[Boomslang]

Hello all!
Recently, I'm seeing all those threads like "shitloads of proxy lists" etc and that is just not right. So I decided to write a thread about my way.

You know about "Harry's Code" from Dexter. You don't? Well you should! It is a sequence of rules followed by a serial killer in the series to kill without getting caught.



So here are my set of rules;

1) Don't Get Caught!

Proxies
Do you think all those proxies will make you an uber anonymous? Well, you know what? It doesn't!
I can't describe how easy is logging your traffic flowing through proxy. And that is even not the worse. Your traffic can literally be manipulated by that server. That means you can actually get infected by malicious Javascript while trying to be anonymous!

Availability: Hell No!

TOR
So you think TOR is a magic rod that can hide you from aaall the feds? Feds ain't that stupid. They have methods to display and modify all of your content. But it is still useable. I won't explain the details in this thread. Go fudging use Google.

Availability: Medium

VPN
Why do you even considering this? You're basically using their gateway to connect internet. Their gateway, their rulez. Also the ones that you pay for are already keeping logs.

Availability: Hell No!

Lets continue to the next step.

2) Never make a scene

Make sure to not to leave any evidence. Buy a used/stolen laptop (use cash!). It is important that device wouldn't be traced back to you. Install an OS on Micro SD card for the usage of this kind of activity. Also make sure that you encrypted the drive. Why Micro SD? Its easy to use, easy to hide, easy to destroy. Make sure that you don't use any social networks or that kind of stuff on that laptop.

Installing OS on Micro SD: http://cubox-i.com/install-os-on-micro-sd-flash-card/

Also you'll need a remote server with kernel level (unauthorized) access to connect TOR through it. Plant a rootkit to the server so you could easily manipulate logs and wipe the HDD if necessary. The route you should follow is like this;

Hacking device > (Encrypted line) > Evil Server > Tor

3) Don't do any attack

When you planned your attack scenario thoroughly, don't do it.
Not joking. Let your Evil Server do it for you. Write a timed script which will attack the target for you in a specific time (like one day later after executed). So you can actually be in another place (like a café) when attacking is realized and bring that in as a proof.

4) Don't use your own network for hacking

Always use public networks (ex: starbucks) while doing your stuff. Try to choose places without cameras. Otherwise, you can make an "invisible mask" to hide your face against cameras.

Invisible Mask: http://www.youtube.com/watch?v=jOH9XhsP3iI

5) Always do cleaning after your job is done

Don't forget to clean logs on Evil Server and your hacking device after finishing your job.

I hope you like this thread.

Au Revoir...

[Snipa]

Great and unusual thread :Thumbs-Up:

Don't even know who Harry is, but i enjoyed reading :epic:

[Ligeti]

Good job as usual

I liked the invisible mask video as well, I think in UK people need to use that more often

Thanks again mate

[chmod]

That's an interesting new spin on a topic that's been done a lot, well done.

@Ligeti that mask looks like it would be really uncomfortable and would you not see the LED's poking out? not the light as that's beyond our range ov vision but the actual LED's.

Also why the UK?

[dropzon3]

So you think TOR is a magic rod that can hide you from aaall the feds? Feds ain't that stupid. They have methods to display and modify all of your content. But it is still useable. I won't explain the details in this thread. Go fudging use Google.

Just to add, you can easily log and manipulate traffic going through tor(like the issues with proxies), and you are under the 'rulez' of your exit node for tor. The only issues you've raised for Tor/Proxies/VPNs are generic enough to impact all three.

Also install an encrypted hacking OS on Micro SD card.

Really now...an 'encrypted hacking os'

Not just any old OS that you're familiar with or that you can do the job...nope a hacking os, and make sure the os is encrypted. What the actual fuck?

Drive encryption should be done yes but that is separate from the operating system install. Why a hacking os, whats wrong with FreeBSD, Ubuntu, Gentoo, etc? Which hacking os what if it doesn't have the tool I need...oh wait later on you tell us not to actually do any attack instead have your evil server do it...so why do we need a hacking os at all if we are not doing any hacking from it.

As for the MicroSD suggestion, problem is you need a machine that will even boot MicroSD; making a bootable one isn't hard but your machine needs to be able to boot it.

Just throw the SD card into Hydrochloric acid to destroy.

Good luck...hydrochloric acid won't do the job it is however sometimes used for part of the processes of decapping chips so you'd just be doing them a favor.

Write a timed script which will attack the target for you in a specific time (like one day later after executed).

Why do we even need a 'hacking os' if we are doing everything from another machine? Besides that you've never done this have you? There are too many variables in most cases to automate everything. I mean sure you write an exploit script to launch that can be roughly automated and made portable okay but how do you know what to attack, or how did you find the vuln in the first place or is that to be scripted also?

Lets say you've done it though, automated discovery and exploitation now you need to deal with post-exploitation which is in a real hack the most important thing. How exactly are you automating this? How are you finding all the log files to automatically clear (only specific entries ofc) what if log files are not in the default location? What if there is extra logging? What if your exploit only landed you into an unprivileged shell and you yet need to escalate before being able to do anything?

Sure you might be able to automate some lame websploit for a defacement or something but that's kids stuff. How exactly do you expect to automate a real hack?

EDIT:

Hacking device > (Encrypted line) > Evil Server > Tor

You've stated that this evil server is one you have unauthorized access to...are you sure you should be connecting directly to it, seems like a pretty stupid idea to me.

[Inori]

Another damn good thread, my friend! Keep it up!

[The Real Slim Shady]

So you think TOR is a magic rod that can hide you from aaall the feds? Feds ain't that stupid. They have methods to display and modify all of your content. But it is still useable. I won't explain the details in this thread. Go fudging use Google.

Just to add, you can easily log and manipulate traffic going through tor(like the issues with proxies), and you are under the 'rulez' of your exit node for tor. THe only issues you've raised for Tor/Proxies/VPNs are generic enough to impact all three.

Also install an encrypted hacking OS on Micro SD card.

Really now...an 'encrypted hacking os'

Not just any old OS that you're familiar with or that you can do the job...nope a hacking os, and make sure teh os is encrypted. What the actual fuck?

Driver encryption should be done yes but that is separate from the operating system install. Why a hacking os, whats wrong with FreeBSD, Ubuntu, Gentoo, etc? Which hacking os what if it doesn't have the tool I need...oh wait later on you tell us not to actually do any attack instead have your evil server do it...so why do we need a hacking os at all if we are not doing any hacking from it.

As for the MicroSD suggestion, problem is you need a machine that will even boot MicroSD; making a bootable one isn't hard but your machine needs to be able to boot it.

Just throw the SD card into Hydrochloric acid to destroy.

Good luck...hydrochloric acid won't do the job it is however sometimes used for part of the processes of decapping chips so you'd just be doing them a favor.

Write a timed script which will attack the target for you in a specific time (like one day later after executed).

Why do we even need a 'hacking os' if we are doing everything from another machine? Besides that you've never done this have you? There are too many variables in most cases to automate everything. I mean sure you write an exploit script to launch that can be roughly automated and made portable okay but how do you know what to attack, or how did you find the vuln in the first place or is that to be scripted also?

Lets say you've done it though, automated discovery and exploitation now you need to deal with post-exploitation which is in a real hack the most important thing. How exactly are you automating this? How are you finding all the log files to automatically clear (only specific entries ofc) what if log files are not in the default location? What if there is extra logging? What if your exploit only landed you into an unprivileged shell and you yet need to escalate before being able to do anything?

Sure you might be able to automate some lame websploit for a defacement or something but that's kids stuff. How exactly do you expect to automate a real hack?

EDIT:

Hacking device > (Encrypted line) > Evil Server > Tor

You've stated that this evil server is one you have unauthorized access to...are you sure you should be connecting directly to it, seems like a pretty stupid idea to me.

I have to say... I agree with most of this.

[Boomslang]

@dropzon3
By 'hacking OS' I didn't mean Kali or BT, I mean an OS which will be used for such kind of activity. I think it is misunderstood so I'll change that expression. Thanks!

Do you have anything to suggest instead of Hydrochloric acid to properly destroy the chip? I'll gladly change that statement if you have a suggestion.

You have to do a direct connection at first anyway. What is wrong with choosing a remote server which I have full access instead of a paid server or TOR?

Thanks for pointing out those.

[Eleven]

Wow, this is in dept and it surprised me how bad proxy and vpns are...

[thewalker]

Hello all!
Recently, I'm seeing all those threads like "shitloads of proxy lists" etc and that is just not right. So I decided to write a thread about my way.

You know about "Harry's Code" from Dexter. You don't? Well you should! It is a sequence of rules followed by a serial killer in the series to kill without getting caught.



So here are my set of rules;

1) Don't Get Caught!

Proxies
Do you think all those proxies will make you an uber anonymous? Well, you know what? It doesn't!
I can't describe how easy is logging your traffic flowing through proxy. And that is even not the worse. Your traffic can literally be manipulated by that server. That means you can actually get infected by malicious Javascript while trying to be anonymous!

Availability: Hell No!

TOR
So you think TOR is a magic rod that can hide you from aaall the feds? Feds ain't that stupid. They have methods to display and modify all of your content. But it is still useable. I won't explain the details in this thread. Go fudging use Google.

Availability: Medium

VPN
Why do you even considering this? You're basically using their gateway to connect internet. Their gateway, their rulez. Also the ones that you pay for are already keeping logs.

Availability: Hell No!

Lets continue to the next step.

2) Never make a scene

Make sure to not to leave any evidence. Buy a used/stolen laptop (use cash!). It is important that device wouldn't be traced back to you. Install an OS on Micro SD card for the usage of this kind of activity. Also make sure that you encrypted the drive. Why Micro SD? Its easy to use, easy to hide, easy to destroy. Make sure that you don't use any social networks or that kind of stuff on that laptop.

Installing OS on Micro SD: http://cubox-i.com/install-os-on-micro-sd-flash-card/

Also you'll need a remote server with kernel level (unauthorized) access to connect TOR through it. Plant a rootkit to the server so you could easily manipulate logs and wipe the HDD if necessary. The route you should follow is like this;

Hacking device > (Encrypted line) > Evil Server > Tor

3) Don't do any attack

When you planned your attack scenario thoroughly, don't do it.
Not joking. Let your Evil Server do it for you. Write a timed script which will attack the target for you in a specific time (like one day later after executed). So you can actually be in another place (like a café) when attacking is realized and bring that in as a proof.

4) Don't use your own network for hacking

Always use public networks (ex: starbucks) while doing your stuff. Try to choose places without cameras. Otherwise, you can make an "invisible mask" to hide your face against cameras.

Invisible Mask: http://www.youtube.com/watch?v=jOH9XhsP3iI

5) Always do cleaning after your job is done

Don't forget to clean logs on Evil Server and your hacking device after finishing your job.

I hope you like this thread.

Au Revoir...

Yes it is correct and is directly what I was looking for and the surpise that proxies have stopped being effective is not much of an surprise since they are used way to much. But it's not the end of the world,most of us fellow hackers have ways to make our own getaway.