Telnet: the Number One Hacker Tool

In this Guide you will learn:

· What is telnet?

· How to telnet

· How to get telnet accounts

· Why you might not want to telnet

· How to install a telnet server on your home Windows computer

· How to turn off a telnet server on your home Linux computer

· How to explore computers using telnet

· Why not use a portscanner instead?

· How to break into web sites using telnet

"Where do I type that command?" People ask that all the time when they read my early Guides to (mostly) Harmless Hacking. I wrote those guides back when the Internet was in its infancy and almost everyone in cyberspace used telnet. However, nowadays you might never even hear about telnet, much less use it, unless you are a hacker. So if you are still wondering about telnet, today is your lucky day.

What Is Telnet?

Telnet is a protocol that is most commonly used to log into a remote computer. It also is the single most powerful hacking tool on the planet. With just a telnet client program, you can:

· send email

· download source code from web sites

· send unexpected input to webservers that can give you amazing and sometimes illegal results

· give arbitrary input to many other services on Internet host computers

· probe the services offered by servers, routers and even people's home computers.

How to Telnet

Don't know how to telnet? Click the easy telnet links at happyhacker.com and land in the middle of a real hacker wargame! This should work regardless of your computer operating system -- if you have an up to date browser, if your online service provider gives you a true Internet connection, and if your computer is able to telnet at all.

Did those links get you into a telnet session? Were you able to login to a remote computer? If yes, congratulations.

If not, how can you fix the problem? If no telnet program appeared on your monitor when you clicked these links, perhaps your browser is too ancient to allow telnet. Try installing the latest Netscape browser (). Or, perhaps your operating system does not include a telnet program. In that case, install or reinstall Windows 95 or 98. If you own a Mac, get the superb Mac OS X or Linux PPC ().

If a telnet program came up and failed to connect, possibly the computer you were trying to telnet into was down or just plain no longer in existence. Or, you may be using America Online (or a similar extremely poor online service). If so, your simplest solution may be to get a better online service provider. Determined to hack using AOL? See http://happyhacker.org/aol.shtml <../aol.shtml> for some ways to make AOL give you a true Internet connection.

OK, so you've managed to telnet for the first time. Presumably you don't want to limit yourself to telnet links on web sites. How do you telnet anywhere you want to go?

If you have Linux or any other type of Unix (BSD, SCO, Solaris, Sun OS, Irix, Ultrix, etc.) telneting is easy. Just bring up "console" or "shell" (or whatever your GUI calls the command line interface). At the prompt type:

telnet

More on Telnet: the Number One Hacker Tool

Windows 2000 works pretty much like Unix. See Figure 1 for an example of a Win 2000 telnet login. Not shown on the screen was the command "telnet 10.0.0.10", which I gave at the Command (MS-DOS) prompt.

Figure 1: Telnet using Windows 2000

If you have Windows 95, 98 or NT, to telnet, bring up the MS-DOS prompt (Start --> Programs --> MS-DOS).

Click "connect" then "remote system…". In the host name box place the host name or IP address of the computer to which you wish to telnet. Leave the Port and Term Type boxes alone for now.

Here is a really important point. Every day people email me complaining that some computer won't let them telnet into it. They ask what they are doing wrong. They aren't doing anything wrong:

· Maybe the computer they are trying to reach no longer exists.

· Maybe the computer they are trying to reach doesn't allow telnet logins. For example, whois.internic.net no longer allows telnet logins on port 23 (the default port). Click here to learn how to telnet into whois.internic.net on the right port for that particular server. <../whois.shtml>

· Maybe a firewall is blocking them.

· Or maybe they make a telnet connection and the remote computer asks for a user name and password they don't have. Then they email me asking for how to get a login name and password that will work.

Newbie note: The owners or administrators of any Internet host computer decide who gets user names and passwords. Believe it or not, about once a week someone emails me asking what user name and password their own online service provider has assigned them for a telnet login. That's why I'm telling people the obvious -- if you want to telnet into any computer, and you don't have a user name and password, you must ask the owner, administrator of tech support for that system for a user name and password. If they won't give that to you, they don't want you to have it!

You can go to jail warning: If you guess the user name and password, or use a computer breakin technique to get or create them, or if someone other than an owner or administrator or a legitimate user on that system gives you a user name and password, it is against the law to use them. Many computer criminals give out user names and passwords that they obtained illegally.

More on Telnet: the Number One Hacker Tool

How to Get Telnet Accounts

OK, so you want to get legal user names and passwords so you can telnet into other computers. Here are some of the best ways:

· See http://happyhacker.org/links2.shtml#shells <../links2.shtml> for organizations that will give you free shell accounts. You can telnet into these.

· Ask Internet Service Providers for shell accounts. Some offer them, although most don't.

· Set up a telnet server on your own computer (see instructions below). Yes, once you are running a telnet server, you can telnet from your computer back into your computer. Simply give the command "telnet 127.0.0.1".

· Make friends with people who run Internet computers with telnet servers.

Why you May Not Want to Telnet

If you love your shell account server, don't ever, ever telnet or ftp into it. I recommend Ssh or Openssh for logging into remote computers? The telnet (and ftp) protocol is a "clear text" transmission. That means that computer on the same LAN as either You or your destination computer, or any computer on any LAN or network path through which your connection passes can steal your login name, password or anything else that goes across your connection. Ssh and OpenSsh encrypt all communications so no one can snoop on you.

How to Install a Telnet Server on your Windows Computer

Usually you can't telnet into a Windows home computer. The reason is, they aren't running telnet servers. Here's how to get a telnet server on your home Windows computers so your friends and you can telnet in and play.

For Windows NT, the Options Pack includes a primitive telnet server.

For Windows 95/98/NT and 2000, you also can install shareware or commercial telnet servers. Check out http://www.winfiles.com, or do a web search.

Of course installing a telnet server makes your computer vulnerable to all sorts of trouble from hackers. It's your funeral, don't come crying top me if a telnet visitor destroys your computer

More on Telnet: the Number One Hacker Tool

How to Turn off a Telnet Server on your Unix-type Computer

If you go online with Linux or other Unix-type computer, a telnet server is the easiest way to ensure you get destroyed by a malicious hacker. Here's how to prevent this. On most of these, the file /etc/inetd.conf launches most of your servers. Edit the file to put a "#" in front of the line that has telnet in it and either reboot your computer or kill and restart inetd.

If your computer doesn't use inetd to launch services, you should be able to find telnetd under /etc/init.d.

Install ssh instead and only use that to log into your shell account.

How to Explore Computers Using Telnet

Even if a computer doesn't have a telnet server, there are lots of fun and even legal things to do to it using telnet. The easiest thing to do is extract "banners" from a victim computer. A banner is a message a computer will often give when you telnet to a port that is running an Internet server of some sort.

For example, most mail sending servers use port 25. To telnet to port 25 from Win 2000 or a Unix shell, simply type:

telnet 25

Windows 95, 98 and NT make it a tiny bit harder.

More on Telnet: the Number One Hacker Tool

If the victim computer is running a mail server, you will see something that looks like this:

Whoa, look at that! The victim computer told us what operating system (Windows NT) and mail server (Mercur) it runs!

A quick search of the Bugtraq archives at revealed horrid things a criminal could do to that Mercur mail server. Since I think it is more fun to be nice, I told someone at the company using this mail server about the problems. He invited me to vacation at his beautiful Swiss home, where he and his wife keep horses and take long trail rides in the Alps. Golly, that is much more fun than breaking into a computer!

Right about now some elite ueberhaxorz are probably reading this and saying "What a lamer Meinel is! We can do the same thing by running nmap."

They are right, you can learn the same things by running a port scanning program such as nmap (available at ). However, I am quite careful about under what circumstances I run any port scanner. In order to get information on what programs are running on what ports, you must run a port scanner in a mode that will probably convince the owner of the victim computer that you are a criminal. He or she may persuade your online service provider to cancel your account.

The other reason to analyze computers using telnet is that you learn more. It's the difference between eating at McDonalds and learning how to cook.

More on Telnet: the Number One Hacker Tool

A quick search of the Bugtraq archives at revealed horrid things a criminal could do to that Mercur mail server. Since I think it is more fun to be nice, I told someone at the company using this mail server about the problems. He invited me to vacation at his beautiful Swiss home, where he and his wife keep horses and take long trail rides in the Alps. Golly, that is much more fun than breaking into a computer!

Right about now some elite ueberhaxorz are probably reading this and saying "What a lamer Meinel is! We can do the same thing by running nmap."

They are right, you can learn the same things by running a port scanning program such as nmap (available at ). However, I am quite careful about under what circumstances I run any port scanner. In order to get information on what programs are running on what ports, you must run a port scanner in a mode that will probably convince the owner of the victim computer that you are a criminal. He or she may persuade your online service provider to cancel your account.

The other reason to analyze computers using telnet is that you learn more. It's the difference between eating at McDonalds and learning how to cook.

How to Break into Web Sites Using Telnet

You don't have to use a web browser to access files on a web site. All you need to do is:

telnet 80

Or specify port 80 in a Windows telnet.

If you are using Windows 95/98/NT, whenever you are NOT logging into a telnet account, you should enable local echo. Otherwise whatever you type in (unless you are in a telnet account) will not show on the screen. To enable local echo, click Terminal --> Preferences --> Local Echo.

So how do you send stuff back to the webserver? Try this:

GET / HTTP/1.0

What kinds of commands can you send? The book Hackproofing Your Network <../bookstore/general.shtml> (by Ryan Russell of Securityfocus.com and Stance Cunningham) suggests a fun and harmless hack. Create and store a bogus cookie in the location on your web browser that stores cookies. (Find it by searching for the file "cookies.txt".) Name your bogus cookie something like "MyBogusCookie." Then telnet to the victim webserver and give something like this command:

GET / HTTP/1.0
User-Agent: HaveABogusCookieThisIsAJoke 123.4
Cookie: /; MyBogusCookie

The Überhacker! -- How to Break into Computers <../uberhacker/index.shtml> book details a number of serious attacks you can perform through sending funny input to a webserver. Basically, you need to learn how to write shell programs, and then find ways to get them to be run by the webserver. I'm not going to explain them here, however. These attacks, when carried out against a vulnerable webserver, are so easy that little kids could do them, and I don't want to be responsible for their behavior. It's much harder for little kids to get a hold of Russell's and my books than it is for them to read this GTMHH on the Happy Hacker website.

So are you dying to know what to send a webserver in order to break into it, without having to buy a book? Here are some hints. How to do this will depend on what webserver it is, what operating system it runs on, whether its security weaknesses have been fixed, and whether the web designer has used things such as Common Gateway Interface (CGI) or Server Side Includes (SSIs) that have weaknesses in them.

You will have to research these issues at Web sites that archive vulnerabilities and exploits such as and . You will need to study web site programming (HTML -- hypertext markup language, CGI and SSIs) and shell programming. You will need to learn webserver commands (documented at ). You will have to use your brain and be persistent.

But at least if you come across a telnet exploit, now you know the answer to the question "where do I type that command?"

frostwire, descargar ares, ares

Read More

How To: Change Your Ip In Less Then 1 Minute

1. Click on "Start" in the bottom left hand corner of screen
2. Click on "Run"
3. Type in "command" and hit ok

You should now be at an MSDOS prompt screen.

4. Type "ipconfig /release" just like that, and hit "enter"
5. Type "exit" and leave the prompt
6. Right-click on "Network Places" or "My Network Places" on your desktop.
7. Click on "properties"

You should now be on a screen with something titled "Local Area Connection", or something close to that, and, if you have a network hooked up, all of your other networks.

8. Right click on "Local Area Connection" and click "properties"
9. Double-click on the "Internet Protocol (TCP/IP)" from the list under the "General" tab
10. Click on "Use the following IP address" under the "General" tab
11. Create an IP address (It doesn't matter what it is. I just type 1 and 2 until i fill the area up).
12. Press "Tab" and it should automatically fill in the "Subnet Mask" section with default numbers.
13. Hit the "Ok" button here
14. Hit the "Ok" button again

You should now be back to the "Local Area Connection" screen.

15. Right-click back on "Local Area Connection" and go to properties again.
16. Go back to the "TCP/IP" settings
17. This time, select "Obtain an IP address automatically"
tongue.gif 18. Hit "Ok"
19. Hit "Ok" again
20. You now have a new IP address

With a little practice, you can easily get this process down to 15 seconds.

P.S:
This only changes your dynamic IP address, not your ISP/IP address. If you plan on hacking a website with this trick be extremely careful, because if they try a little, they can trace it back

Read More

Network monitoring Tools

Featured Tool: Ping Plotter Ping Plotter is a marvelous tool that pings and graphs an endpoint and all hops in between. It can be useful in troubleshooting packet loss and latency. What is unique about Ping Plotter is it can identify current problems but can also be watchful of new issues that occur. The current version has multiple alert instances and is capable of sending e-mail, logging to a text file, or playing a wav file for specified parameters.
Another is feature is the graphical representation of packet loss and/or latency. You can see the results over any specified time period. Besides the visual graph inside of Ping Plotter, you can export either raw data or have a screen shots saved at automatic time intervals. All ping intervals are completely customizable and any hop can be graphed along with the endpoint.
The Ping Plotter website includes a tutorials and documentation on interpreting the results. There is also a support forum for the product. Ping Plotter is a very affordable at $15 and is available as a 30 day trial. Several websites that rate shareware have given Ping Plotter high marks. It also received an honorable mention in MCP Magazine. Users at Broadband Reports frequently use Ping Plotter to located poor DSL or Cable connections. Gamers are also concerned packet loss and latency and will find this tool invaluable. The beta version of Ping Plotter will be adding more features and better performance.
In our testing, we used Ping Plotter to ping watch the connection to a low traffic website on the end if a dedicated T1. The time interval was set to 1 minute as not to flood the hops or endpoint with packets. The display interval was set for one hour and an image was automatically saved each hour showing the results graphically. The captured results were surprising to say the least. While the cable connection is very good, it isn't perfect. Future plans will include using Ping Plotter with an FTP program to automatically upload the hourly results for everyone to view.

Ping Tools

Free Ping - This IP ping software tool allows for visual notification along with Windows Pop Ups to notify you of a downed device.

Windows Status Network Reporting Tool - Simple to configure monitoring tool that provides a webpage of device status. Lacks any alerting features but does run as a Windows NT/2000/XP service.
Servers Alive - Fully mature commercial product that can monitor devices, NT Services and performance counters and includes Netware monitoring. Runs as a service on Windows NT/2000/XP, web interface and multiple alerting capabilities. Free for 10 devices. <$$>
IP Sentry - Runs as a Windows NT/2000/XP/2003 service or network monitoring software package. Web interface, monitors Windows shares and services. Lots of optional plug ins. Free for 2 devices. <$$ - $$$>
WhatsUp - The standard against all others are judged. Full package of monitoring and alerting capabilities. Can monitor services, web pages, up/down dependencies, and runs as a service on Windows NT/2000/XP. It has a web interface that includes multiple levels of security. WhatsUp FT Premium adds Fault Tolerance and application monitoring for Microsoft Exchange and Microsoft SQL Servers to good old WhatsUp Gold. WhatsUp Professional suits larger networks.<$$$>

Network Sniffers

Wireshark - Network protocol analyzer (successor to Ethereal). Free does not mean a product is lacking in features or maturity. This is a full feature packet sniffer that can be used capture traffic in real time and identify everything behind the scenes in network traffic. Filtering, DNS resolution of clients and select between TCP/UDP/ICMP traffic.
Show Traffic - Real-time network traffic sniffer on any given interface. Resolves names to IP addresses. Can be used to identify unwanted traffic. It does not capture traffic for later analysis.
Network Probe - Network monitor and protocol analyzer. Unbelievable tool to identify almost any specific network traffic including peer to peer applications and instant messaging software. Filter by hosts per protocol. You will be surprised at the traffic types on your network.
Web Log Analyzers
IIS Log File Analyzer - Simple interface and reporting capabilities provide information such as number of visitors, NS Lookups of visitors, simple filter, and referrers.
Web Log Expert (Full & Lite) - Support for IIS and Apache Logs. Both versions can identify referring traffic, entry page, page stats, search engines, and traffic by the hour of the day and week. The full version can give detailed error reports, exit pages weekly and monthly traffic and much more detailed reporting and filtering.
Mach 5 Analyzer - This is a solid mature product that offers full reporting capabilities and exporting to Word, Excel, and HTML. Extensive filters and tracking and errors. Supports most log file formats. <$$>
Who's-On - Unlike traditional analyzers while report after the fact, this tool reports access in real time. Track visitors activity, set alerts for exceptions and undesirable traffic. This tool is both useful and addictive. Several versions available including one that runs as a service. Web interface for remote monitoring also available. <$$>
Miscellaneous Tools
CoolMon - This tool can provide information about your system in a transparent pane on your desktop. (My Desktop & Config File) There are a variety of scripts and extensions that do everything from gather the weather to create a webpage of multiple systems. (Think servers!)
VNC - Need to remote control a desktop across the room or across the world? This is a stable product that will run as a service or from a floppy and is available for almost any platform.
Event Sentry - Monitor Windows NT/2000/XP Event Logs with this tool that runs as a service. It send e-mail alerts of events specified by type (Warning, Information...) or as defined by the filter.
GFi LANguard Network Security Scanner - Identify security risks on you servers and workstations. Find unauthorized/unexpected services and shares. The product can be used to push patches and updates to equipment for the first 30 days and for a modest fee after thirty days. The scanning ability continues to work for free forever. <$$$>
Sysinternals - There are a wide variety of tools to assist in management or troubleshooting of Windows systems and servers. The tools are well respected with many of them free.
Directory & File Monitor - This small utility monitors files or directories for changes including add/deletion of files, renaming or attribute changes. Has the ability to log activity to a webpage. Excellent to monitor a server or workstation for unauthorized or malicious activity.
GFi LANguard System Integrity Monitor - Monitor files for unauthorized or malicious activity. It runs as a service on Windows NT/2000/XP and can send e-mail alerts. It is an excellent way to protect your web server.
Who's On Proxy/ISA Server - If you has a Microsoft Proxy or ISA Server, watch the actual traffic in real time. See where your users are visiting at any given moment. Web interface for remote monitoring. <$$>
Netbotz/Rackbotz - Hardware devices to monitor critical system areas. Besides security cameras that can detect motion, there are sensors for sound (fire alarm), moisture, temperature, and airflow. These can be a lifesaver for mission critical equipment. <$$$$>
Helper Applications
Hermes Mail Server - Excellent SMTP/POP3 mail server that can be used to relay alerts from your network monitoring station or tools. The source code is included. It can run as a service on Windows NT/2000/XP.
VNC - Remote control of almost any desktop from anywhere. VNC (Virtual Network Computing) allows you to view and interact with one computer (the "server") using a simple program (the "viewer") on another computer anywhere on the Internet. The software is open source and has been ported to almost any platform ever used. VNC runs a service on Windows NT/2000/XP.
Network Notepad - It should come as no surprise that proper network diagrams are an important tool in monitoring your network. Network Notepad is a freeware alternative to more expensive diagramming programs. Network Notepad is a program for creating interactive network diagrams with user definable management features such as point and click telnet

Read More

How To perform Anonymous Port scanning using Nmap and Tor

Tor is a network of virtual tunnels that allows people and groups to improve their privacy and security on the Web. It also permits developers / researchers to generate new communication tools with built-in privacy features. Tor provides the foundation for a range of applications that permit organizations and individuals to share information over public networks without compromising their privacy

The Onion Router [TOR] is an excellent work towards defending online privacy. As of with every debate about exploitation frameworks, security tools, vulnerability disclosures such projects have also been victim of criticism, and debates of potential abuse that they may cause and the dangers of teaching individuals a dangerous and potentially illegal craft and a ‘secure’ channel to hide their online presence. But lets face it, the bad guys already know about it (that is the reason they’re bad ‘eh). However although these channels of misuse and abuse do exist and they cannot be ignored, still the merits of it will always outweigh the harm black community may cause.

Regrettably in the country I live in even most of the senior know-how people I meet / see / have a chance to work with, don’t even have a clue of online privacy or security of their information.

Privacy is every individuals right, and is as important as any other basic human need. You will seldom require somebody tracking your IP, spywares tracing your network activity, and the next time you try to experiment with something, you receive a disagreeable small e mail from an ISP admin that you were doing so-and-so. I am by no way TEMPTING you to do something wrong. Its all about your morale and motivation : ) , the small how-to below is a kick starter for getting started with TOR and experimenting with some stuff securely. Interested ? move on, but don’t go about emailing me that this stuff like this is illegal to be posted and ought to be removed.

The problem

A basic issue for the privacy minded is that the recipient of your communication / conversation or even otherwise can see that you sent it by taking a look at the IP headers, or worse trace the whole path. And so can authorized intermediaries like ISPs, govt. organizations etc, and sometimes unauthorized intermediaries as well. A very simple type of network traffic analysis might involve sitting somewhere between sender and recipient on the network (man-in-the-middle), taking a look at headers.

But there's also more powerful kinds of packet analysis. Some attackers spy on multiple parts of the Web and use sophisticated statistical techniques to track the communications patterns of plenty of different organizations and individuals. Encryption does not help against these attackers, since it only hides the content of Web traffic, not the headers (VPN ? duh!!) .

The solution:
A distributed, anonymous, secure network

To reduce the risks of both simple and sophisticated traffic analysis by distributing your web traffic over several places / servers, so no single point can link you to your location helps defending your privacy. Its like taking a zig-zag random, hard to follow path to deceive somebody who is tracing you (what the heroes usually do against the villain in action films : ) ) , then periodically erasing your footprints. In lieu of taking a direct route from source to location, information packets on TOR take a random pathway through several servers that cover your tracks so no observer at any single point can tell where the information came from or where it is going.

TOR incrementally builds a circuit of encrypted connections through servers on the network which is extended one hop at a time, and each server along the way knows only which server gave it information and which server it is giving information to. No individual server ever knows the whole path that a knowledge packet has taken. The client negotiates a separate set of encryption keys for each hop along the circuit to make positive that each hop cannot trace these connections as they pass through.

Two times a circuit has been established any information can be exchanged and because each server sees no over one hop in the circuit, neither an eavesdropper nor a compromised server can use traffic analysis to link the connection's source and location.

Tor only works for TCP streams and can be used by any application with SOCKS support.

to experiment and write this small how-to, I setup a server on the Web that I desired to scan from my home network using Nmap, Nessus, and metasploit from my bacttrack suite installed in a VM. Here are the steps I followed to launch the scan / exploitation method by Tor:

A. Installing TOR: Detailed instructions can be viewed on the net site.

B) Download socat .This gizmo is an excellent multipurpose relay and will permit to setup a local TCP listener that will tunnel my connections by the Tor SOCKS server (listening on 9050).

Unfortunately socat comes only on bsd and *nix systems. To make use of TOR on windows I would recommend using Privoxy, or better installing the whole TorCP bundle.

Let us assume that the IP address of the host I desired to scan was 202.163.97.20

I invoked socat:

[talha@localhost#] ./socat TCP4-LISTEN:8080,fork SOCKS4:127.0.0.1: 202.163.97.20:80, socksport=9050

The above command causes socat to listen on port 8080, and tunnel all incoming connections to 202.163.97.20 (port 80) by the Tor SOCKS server.

For using on windows you will need to:

1. Install privoxy
2. permit HTTP CONNECT requests by 80 through your firewall
3. Browse to http://config.privoxy.org/show-status

C. I assume Nmap, Nessus and metasploit are already installed and running. If not you can find the detailed instrucations on respective website.

D. Launch an nmap connect or nessus scan against 127.0.0.1 port 8080. Configure Nessus to limit the scan to port 8080 in the “Scan Options” tab.

Here are a quantity of the entries in my Apache log that were a result of the scan:
212.9.32.5 - - [10/Jul/2005:17:29:56 -0700] "GET /Agents/ HTTP/1.1" 404 205 "-" "Mozilla/4.75 [en] (X11, U; Nessus)"
212.9.32.5 - - [10/Jul/2005:17:29:56 -0700] "GET /cgi-bin/viewpic.php?id=7&conversation_id=&btopage=0 HTTP/1.1" 404 217 "-" "Mozilla/4.75 [en] (X11, U; Nessus)"
212.9.32.5 - - [10/Jul/2005:17:29:57 -0700] "GET /index.php?err=3&email= HTTP/1.1" 404 207 "-" "Mozilla/4.75 [en] (X11, U; Nessus)"
212.9.32.5 - - [10/Jul/2005:17:29:57 -0700] "GET /scripts/fom/fom.cgi?cmd=&file=1&keywords=nessus HTTP/1.1" 404 217 "-" "Mozilla/4.75 [en] (X11, U; Nessus)"
212.9.32.5 - - [10/Jul/2005:17:29:58 -0700] "GET /scripts/viewpic.php?id=7&conversation_id=&btopage=0 HTTP/1.1" 404 217 "-" "Mozilla/4.75 [en] (X11, U; Nessus)"
212.9.32.5 - - [10/Jul/2005:17:29:58 -0700] "GET /Album/ HTTP/1.1" 404 204 "-" "Mozilla/4.75 [en] (X11, U; Nessus)"
212.9.32.5 - - [10/Jul/2005:17:29:59 -0700] "GET /fom/fom.cgi?cmd=&file=1&keywords=nessus HTTP/1.1" 404 209 "-" "Mozilla/4.75 [en] (X11, U; Nessus)"
212.9.32.5 - - [10/Jul/2005:17:29:59 -0700] "GET /cgi-bin/wiki.pl? HTTP/1.1" 404 213 "-" "Mozilla/4.75 [en] (X11, U; Nessus)"
The 212.9.32.5 IP address represents the host that is the last onion router in the random circuit that was setup by the Tor program

Simlarly two times you discover a vuln in a remote technique, setup another instance of socat: Say for simplicity you are exploiting a webserver (port 80).

[talha@localhost#] ./socat TCP4-LISTEN:1234,fork SOCKS4:127.0.0.1: 202.163.97.20:80,

In metasploit when launching the exploit, set the target IP to 127.0.0.1 and remote port to 1234. Its that simple eh.

The above instructions may even be used to exploit program flaws in order to anonymously execute arbitrary commands on vulnerable hosts.

Some pieces of advice:

1. Nmap makes use of something that generates packets by the raw packet interface so the packets connect directly to the target, not by Tor. For example:
Doing a connect() scan (TCP) will work with Tor but using something like -sS connects directly to the target, revealing your true address.

2. Nmap & Nessus will often ping a target so see if it is up before doing a port scan. This is usually completed by raw ICMP packet's, ICMP won't traverse the Tor network (since its not TCP) and will reveal your true address.

In the usage of socat, socks4 does client side DNS. So you resolve a target host name by DNS from your machine not by the Tor network proxies.

Hence it is impossible to leak your source IP because you tell your scanner to make use of 127.0.0.1 as the target IP . Therefore, nmap / nessus has no host name to resolve, and in case you do forget to tell your scanner not to bother with ICMP pings, you will finish up pinging yourself – not the target directly.

Staying anonymous

Tor cannot solve all anonymity issues. It focuses only on defending the transport of information. You will need to make use of protocol-specific support program in case you don't require the sites you visit to see your identifying information. For example, you can use web proxies such as Privoxy and open relays while web browsing to block cookies and withhold information about your browser type ident.

Be clever. Don't provide your name or other revealing information in web forms. Be aware that, like all anonymizing networks that are fast for web browsing, Tor does not provide protection against end-to-end timing assaults: If your attacker can watch the traffic coming out of your computer, and also the traffic arriving at your selected location, they can use statistical analysis to discover that they are part of the same circuit.

The Electronic Privacy Information Centre (EPIC) lists down a comprehensive list which servers as a sampling of best available privacy enhancing tools.

Read More