband customers, then you have a chance that the IP that is attacking your system actually is the customer allocated that IP address. Of course if there is any machine at that IP address that is simply proxying the attack from somewhere else (malware such as RATs can provide this service), then your search just got a lot harder.

  • your approach assumes using IPs as the main vector - there are other ways
    – schroeder
    Commented Mar 18, 2015 at 18:09
  • There are other ways, but if you want to geolocate an attacker, the main method will always be via IP. The fact that the question refers to locating the attacker indicates that the attack was performed remotely, not locally, but this is still an assumption. More details about the attack would need to be known before a more precise answer can be provided.
    – StampyCode
    Commented Mar 18, 2015 at 18:17
  • The attack itself can leave clues. Uploaded code can use comments or variable names from a particular language, attackers can sign their names, etc. I run honeypots, and it's amazing what fingerprints attackers leave behind - I never use IPs to attribute attacks.
    – schroeder
    Commented Mar 18, 2015 at 18:29
  • @schroeder I often read "comments" as a clue to identify malware author etc.. but I can't understand how these comments can appear (apart from scripts/interpreted code) ? Comments are only visible in source code, not in "running code"... same for variable names, as it is compiled etc.. Commented Mar 18, 2015 at 22:06
  • @crypto-learner there are ways for scripts to be uploaded (PHP shells, source code to be compiled on the target box, etc.)
    – schroeder
    Commented Mar 18, 2015 at 22:21

As Stampycode says, if the attacker has used pretty much any techniques to avoid being traced directly, you will struggle to directly trace them.

Depending on your remit, and the laws of wherever you are, you could switch to using active techniques to try and track them down.

If, for example, they are trying to access corporate documents, it would be possible to put "honeypot" documents on the network that either contain beacons or an exploit (which are many for PDF, Word documents, and Excel documents). This could allow you to see their real IP (if they open the document outside of the VPN/Tor) or even gain control of their machine. Again, a sensible attacker will be running this in a virtual machine.

There are of course other active techniques - they largely rely on the attacker getting greedy or lazy though.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .