[superMAUS]

How to make semi-anonymous
Nmap scans with TOR on Linux

by theLurkingMass

I use this method when attacking systems with more astute sysadmins and less traffic. An unprotected nmap scan can stick out like a sore thumb so its best to use this method.

Dependencies:

TOR (of course)
Proxychains (sudo apt-get install proxychains)
Nmap (sudo apt-get install nmap)

0x01.

Open up a text editor and copyandpasta this tiny program I wrote for automation:

Code:

#!/bin/bash if [ -z "$2" ]; then echo "Syntax:" echo "./nmaptunnl.sh [host] [ports]" exit fi proxychains nmap -sT -PN -n -sV -p $2 $1

Then Save it as nmaptunnl.sh.

0x02.

Open up terminal and navigate to the file. Run it using bash ./nmaptunnl.sh.

Then use the syntax below:

Spoiler:

0x03.

Scan the host and profit (like so):

Code:

thelurkingmass@thelurkingmass:~/Documents/nmaptunnl$ bash nmaptunnl.sh www.google.com 21,80,23 ProxyChains-3.1 (http://proxychains.sf.net) Starting Nmap 5.21 ( http://nmap.org ) at 2014-03-30 19:17 EST |DNS-request| www.google.com |S-chain|-<>-127.0.0.1:9050-<><>-4.2.2.2:53-<><>-OK |DNS-response| www.google.com is 173.194.116.145 |S-chain|-<>-127.0.0.1:9050-<><>-173.194.116.145:21-<--timeout |S-chain|-<>-127.0.0.1:9050-<><>-173.194.116.145:23-<--timeout |S-chain|-<>-127.0.0.1:9050-<><>-173.194.116.145:80-<><>-OK RTTVAR has grown to over 2.3 seconds, decreasing to 2.0 RTTVAR has grown to over 2.3 seconds, decreasing to 2.0 |S-chain|-<>-127.0.0.1:9050-<><>-173.194.116.145:80-<><>-OK Nmap scan report for www.google.com (173.194.116.145) Host is up (13s latency). PORT STATE SERVICE VERSION 21/tcp closed ftp 23/tcp closed telnet 80/tcp open http Google httpd 2.0 (GFE) Service Info: OS: Linux Service detection performed. Please report any incorrect results at http://nmap.org/submit/ . Nmap done: 1 IP address (1 host up) scanned in 39.04 seconds

Enjoy and if you have any queries feel free to ask.

[Reiko]

dear god... you're not retarded. You actually made sure to use the -sT flag for this.
What kind of world am I living in when I can't make fun of you online for being retarded?!

[w00t]

echo -e "alias nmap='nmap --proxy \"socks4://127.0.0.1:9050\"'\n" >> ~/.bash_aliases

[Mom]

dear god... you're not retarded. You actually made sure to use the -sT flag for this.
What kind of world am I living in when I can't make fun of you online for being retarded?!

Well you still totally can. There's always a way to call someone retarded.

[e523e]

Or you could just use torify, you probably already have it and don't know it.

Code:

torify curl ifconfig.me 5.79.81.200

Code:

man torify

[Alan Turing]

That background looks really nice. Good tutorial as well

[superMAUS]

echo -e "alias nmap='nmap --proxy \"socks4://127.0.0.1:9050\"'\n" >> ~/.bash_aliases

Thats definetly a better method instead of installing so many dependencies. You win :3

---

That background looks really nice. Good tutorial as well

Thanks very much :3

---

Or you could just use torify, you probably already have it and don't know it.

Code:

torify curl ifconfig.me 5.79.81.200

Code:

man torify

Thanks for this share, this is certainly useful not just for nmap.

[Equinox]

Well you still totally can. There's always a way to call someone retarded.

You're retarded.

[Mom]

You're retarded.

Spoiler:

On a serious note, Duubz: <3

[superMAUS]

Spoiler:

On a serious note, Duubz: <3

Stop using the fucking heart okay? I challenge you.