[yzT!]

First of all, I'm a white hat.

I've been playing around for quite time with my pentester lab, but obviously, staying within my network limits I won't improve. Also I've done some ctf.

I'm planning to start finding some vulnerabilities in "pointless" webs (inactive webs or with low traffic) and check out my knowledge. The most probably is that the owner of this kind of web not even knows that I'll be "attacking" him, but still I want to be "anonymous".

So from this point of view, where I don't want to do any harm and I only need mask my ip, would you use TOR (random IPs all the time) or a VPN (static IP)

[Asuna_mybb_import7736]

Wifi>MAC Spoofer>VPN>TOR

User Agent spoofer, better privacy, keystroke encrypter. (For Tor).

This is Kabraxis setup. His from UGN, so that's pretty secure.

[Evil.eXe]

Wifi>MAC Spoofer>VPN>TOR

User Agent spoofer, better privacy, keystroke encrypter. (For Tor).

This is Kabraxis setup. His from UGN, so that's pretty secure.

Secure, definitely. However with a set up like this, your speeds are likely to be so slow, it is no longer worth trying to do anything that requires loading more than a basic web page.

[NiTrOwow]

FBI can still find out the Exit tor node if they want. Just use a vnp without logs on a public network somewhere else. And you're safer then tor.
And of course use linux. It doesn't leave any tracks like Windows does.

[Anima Templi]

People will have to realize something here TOR isn't as secure as everyone thinks anymore. It has been to easy to trace your through TOR so please don't rely on it. As said above a VPN would be the best choice.

Remember, we do not allow blackhat activity on this forum. Since you haven't provided us with information about your target and you are asking for ways to secure yourself i will let this thread stay.

[1llusion]

Look for Whonix operating system. Use that, make it connect only through the host computer and put a VPN on the host. (you can even chain VPNs by using one inside Whonix).

But, if you are white-hat, you don't really have to be scared. I usually search for vulns even on big websites (found SQL injections on government websites) and I don't really use any VPN or so. This is because I simply report all of the vulns and tell them how to fix them etc. Also, if I find SQL injection, I don't fully exploit it until they give me a written permission

[yzT!]

Look for Whonix operating system. Use that, make it connect only through the host computer and put a VPN on the host. (you can even chain VPNs by using one inside Whonix).

But, if you are white-hat, you don't really have to be scared. I usually search for vulns even on big websites (found SQL injections on government websites) and I don't really use any VPN or so. This is because I simply report all of the vulns and tell them how to fix them etc. Also, if I find SQL injection, I don't fully exploit it until they give me a written permission

But what happen if you are looking for vulnerabilities in big websites and they detect that you are "attacking" them? That was the point that made me open this topic. I won't exploit the vulnerability, just find it. But they may think that I'm a malicious person

[chmod]

As long as you stop and contact an admin as soon as you find a vulnerability ie an sql error you are doing nothing illegal and thus won't have any repercussions

[chmod]

As long as you stop and contact an admin as soon as you find a vulnerability ie an sql error you are doing nothing illegal and thus won't have any repercussions

[chmod]

As long as you stop and contact an admin as soon as you find a vulnerability ie an sql error you are doing nothing illegal and thus won't have any repercussions