Staying Anonymous On The Internet: The How To

Hello, everyone. As i said i would, here are a few ways in detail on how to maintain anonymity while on the internet.

As hackers, we want to be anonymous and hard to detect while doing our work. We therefore employ the help of several tools and procedures to help hide our identities.

USING TOR

In parrot the tor service comes installed in the system, but not so in Kali Linux. You can easily install it in your Linux distro by typing on the terminal:   
    apt install tor -y
To start using the tor service to route your traffic through a tor network, type:
    service tor start
You can check the status of the tor service by typing:
    service tor status

Also download the Tor Browser from the Tor website and make use of it.

It's advisable and recommended that you torrent and tor while on a non-root account if only to play it safe. However if you do insist on using tor on a root account (don't torrent
while on root unless its a legitimately trust-able site like https://www.kali.org/), by default Tor is usually disabled to run in root, but you can change that and enable it by changing a simple line of code.

In the Tor browser folder is a file called start-tor-browser.


Open the file and edit it from line 91.

Comment the following lines to enable tor browser to run as root on your system.

Use The Hidden Wiki to find sites to which you can access on the deep web using Tor browser.

USING PROXYCHAINS 

One way of remaining anonymous is by using an intermediary machine whose IP address will be left on the target system. A proxy server is a software system running on a computer and acts as an intermediary between two nodes, an end node of a client device and a node that is a server from which the client is requesting services from.

Thus by connecting through a proxy, the IP address of the proxy is seen rather than the client's actual IP address.

In Kali Linux and much of penetration testing based systems such as Parrot Sec and BlackArch Linux, is a built-in anonymity tool called Proxychains.

By using proxychains, you will anonymize all foot-printing traffic, covering your tracks and you could also use Tor and proxy-chains together. Proxychains is even capable of doing DNS resolution through proxy. It can handle any TCP client application, i.e. nmap, telnet.

Proxy-chains gives the ability to route traffic through several proxy servers, thereby hiding behind them or having them forward your requests/queries so that it appears as if traffic originates from them not from you.

To install proxy-chains in your Linux system, type:
    apt install proxychains

To do a bit of configuration, open the proxychains.conf file for editing in your desirable text editor.
    /etc/proxychains.conf

After a little configuration, we need to add a list of proxy servers. There are free but unstable proxy servers out there, but i don't recommended them for tasks such as brute-forcing and mass scanning mainly because of the instability they have and their slowness.

There are types of proxies: HTTP, SOCKS4 AND SOCKS5: each having with their own fundamental differences.

Types Of Proxies that Proxychains Supports

The best possible one to best anonymise traffic is SOCKS5. HTTP is for http traffic. SOCKS4 is very similar to SOCKS5 but can be limiting and rather problematic as it doesn't support IPv6 protocol and UDP protocol.

In that file are several terms to consider: dynamic_chain, random_chain, strict_chain. These terms are for setting how we want traffic to be routed. The best, dynamic_chain policy is more stable as you can access any site even when using only one proxy server which is functional and working, well, at least if you are using free proxies that is the condition that can sometimes occur. However, if you are using paid proxies, the strict policy will work just fine since you can be assured all the proxies will be up and functional unlike in free proxies where some may fail.

Point of consideration is that by having subscribed for the paid for proxy servers kind of diminishes your anonymity since you have to use a mode of payment for the service and you will be in the records of paying users/clients. That can compromise your anonymity. 
 
All proxies will be chained in the order as they appear in the list, i.e. connections are done via chained proxies. Using the strict_chain policy, traffic will have to go through all proxy servers sequentially e.g. A to B to C to D and to E. 

However, in dynamic_chain policy, traffic can pass through either or one e.g. through B to E to D, or through C only and so on depending on conditions of the servers. Traffic is routed through the alive servers and the dead ones are skipped automatically without throwing exceptions.
Its far simpler to use dynamic_chains. Again, in order to route proxy traffic through tor network, you must enable dynamic_chain. It's highly unlikely to work in strict_chain policy due to tor nodes.
 
In the proxychains.conf file, do the following editing:
Uncomment the line beginning as: #dynamic_chain so that it now begins as: dynamic_chain.
Then comment the line beginning as: #strict_chain lines so that it now reads strict_chain.
(comment by adding '#' and uncomment by removing the '#' at the beginning of the of the line)

The other policies
#random_chain, allows you to connect to a different random proxy during each specified connection e.g. after every packet sent e.t.c. By randomly choosing IP addresses from our list, the chain of proxy will look different to the target, making it harder to track our traffic from its source. It's like resetting your IP address with every connection.
You may also want to uncomment the line with “chain_len”. This option will determine how many of the IP addresses in your chain will be used in creating your random proxy chain.

There's another line that reads as follows:
#Proxy DNS requests - no leak for DNS data
proxy_dns

This one helps to prevent DNS data leakage. It might slow you down but it's worth it. DNS server helps in resolving domains to IP addresses and vice versa. On your local computer, the DNS server of your ISP does so. A DNS leak will occur the local IP address of DNS server of your ISP is known, which can be used to expose you.

Formats for entering Proxies
First column represents the type of proxy, 2nd column the IP address of the proxy-server, 3rd column the port to listen on and for some proxy servers, it is included in the 4th and 5th columns the usernames and passwords respectively.

Proxy Formats

By default proxychains directly sends the traffic first through our host at 127.0.0.1 on port 9050 which by default is the address Tor listens to.

Tor by default listens to address 127.0.0.1 at port 9050.

If you are not using Tor, then you may need to comment out these lines.

If you are using Tor, then leave the lines as they are or you may add this line if you are missing the SOCKS5 proxy type:
    socks5    127.0.0.1    9050

We have used a loopback address (127.0.0.1)  which is used for inter device communication.

We are now almost gaining the level of anonymity needed to begin anonymous surfing and browsing on the internet.
Thereafter to check for Tor's status, type:
    service tor status
If it's not running type to start it:
    service tor start

Now to use proxy-chains in combination with tor and our local browser, remember to configure - by verifying proxy-chains settings. Type:
    proxychains firefox www.duckduckgo.com

Loading time may be slow. I f it does eventually load, then it working perfectly.

I like using DuckDuckGo as they help maintain your anonymity. They don't record your IP address or traffic. This is a far greater level of anonymity compared to google, bing and others.

I would also wish to check for DNS leaks just to confirm completely that i am anonymous to the best extent.
On the search bar type:
    Online checking for DNS leaks 
 
Choose a site that offers a DNS leak test such as https://dnsleaktest.com/. Confirm that your Public IP address they display to you doesn't show you your real IP address and location. Your IP address will change from time to time. If the IP address and location are wrong, then you are very well anonymous.

You can also use proxy-chains with nmap much like you did with your local browser such as firefox. To enable proxychains service when performing certain jobs just precede your job by starting with the word proxychains e.g.
        proxychains nmap 192.168.1.1/24
 
Importing Custom Chains of Proxy
 
In the search bar, type:
    free SOCKS5 proxies
or:
    free SOCKS5 proxy server list
 
Choose a site that lists several free SOCKS5 proxies that can be issued for free e.g. https://www.socks-proxy.net/ or NordVPN's free proxy service.

Find proxy addresses in countries with fantastic privacy policies e.g Netherlands, Germany e.t.c.

Input the addresses and the corresponding ports they will be listening to in the /etc/proxychians.conf file as in:
socks5    216.8.240.194    33169   
...


Continue that way filling in for as many proxies as you want. From experience half of these proxies may not work, and many will give timeout responses. It'll also be quite slow. One needs to keep it low in terms of proxies depending on their speed. Use at least 2 or a maximum of 3. Stick with the ones with great reviews and uptimes too and from countries with great privacy policies.

By now, you have achieved a great level of anonymity to cover your identity and stay anonymous without worrying about being detected by target IDS or forensic investigators, and you may now use internet services through proxy-chains e.g. proxychians firefox www.duckduckgo.com

 

SPOOFING MAC ADDRESS

Spoofing/changing your MAC address will help maintain your anonymity especially on a LAN network. For this method, we use the tool macchanger which comes pre-installed in Kali Linux and many other Linux distros e,g Parrot Sec OS.
Macchanger is a GNU/Linux utility for viewing/manipulating MAC address for network interfaces.
In order to change the MAC address, one must first bring down the network interface.

Use ifconfig to know which network interfaces are up and operational on your system.

Network Interfaces

If it's on a WLAN I'll use interface wlan0 and eth0 for ethernet.

Bringing down my interface:
    ifconfig wlan0 down

I can decide to do a number of things to the MAC address:
1. Setting the MAC address of a random vendor, either:
    macchanger -a wlan0
    macchanger -A wlan0

2. Set a fully random MAC address:
    macchanger -r wlan0

3. Set fully random MAC address but pretend to be a burned-in-address:
    macchanger -r -b wlan0

4. To choose the MAC to use:
    macchanger -m xx:xx:xx:xx:xx:xx wlan0

Plus other options you may wish to go with, i just thought these were the most relevant.
    ifconfig wlan0 up

If you wish to revert the MAC address to its original permanent MAC address, type:
    macchanger -p wlan0

 

ANONSURF

Anonsurf, initially built for Parrot Sec Linux OS, has been ported to work with Kali Linux. It may work with any debian or ubuntu system, but this has only been tested to work on a kali-rolling amd64 system. Anonsurf will anonymize the entire system under TOR using IPTables. It will also allow you to start and stop i2p as well.
You can get it from github. To get it from github, clone the repository using the url https://github.com/Und3rf10w/kali-anonsurf.git.
Just type in from the terminal:
    git clone https://github.com/Und3rf10w/kali-anonsurf.git

The repo usually contains the sources of both the anonsurf and pandora packages from ParrotSec combined into one.

Pandora:
Pandora automatically overwrites the RAM when the system is shutting down. The usage for the Pandora module is easy and can be done manually.
Pandora can also be ran manually:
```bash
pandora bomb
```
NOTE: This will clear the entire system cache, including active SSH tunnels or sessions.

Having downloaded it from github, go to its directory:
    cd kali-anonsurf

You should find an installer.sh file. Give the file executable permission:
    chmod +x installer.sh

Things are easy from here onwards as you now just have to run it:
    ./installer.sh

Once installation is complete, you'll now be able to use the anonsurf modules.

To start the system-wide anonymous tunnelling under TOR proxy through iptables, type:
    ananosurf start
To stop the service, resetting the original iptables settings and returning to clear navigation, type:
    anonsurf stop
To combine both the "start" and "stop" options, type:
    anonsurf restart
To change identity, restarting TOR, type:
    anonsurf change
To get the status and working response of anonsurf, type:
    anonsurf status

 

USING VPNBOOK

Vpnbook is a free VPN service that is very popular among Kali Linux users especially. It's like the major and most popular vpn used.
Access the service by first going to the site: www.vpnbook.com
Go to the Free VPN page and from there you should see several configuration files either from the countries: Germany, USA, Canada or France. Download the configuration files from the country which you desire.
On the same page check out some username and password credentials we'll use to activate the service and use the vpn.
Extract the files and save them in a directory.

You will now connect to the VPN via a terminal or simply import the files to network-manager. I'll go the terminal way.

Configuring the VPN service, type:
    openvpn --config vpnbook-us2-tcp443.ovpn
 
This may not withstand a DNS leak test. It'll have finished the whole process when in the terminal you get the message:
Initialiation sequence completed

To use the service again at you own time, you just have to be typing:
    openvpn vpnbook-us2-tcp443.ovpn
    input username as vpnbook
    input password as you got it from the vpnbook.com website.

Password changes occasionally, so be sure to confirm from the site the current password always. Other than the tcp443 option for https traffic, there's also the option for http traffic through the tcp80 option as:
    openvpn vpnbook-us2-tcp80.ovpn
 
There are also options for UDP traffic at ports 53 and 25000.

To take care of DNS leak which can occur, open the file /etc/resolv.conf to edit it:
    nano /etc/resolv.conf
 
This file is usually generated by network-manager by default.

Resolving the IP

The IP address there is the private IP on LAN. However, we don't want the computer using the ISP's DNS server. It is usually the IP of the router which will then forward DNS requests to the ISP which can be traced back to you finding your location.


In your browser, type:
    opendns.com     
It should take you to: https://www.opendns.com/

Go to that site. opendns.com
 
Click on DNS to go to the DNS page, then copy the completely free IP addresses displayed and paste them onto the resolv.conf file as:

    nameserver xxx:xxx:xxx:xxx
    nameserver xxx:xxx:xxx:xxx

Nameserver IP addresses

 
We use two nameservers so that if connections can't go through the first nameserver then, it can always fall back towards the second. You can also use google's dns servers with IP addresses as: 8.8.8.8 and 8.8.4.4

After this don't dare restart network-manager since it will preload the file once again and you'll be stuck with the dns servers of your ISP server's.
Do a DNS leak test just to confirm everything, you should get a false public IP, wrong location and even the DNS server shouldn't reveal an ISP DNS server from your country.

 

TIPS TO BETTER ANONYMITY

Never use your personal contact information while pentesting or hacking i.e. opening an email account or any other social networking account that you own.

Change or spoof mac address constantly daily and severally per day or whenever you begin pentesting.

Keep a regular check on the visibility of MAC Address.