Waraxe IT Security Portal

g0df4th3r · Advanced user

Here you will find answers for all your questions.

g0df4th3r · Advanced user

1. Whenever you request a web page, file or other resource from the Internet, your request carries information which can identify you personally. This information is available to the sites you visit, and can be matched to your real identity using your ISP's server logs.

2. An anonymous proxy server is simply a computer on the Internet which strips out these "identifiers" and replaces them with its own. A web site then sees your request as coming from the proxy server's IP address rather than your own. Result? Anonymity! Well, not quite...

3. There are still one or two problems. Firstly, some proxy servers do not do a very good job and still pass on your identity, and secondly, you can still be identified from the proxy server's own logs (if kept). On the plus side, at least you have made it more difficult for the Law Enforcement Agencies (LEA) or government snoopers to track you down, and why should they bother when there are so many idiots who take no precautions at all?

4. So what makes a good proxy? Well there are three important aspects. Firstly, the proxy server must be truly anonymous - for this we need a proxy usually referred to as Elite, Grade 1/2 or Grade A/A-. Secondly, because some countries are well known for co-operating with Western LEA, we need one in a "friendly" country - usually Far or Middle Eastern. Finally, we need a proxy which works at a fast speed.

5. If you are looking at or downloading "X rated(no pun)material", a good anonymous proxy server is your first line of defense. So how do you find a good anonymous proxy? The good news is that there are hundreds of sites on the web offering lists of anon proxies. You found this page right? Eagleproxy is a great start!

6. However if you find them, you will end up with a proxy address (or list of addresses) in the format Proxy IP Address Port: (eg: 202.34.191.200:8080). It is vital that you check your proxies personally, before you use them for surfing. However, whatever proxy has been tested by someone else, you need to know that it works for you! Proxies can change and their efficiency can vary according to your own location and configuration.

7. There are two ways to check an anon proxy. One of them is to load it into your browser - configuration settings vary between browsers, but somewhere in your browser's options you will find a setting which allows a proxy server. The other is to load one or more proxies into proxy checking software such as Proxy Checker (recommended) or AATools. Again a search engine will find these for you. Run the checking software, pick one which looks anonymous and fast, and load that into your browser.

8. Now to see if it works for you. You need to find a site on the web which offers a Proxy Judge script. In each case check the variables which are shown on the screen, and make sure that none of them points to your real IP address, only your proxy's IP address. Some Judges also rate your proxy's anonymity - look for a rating of A or A-, or 1 or 2.

9. If all has gone well, you now have a fast anonymous proxy and can get out onto the web. If not, you will need to load another proxy and try again. Be prepared to run this sequence each time you start a browsing session.

10. Here is a good example of a proxy judge's results:

Your Host Information
REMOTE_HOST 62.118.248.19
REMOTE_ADDR 62.118.248.19
USER_AGENT Apache/1.3.6 (Unix) mod_perl/1.21
FERER (none)
HTTPConnection Information
RWARDED (none)
FORWARDED_FOR (none)
A (none)
NNECTION Keep-Alive
_HOST (none)
CHE_INFO (none)
IENT_IP (none)
OKIE $1
Your IP or Proxy Server Name
62.118.248.19

REMOTE_HOST=62.118.248.19
REMOTE_ADDR=62.118.248.19

NNECTION=Keep-Alive
ST=p-jan.virtualave.net
ER_AGENT=Apache/1.3.6 (Unix) mod_perl/1.21

--------------------------------------------------------------------------------

REMOTE_HOST
Result
IP Addr.
Comment
I have no idea because DNS lookup failure.

HTTPEnv. Value
Result
NoProxy!
Comment
Like no proxy server.

AnonyLevel : 1

Good Luck!! Surf Safe!!

g0df4th3r · Advanced user

What is a SOCKS protocol?
--------------------------------------
SOCKS - A Firewall software that establishes a connection from inside a firewall to the outside when direct connection would otherwise be prevented by the firewall software or hardware (for example, the router configuration).

Socks 5.x
-----------------
SOCKS5.x is a protocol that relays TCP sessions at a firewall host to allow application users transparent access across the firewall.
Because the protocol is independent of application protocols, it can be used for many different services, such as telnet, ftp, finger, whois, gopher, WWW, etc.

When to use Socks5.x?
------------------------------
Socks5.x may also be used if the firewall blocks the bi-directional TCP connections, the program will communicate with its server but users will not be able to communicate between themselves.

If your firewall does not allow for open listening port, your program will work but the users will not be able to communicate with other users that are behind a firewall with the same configuration. This is where Socks5.x comes in. It is designed to open a listening port on the Socks.x server, and redirect users to the client computer, and redirect the TCP packets from the client computer to the Internet.

Access control can be applied at the beginning of each TCP session; thereafter the server simply relays the data between the client and the application server, incurring minimum processing overhead.

Socks 4.x
-----------------
SOCKS4.x is a protocol that relays TCP sessions at a firewall host to allow application users transparent access across the firewall.
Because the protocol is independent of application protocols, it can be used for many different services, such as telnet, ftp, finger, whois, gopher, WWW, etc.

Access control can be applied at the beginning of each TCP session; thereafter the server simply relays the data between the client and the application server,
incurring minimum processing overhead.

When to use Socks4.x?
------------------------------
Socks4.x may be used if your firewall blocks bi-directional TCP packets or does not allow an opened listening port. Socks4.x. may also be used if the firewall blocks the bi-directional TCP connections, the program will communicate with its server but users will not be able to communicate between themselves.

If your firewall does not allow for an open listening port, the program will work but users will not be able to communicate with other users that are behind a firewall with the same configuration. This is where Socks4.x comes in. It is designed to open a listening port on the Socks server, and redirect users to the client computer, and redirect the TCP packets from the client computer to the Internet.

Important:
----------------------
-The Socks4.x.server must have the ability to communicate with the Internet and your LAN freely, including the ability to open listening TCP port. In most cases this type of server has more than one LAN interface, one of them to the Internet, the others to the LAN. Your Socks server will behave as a gateway to the Internet.

-The main difference between Socks4.x and Socks5.x is that Socks5.x offers more features such as in the area of security, ftp and more.

g0df4th3r · Advanced user

Using proxies (the basics for noobs)
i don?t know author , as you can see writed in 2003.
1. Introduction
2. Just a number?
3. What is a proxy server?
4. Why use one?
5. Proxy Types
6. Steps for Finding an Anonymous Proxy
7. Where to find a Proxy List
8. Where To Test Your Proxy for Anonymity
9. Where to Check The Proxy Server's Country
10. How to configure one in your browser
11. Obscuring a Proxy URL
12. Additional Security
13. Resources

1. Introduction:
This is intended as a summary of proxy basics. A reminder as to why its required. Anonymity is needed because there are people who surf the net looking for other people's ip address or url name so they can then publicly malign them by finding their "true" identity and telling the world this person eats spam or likes to watch the grass grow, or in the case of an Advertising Corporation which will sell your identity to some retailer like WalMart. So some basic precautions that you need to take to avoid this are: using a proxy, disabling all cookie options, java, active-x, and all scripting options in your internet browser, print and file sharing in NetBios, and also installing a firewall. The following text attempts to be a summary of those basic methods by which you can anonymously communicate with other like minded persons.
------------------------------------------------------------------------
2. Just a number? :
Before you can understand how best to protect your privacy, it's helpful to know just what information you're generating when you connect to the net, and how easy this is to trace.

At the very lowest level, when you connect to a website it will receive a record of your IP address - the unique number that indicates which computer you're using. If you use an ISP like Demon, that gives you a fixed address, that's enough to pinpoint your account. With a dynamic address, it'll pinpoint the modem line you connected to. Finding out which customer was using that line means matching up a time with the records from the computers that handle your login. On a busy system, that could mean finding one from tens of thousands of entries, but it can be done. This is how the police were able to track the source of the Love Bug virus to a dialup account used by a group of students in the Philippines. Some systems, such as AOL, might share an IP address between more than one user. The same is true of some corporate gateways to the net; but even so, there will usually be a way to work back to a specific system, even if it involves trawling through pages of log files. One way of hiding these sites is to go via a proxy, making the address that appears in the web server's logs that of the proxy server. Of course, all that's really doing is adding another link to the chain, since the proxy server will have a record of what you're asking it to do. But with the Proxy Server resident in a foreign country this is time consuming, probably not practicable and faced with proxy chaining, most will just give up. This is also what makes proxy servers a useful tool for those who want to see what you're up to. Even though you may not think your web requests are going through one, many internet service providers (ISPs) use so-called 'forced proxying'. This means that all web requests are routed via a transparent proxy. You don't need to change any settings in your browser, but the effect is the same. For an organization or country that wants to control and monitor what people are seeing on the web, it's ideal.

Thoughts regarding the use of system logs as evidence: Log files make crap evidence, for a start they're easily forged, and you're reliant upon computer generated evidence. What jury will believe a computer over a human? At best log files are supporting evidence, in most cases they only show logins, connections and other impersonal evidence, no log can say BEYOND REASONABLE DOUBT that someone did something, they only say this machine number connected at this time, it don't say anything about the identity of the person. If in doubt, deny everything, after all its the job of the prosecution to prove you are guilty of some misdemeanor.
------------------------------------------------------------------------
3. What is a proxy server:-
A Proxy Server is a firewall and cache server. It can allow an entire network of computers to access the internet(http or ftp) with a single IP. it can act as a kind of filter for that network. Let's say you have 3 computers in some small network in japan going through a proxy server, schematically it looks like this.

1. ------->|
2. ------->|Proxy Server ----> The Web Site
3. ------->|

If you are at home with internet access through your ISP, this is what your connection looks like :
(PC)------>Your ISP ----> The Web Site
If the proxy server in the network above allows other users to use it we can do this :
(PC)------->Your ISP ---->Proxy Server ----> The Web Site
From the above diagram we can go through the proxy server and hide our real ip address or url name! The Web Site will only see the ip address or url name of the proxy server and NOT that of your isp, thereby making you anonymous!
------------------------------------------------------------------------
4. Why Use One:-

* To act as a security firewall or ip filter.
* To reduce the network load by caching commonly requested pages.
* To translate the material into another language.
* To improve access speed for users, achieved by caching.

Our interest lies in the first option i.e. becoming anonymous and Surfing Safe It isn't guaranteed that simply by using a proxy you will be anonymous. Some proxy servers will forward your real ip at random intervals others do it by default, others do by request from the web site that you visit. This makes it necessary to test your proxy for anonymous status at a Proxy Checking site. These sites will allow you to test the information or headers that are passed from the proxy server to the web site, careful inspection of these will allow you to decide just how anonymous you really are. An example header is:
HTTP_USER_AGENT: IE5 WIN2000which tells the site your browser and operating system type. So once you enter a website, and click any one of the files on the webserver, the website owners can find out these items of information about you, and much more:

1. Your IP Address.
2. Your hostname.
3. Your continent.
4. Your country.
5. Your city.
6. Your web browser.
7. Your Operating System.
8. Your screen resolution.
9. Your screen colors.
10. The previous URL you visited.
11. Your ISP.
------------------------------------------------------------------------
5. Proxy Types:-
The two most commonly used proxy types are http and socks each uses the common ports 8080, 1080 respectively. http proxies are for use with your browser. Socks which is a valid proxy alternative allows you sockisfy http, ftp, telnet, nntp, and common chat protocols similar to icq, hotline.
------------------------------------------------------------------------
6. Steps for Finding an Anonymous Proxy:-

Step 1. Find a List of Proxies
Step 2. Check the Proxies for Anonymity
Step 3. Check the Proxy Server's Country
Change your proxy regularly, else you leave yourself open to relationship analysis. Accomplished by comparing Referer, Site Location, and your current proxy, along with all the other visitors. If you keep your proxy long enough the logs may be hacked or made available to some interested 3rd party.
------------------------------------------------------------------------
8. Where To Test Your Proxy for Anonymity:-
Go to one of these sites, even more than one to double check, read the environment variables, look for the ip address or url name. If you see your ip number then you are not anonymous!

http://leader.ru/secure/who.html
http://www.all-nettools.com/tools1.htm
http://www.multiproxy.org/env_check.htm
http://privacy.net/analyze/
http://www.accessdiver.com/download/proxyjudge-scripts.txt
*All working links as of (December 31 2003)
------------------------------------------------------------------------
9. Where to Check The Proxy Server's Country :-
Avoid US/UK/Canada/Australia/NZ and most western European countries!
http://www.arin.net/whois/
http://www.all-nettools.com/tool s1.htm
http://www.samspade.org
http://www.who-is.info
------------------------------------------------------------------------
10. How to configure one in your browser:-
To enable a proxy server in IE
Go to: Tools... Internet Options... Connections... Settings

If you use a dialup connection, click the "Settings" button next to the dialup properties box. If you have a broadband connection, click the "LAN Settings" button instead. Check the "Use a proxy" option, then enter the proxy's hostname into the "Address" Editbox and port number into the "Port" Editbox normally 8080.

Tip: In the "General" tab make your Proxy Checking Url your chosen "Home Page" this allows you to check each time you log on.
To enable a proxy server in Netscape:
Go To: Preferences... Network... Proxy tab
Same as Internet Explorer
------------------------------------------------------------------------
11. Obscuring a Proxy URL:-
An additional method is to obscure your url using hex codes so it turns out like looking like this
http://3513587746@3466536962/~anyname/homepage.htm
------------------------------------------------------------------------
12. Additional Security:-
Your security can be further advanced by chaining proxies whether they be http based or socks proxies. And schematically might look like this:
client ---> proxy1 ---> proxy2 ---> Web Site. Each proxy server type has its own chaining syntax.

HTTP/FTP
The most common syntax is of the form proxy1.jp:8080//proxy2.kr:8080. This is added direct to your address editbox. Other proxy servers like the Japanese DeleGate servers use -_- to prefix the proxy and this can be typed straight into the url address bar i.e. type http://needmore.cs.utexas.edu:10080/-_-http://www.yahoo.com, note the "-_-", similar syntax applies to ftp sites since DeleGate Proxy Servers offer a ftp proxy service. The majority of proxy servers will use the http transport to convey the ftp information, and in doing so may or may not adhere to the connection conventions laid out in the ftp protocol. So to avoid revealing your ip address via an ftp connection its best to use a socks proxy for the purpose of anonymity, probably combined with some ftp client program. Proxy Hunter can be used to find the fastest proxies.

SHTTP/HTTPS
SHTTP aka Secure Hypertext Transport Protocol is a modified version of the Hypertext Transport Protocol (HTTP) that includes security features. implementations include Digital Signitures, MAC aunthentication, Public/Private Key Encryption.
HTTPS aka SSL (S)ecure (S)ocket (L)ayer is similary a secure messaging protocol but it differs from SHHTP in that supports a variety of protocols such as FTP/HTTP etc. SSL is compatible with firewalls and tunneling connections. Other protocols have their own secure versions such as FTPS for ftp and NNTPS for NNTP or Network News where some news servers allow upload via a secure connection.

WARNING: Since both these protocols allow connections on arbitrary or secure ports 443 in the case of SSL. These connection requests, unless blocked by a firewall or handled via a secure proxy specific to the protocol, will reveal your ip address in the connection process!

SOCKS:
Socks Proxies which are the most flexible covering many protocols can be successfully chained using a program called SocksChain which chains 2 or more socks proxies. If you use say 4 socks proxies chained together because you want to post on some Russian news server. Then this will make you anonymous. Similar applies to ftp http mail icq etc. (Mac users are out of luck with regard to the availability of software which performs these various proxy tasks, with some rare and not very reliable exceptions.)

Proxy Chaining:
The basic idea is this: although not all chainable proxies have web interfaces (a web page with a form where you can enter the URL you want to surf to using the proxy), several do have such interfaces. Three that are well known are MagusNet, the Anonymizer, and the Anonymicer.

Before starting, go to http://www.tamos.com/bin/proxy.cgi and write down the set of four decimal digits that make up your current IP address. Now, here's how to figure out how to learn to chain proxies with web form interfaces: Also try ports 8088 and 8090 for some additional interesting results. MagusNet uses a DeleGate proxy server; many other DeleGate proxy servers also have web interfaces and are chainable; to find several, notice the title of the MagusNet page: 'DeleGate for Non-CERN-Proxy clients'. Searching for that phrase on the standard US and Japanese search engines will turn up several other DeleGate proxy servers you can easily find the prefixes for using the exact same technique outlined above.

Many other DeleGates have no web interfaces, but they are chainable, too. Any time you are testing proxies you have found by scanning with ProxyHunter, searching on Search Engines, or filtered out of lists like the ones at Proxys4All or out of guestbooks or Boards at sites dealing with proxies etc., just test them to see if they can be chained. For example, if the _fictional_ proxy my_url.jp:80 is identified as a DeleGate on the Tamos page (or any of the other ENV testers listed on the Proxys4All Tools page), try http://www.my_url.jp:80 /-_-http://www.tamos.com/bin/proxy.cgi and see if it works. If it does (and many times it will), you've got another chainable proxy to add to your list.
------------------------------------------------------------------------
13. Resources
Proxy Hunter:
This is a good freeware proxy scanner-again, for the PC user.

Anonymity 4 Proxy:
.This program can inform if a proxy allows connection for HTTP, SSL and FTP.

HTTPort:
Is freeware and it can use a SSL proxy to tunnel requests to a wide variety of net services.

AAtools:
The best program ever, proxy/sock checker, whois, port scanner ...etc

Proxy Checker:
Another program to check proxy lists as well as scan ip ranges.

Socks2HTTP:
Socks2HTTP is an agent converting SOCKS v.5 requests into HTTP requests and tunneling them through HTTP proxy.

Newsgroups dealing with Anonymity

* alt.anonymous
* alt.anonymous.email
* alt.anonymous.messages
* alt.hackers
* alt.security.keydist
* alt.security.pgp
* comp.security.pgp
* comp.security.pgp.announce
* comp.security.pgp.discuss
* comp.security.pgp.resources
* comp.security.pgp.tech
* misc.security
* sci.crypt
* sci.crypt.research

LINUX · Moderator

i finish read all exellent work g0df4th3r Wink

linli · Regular user

finish read all exellent work g0df4th3r

Gabe · Beginner

700G · Active user

Thank you Gabe...good info!

flash · Beginner

Injector · Active user

lolz another skiddie on the loose Twisted Evil

shai-tan · Valuable expert

lol I think everyone has done at some point.

g0df4th3r · Advanced user

Gabe, i didnt leech it on proxynation if a knewed a real author i posted also his real name, but till know i dont know a real author.
And i dont feel like i must shame for helping people, i wasnt in your nation.