✏️
OSCP
  • $WhoAmI?
  • Manual
  • NMAP
    • NSE Scripts
  • Steganography
  • Services Enumeration
    • Postgres Psql
    • SNMTP - 199
    • SSH - 22
    • TELNET - 23
    • RDP - 3389
    • DISTCCD - 3632
    • IMAP - 143
    • TFTP - UDP69
    • FTP - 21
    • HTTP 80/443
      • LFI to RCE
      • ShellShock
      • GIT
      • XXE, SQLI, CRLF, CSV,
      • CMS
      • Locations
        • Interested Linux Files
        • Logs
      • Command Injection
      • Remote File Inclusion (RFI)
      • File Upload Vulnerabilities
      • Remote Code Execution (RCE)
      • SQL Injection
      • Local File Inclusion (LFI)
        • LFI TO RCE
      • Web Enumeration
        • Patator BruteForce
        • ShellShock
        • Nikto
        • Anonymous Scanning
        • Fuzzers
        • DNS
    • SMB 139/445
      • SMB Exploit
      • SMB Enumerate
      • Send and Execute
      • Samba 2.2.x
    • RPC - 111
    • NFS
    • SNMP 161
    • SMTP 25
    • VNC - 5800
    • MYSQL - 3306
    • POP3 - 110
    • LDAP - 389
    • IRC 667
    • Java-RMI 1098/1099/1050
    • 1433 - MSSQL
  • Linux
    • Shells Linux
    • File Transfer
    • Linux Priv Esc
    • Fix Shell
    • Upload
    • Restricted Shell
  • Windows
    • File Transfer
    • Reverse Shell Cheatsheet
      • Full TTYs
      • Shells - Windows
      • MSFVENOM
    • Post Explotation
      • Nishang
      • Kernel Exploits
      • Service Exploits
      • Unquoted service paths
      • Mimikatz
    • BackDoors
    • EternalBlue MS17-010
    • Windows - Download and execute methods
    • Windows Priv Exc
    • Priv Esc Tools
    • ByPass UAC
      • Bypassing default UAC settings manually c++
      • EventVwr Bypass UAC Powershell
      • ByPass UAC Metasploit
      • Bypassing UAC with Kali’s bypassuac
      • Bypass UAC on Windows Vista
  • Password Attack
    • Intercepting Login Request
    • Windows Hashes
    • Linux Hashes
    • Wordlists
    • Brute Force Password Attacks & Cracking
    • Hashes
  • Network Pivoting Techniques
  • Buffer OverFlow
    • 6. Getting Shell
    • 5. Finding Bad Characters
    • 4. Overwrite EIP
    • 3. Finding The Offset
    • 2. Fuzzing
    • 1. Spiking
  • Downloads
  • Online Websites
  • Privilege Escalation History
  • Exploit
    • Unreal IRC
    • Sambacry
    • Shellshock
    • Padding Oracle Attack
Powered by GitBook
On this page
  • torsocks
  • ProxyChains-NG
  • Sqlmap anonymous
  • WPScan anonymous
  • NMAP anonymous

Was this helpful?

  1. Services Enumeration
  2. HTTP 80/443
  3. Web Enumeration

Anonymous Scanning

https://miloserdov.org/?p=131

torsocks

How to install and run Tor in Kali Linux

Install necessary packages:

sudo apt-get install torsocks tor

#Then open the /etc/tor/torrc file:

sudo gedit /etc/tor/torrc

#And append lines:

AutomapHostsOnResolve  1
DNSPort                53530
TransPort              9040

#Start and add tor service in autorun:
sudo systemctl start tor
sudo systemctl enable tor

ProxyChains-NG

#Installing ProxyChains-NG: 

sudo apt-get install git gcc
sudo apt-get remove proxychains
git clone https://github.com/rofl0r/proxychains-ng.git
cd proxychains-ng/
./configure --prefix=/usr --sysconfdir=/etc
make
sudo make install
sudo make install-config

Sqlmap anonymous

Sqlmap anonymous scanning through Tor, Sqlmap has the –proxy option,

therefore you just need to append –proxy socks5://127.0.0.1:9050 to you command:

sqlmap -u TARGET --proxy socks5://127.0.0.1:9050

WPScan anonymous

WPScan anonymous scanning through Tor WPScan has the similar –proxy flag,

so just append –proxy socks5://127.0.0.1:9050 to you normal command:

wpscan -u TARGET -e p,vt,u --proxy socks5://127.0.0.1:9050

I recommend you consider usage of –request-timeout 500 –connect-timeout 120 options, because scanning through Tor leads to significant delays.

Example:

sudo wpscan -u spryt.ru -e p,vt,u --proxy socks5://127.0.0.1:9050

NMAP anonymous

proxychains4 nmap -sT -PN -sV --open -n -p 80 mi-al.ru 2>/dev/null

Starting Nmap 7.40 ( https://nmap.org ) at 2017-03-18 04:21 EDT
Nmap scan report for mi-al.ru (224.0.0.1)
Host is up (0.15s latency).
PORT   STATE SERVICE VERSION
80/tcp open  http    nginx 1.10.2
 
Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 9.41 seconds

PreviousNiktoNextFuzzers

Last updated 4 years ago

Was this helpful?