Using Tor networks for scanning

During a Penetration Test, a lot of pentesters think that test should not include scanning of the target network, because external attackers would seldom perform these activities as it would give away their position and the target environment may shun the attacking IP address. However as discussed in client side attack presentation (Defcon 17 – 2009 year) we can evaluate this risk.

Based on a Defcon presentation by Valsmith and his crew about client side attacks and Strandjs article.

Prerequisites:
Installation > – Tor – Privoxy – proxychains – tortunnel – nmap
A preset and complete configuration of tools.

Training
Scanning through the Tor network,all of your packets going through three Tor nodes:

proxychains nmap -sT 209.20.73.195

But you aren’t anonymous in scanning, because nmap pings the remote host and it sends ICMP packets to the target systems.

A fix packets sent to the target environment (that are not going through the Tor network) are dropped.

iptables -A OUTPUT –dest [TargetIP or range] -j DROP

Using tortunnel you can improve the speed of your scan, because it allows tor goes directly to an exit node.
You need to edit proxychains.conf file to use socks5 and look for stable exit nodes to scan through.

socks5 127.0.0.1 5060

Start Tortunnel

./torproxy [ExitNodeIP]

now restart Nmap

proxychains nmap -sT -p 80,443,21,23 209.20.73.195

and configure /etc/privoxy conf file

forward-socks5 / 127.0.0.1:5060 .

If IPs will block you, move to another node.

Please understand that there are a lot of risks through a Tor network, because it isn’t completely anonymous,your traffic can be sniffed on the exit nodes.