getting started with tor for backtrack linux

### Tutorial on being anonymous on the internet today.
### by gh0st
### big shouts to guys in #antisec on irc.anonops.li   -> (especially redacated)

It has become apparent that more and more people today are interested in becoming anonymous on the internet today, and they want to know
how to hide themselves. While there are many ways to do this, i am going to show you how you can be anonymous while browsing the web and
using irc, for these seem to be the 2 that i find that most people are interested in. While i will cover these 2 areas in depth, you can
apply these "anonymous theories" to other services such ass Instant Messaging (Pidgin) for example. This tutorial will  cover how to setup
tor and polipo on backtrack 5 specifically, but you can apply these methods to any linux distro. I appologize for windows users, however
its all pretty much the same thing. Please not that this is a quick tutorial to get you started with tor, i made this tutorial for the
guys in #antisec on irc.anonops.li. Big shout out to Redacted, your leadership is well respected! Okay lets get started.

1. Why is important to be anonymous on the internet today ?

Well people will have different answers for this question. Some people will want to be anonymous so that websites can not track them,
and others will want it for more malicious reasons. If you plan on doing things like sql injection and other web attacks then it wouldn't
be very smart for you to go and use your real ip address would it... Also if you are going to be doing things such as vulnerability
scanning, you are going to be connecting the target network in a very LOUD way, so it is always a good idea to use some kind proxie to try
and anonymize your web activity.

2. Will tor and other proxies keep me 100% anonymous on the internet today.

Well the sad answer for this one is no. Tor will not keep you 100% safe, and even in some instances tor is vulnerable to things like sniff
attacks. However, i am with the attitude that it is better than nothing, and Tor will make it more difficult for you to be traced back to.

3. Tor is free, should i pay for a proxie ?

People ask me all the time what is the difference between using a free proxie vs paying for one. The truth is that it is rumored that free
proxie services probably log which could compromise you in a log run, and it is said that if you pay for proxie service that they don't
log, this is for you to decide and it depends on how paranoid you are. If you want to spend money great, i am sure you will be happy with
the results, me on the other hand i don't need to pay for proxie service.

Lets get started...

Like i stated earlier i am setting up tor and polipo on my backtrack 5 box. This setup will work with most linux distro with small changes.
Backtrack 5 does not come with tor in their repo's (other linux distros like fedora do carry it in their repo's) so we need to add tor
to the reop's list.

Step 1. go to this directory -> cd /etc/apt

Step 1a. run command "ls -alt" to make sure you have the file "sources.list" if you are running Backtrack or debian or ubuntu you should
         have this file, for systems like fedora or centos tor is already in your repo's so you don't need to do this.

Step 2. open sources.list with vi -> commmand: vi sources.list

Step 2a. press "i" on your keyboard to enter insert mode in vi and go to the bottom of the page and add this line to /etc/apt/sources.list

         "deb http://deb.torproject.org/torproject.org lucid main"

Step 2b. press "esc" on your keyboard to exit insert mode in vi, and on your keyboard type ":" vi will give you a ":" prompt at the end of
         of the file enter "wq" and press enter. This will write the changes and quit the file.

Step 3. run this command: gpg --keyserver keys.gnupg.net --recv 886DDD89

Step 4. run this command: gpg --export A3C4F0F979CAA22CDBA8F512EE8CBC9E886DDD89 | sudo apt-key add -

Step 5. run the command: "apt-get update"

Step 5a. run the command: apt-get install tor tor-geoipdb

Okay now that we have tor installed on our linux box we need to setup polipo. Polipo is what tor uses for web proxy. When you install tor
it comes with privoxy (the other web proxy that tor uses) however i prefer Polipo. What is the difference you might ask? Well the major
difference between privoxy and polipo comes down to speed. Without getting into too much detail privoxy is considered being "more anonymous"
but at the same time, is very slow, it will slow down your web browsing. Polipo is much better when it comes to speed while web browsing,
and it works great so it is my choice. However, i will cover how to set both of them up.

###### Setting up Polipo.

command: apt-get install polipo

Since we added tor to /etc/app/sources.list we can just run that command to get polipo, if you are using fedora or centos then you should
have it in your repo's.

Okay now we need to configure polipo to get it working.

Step 1. cd /etc/polipo

Step 2. we are going to use a different config file that the one provided but it is allways a good idea to backup the original one so run
        this command: mv config conf-backup.txt

Step 3. Go to this website and copy the polipo config file that torproject provides
        https://gitweb.torproject.org/torbrowser.git/blob_plain/HEAD:/build-scripts/config/polipo.conf

Step 4. Make a new config file with "vi config" press "i" on your keyboard, and copy and paste the polipo conf file you go from torproject
        and then press "esc" on your keyboard the enter ":wq" and press enter to save the new file.

        This will run polipo on 127.0.0.1 (localhost) on port 8118  -> this is standard if you need to change this then edit the conf file.

Step 5. cd /etc/init.d/

Step 5a. run command: polipo started

NOTE: for backtrack users running the command "polipo start" from /etc/init.d will cause an error which looks like this:

root@bt:/etc/polipo# cd /etc/init.d
root@bt:/etc/init.d# polipo start
command line:0: parse error.
root@bt:/etc/init.d#

So instead we will use the following:

run command: service polipo start

Now polipo should be running smoothly...lets double check though =-P

root@bt:/etc/init.d# ps aux |grep polipo
proxy    25081  0.0  0.0   2656  1220 ?        Ss   15:39   0:00 /usr/bin/polipo -c /etc/polipo/config pidFile=/var/run/polipo/polipo.pid daemonise=true logFile=/var/log/polipo/polipo.log forbiddenFile=/etc/polipo/forbidden
root     25707  0.0  0.0   3372   744 pts/2    S+   17:41   0:00 grep --color=auto polipo


another check will be with the command netstat

root@bt:/etc/init.d# netstat -ntl
Active Internet connections (only servers)
Proto Recv-Q Send-Q Local Address           Foreign Address         State
tcp        0      0 127.0.0.1:8118          0.0.0.0:*               LISTEN
tcp        0      0 127.0.0.1:9050          0.0.0.0:*               LISTEN
tcp        0      0 127.0.0.1:7175          0.0.0.0:*               LISTEN
tcp6       0      0 ::1:7175                :::*                    LISTEN


Remember that polipo runs on port 8118, tor is running on 9050

if for whatever reason tor is not running run the command "service tor start"

Alright now that we got tor and polipo correctly configured we need to setup firefox to use the web proxy polipo so that we can start
surfing the web anonymously!


###### Setting up Privoxy instead of Polipo

If you are the ultra paranoid type and you don't care about your web browsing speed being slowed down then you will want to use privoxy.

I am not going to go into too much detail about setting up privoxy because you use will use basically the same steps used to install
polipo.

When you ran the command "apt-get install tor tor-geoipdb" privoxy should be on your system, if for whatever reason it is not then run
the command "apt-get install privoxy"

Okay now go into the directory "/etc/privoxy" and locate the config file

root@bt:/etc/privoxy# ls -alt
total 200
drwxr-xr-x 149 root    root 12288 2011-07-06 17:24 ..
drwxr-xr-x   2 root    root  4096 2011-07-06 15:35 templates
drwxr-xr-x   3 root    root  4096 2011-07-06 15:35 .
-rw-r--r--   1 root    root 51085 2010-01-17 23:09 config

Okay open privoxy with vi or whatever text editor you prefer and located the following line:

#        forward-socks4   /               socks-gw.example.com:1080  .

change that line to the following:

forward-socks4a   /               127.0.0.1:9050 .

NOTE: THAT YES the "." at the end is needed

If this is a bit confusing for you then these are the general variables that are needed in the privoxy config file you can copy the
original privoxy config file to privconf-backup.txt like we did with polipo's config file earlier and make a new config file with these
options.

Example of Privoxy Config File.

forward-socks4a / 127.0.0.1:9050 .
confdir /etc/privoxy
logdir /var/log/privoxy
actionsfile standard
actionsfile default
actionsfile user
filterfile default.filter

debug   4096
debug   8192

user-manual /usr/share/doc/privoxy/user-manual
listen-address  127.0.0.1:8118
toggle  1
enable-remote-toggle 0
enable-edit-actions 0
enable-remote-http-toggle 0
buffer-limit 4096

Please remember that privoxy config file goes in /etc/privoxy/

After you modified the config file save and exit the file. Then you need to start privoxy with the following command:

run command: service privoxy start

You can check to make sure that privoxy is running correctly with the following commands that was showed earlier with Polipo.

ps aux |grep privoxy

netstat -ntl  (look for localhost with ports 8118 and 9050

Thats it, privoxy should now be running smoothly you will just need to add a manual proxy setting in your web browser to start viewing
the web anonymously.


NOTE:
Before we configure foxyproxy with firefox open firefox and go to www.whatismyip.com and take not of your ip address. After we configure
foxyproxy to use polipo your ip address will never be the same! Are you excited ?

####### Setting up firefox with tor

Okay load firefox

From firefox menu -> Tools -> Addons

From addons run a search for the following: FoxyProxy

FoxyProxy should be found right away and it is free do install the addon.

Once the foxyproxy addon has been installed on to firefox, you need to restart firefox by closing it and opening it up again. When you do
this a new tab should be open up with a foxyproxy web page being displayed.

Notice that a new icon has been added to firefox, you should see a fox with a circle around it crossed out (to the right of where you would
enter a web address) FoxyProxy is crossed out because it is not correctly configured yet.

Click on the fox icon

Click on the proxie tab and then click on "add new proxy"

From there what you want to do is add a proxie, but i am sure you are asking (what proxie do i add?)

If you know the answer to what proxie you should add then i am happy for you because you are getting the concept, and you are on your way!

Remember earlier when we ran the command "netstat -ntl" and got the following output


root@bt:/etc/init.d# netstat -ntl
Active Internet connections (only servers)
Proto Recv-Q Send-Q Local Address           Foreign Address         State
tcp        0      0 127.0.0.1:8118          0.0.0.0:*               LISTEN
tcp        0      0 127.0.0.1:9050          0.0.0.0:*               LISTEN
tcp        0      0 127.0.0.1:7175          0.0.0.0:*               LISTEN
tcp6       0      0 ::1:7175                :::*                    LISTEN


This is why we run tor and polipo our proxie is running at 127.0.0.1 (localhost) on port 8118


So when we click "Add new proxy" on foxyproxy we are going to add the address 127.0.0.1 and add port 8118 it will ask us for a whitelist or
blacklist and these are websites that you either don't want to proxy or you do want to proxy for them, i choose to run the proxy for every
website, so i left that area blank, you will get a warning its okay just click okay.

Then just name your proxy whatever you like you can name your proxy "Tor" if you want to remind you that you are using tor.

In the top of the proxy menu is the "Select Mode" window and it is currently set at "don't use a proxie" and you want to set it at

Use Proxy "Tor" for all urls  (use this setting to proxy every website you go to)

Now if all goes well you should see the foxyproxy icon in your firefox web browser turn blue and the circle with the cross out line should
be gone which means that foxyproxy is running.

For the test now go to www.whatismyip.com and see if your ip has changed, if your ip has changed you are now browsing the web anonymously!


Remember when we talked about purchasing proxies for even better privacy, if you want to instead of running tor on your computer you could
purchase one and use theirs, they tend not to be that expensive. It is up to you to research around which ones are the best. You have now
made it more difficult for websites and other people to track you will you browse the world wide web, congradulations!

If you have any other questions about tor or any other concerns that i did not cover here, always go to the website torproject.org they
also have great irc support that you can find at their website. I really hope this has helped you so far. Remember the setup is not much
different for windows, same concept.

######## NOTE: WINDOWS USERS

go to this website for setting up tor on windows

https://www.torproject.org/docs/tor-doc-windows.html.en     -> it will help i promise you


######## NOTE LINUX USERS

If you would like a gui for using tor, linux provideds the app "Tork" which provides you with a graphical user interface for kde which
makes using tor and related apps a lot easier to use and manage. Tork is more than likely provided in your linux repo's so just run the
command "apt-get install tork' or "yum install tork" to install it. Again this app makes managing tork very easy.



######## NEXT USING TOR WITH IRC

Everyone wants to be anonymous on the web, yet i am seeing a lot of questions today about being anonymous on irc. This has a couple of
issues. One a lot of irc networks don't support tor such as irc.freenode.org for example. If you have never been on irc.freenode.org it is a
great irc server dedicated to helping people with technical support for many different things.

NOTE: TOR does have scripts on their website to make connecting to irc servers easier, for example freenode. The link is provided in this
tutorial, just keep reading. Make sure to look for it.


####### USING TOR WITH XCHAT

Setting up tor with xchat is not very difficult, you just need to configure a few options and you are good to go. Please remember to check
and see if the irc server you are trying to connect to supports tor.

Okay right click the window

Then go to setting -> preferences -> network -> network setup -> proxy server

Then enter the following:

Hostname: 127.0.0.1           NOTE:  ->   (enter the ip address, don't enter localhost)

Port: 9050                    NOTE:  ->   (we are using tor not privoxy or polipo)

Type: Socks5                  NOTE:  ->   (you can either use socks5 or socks4)


That is it, you are now able to use tor with irc, which means that your ip address for the most part will be protected from other users.
Not very difficult right? As i said before there are some cons to using tor on irc, however there are some advantages too, so it all
depends really on what your needs are. Next we will discuss how to use tor with irris, an irc text based client.


######### USING TOR WITH IRSSI

Okay here we will show you how to use tor with irssi.

PROBLEM: you want to use irssi with tor but you also want ssl support, so you have encryption.

Okay well when you try to connect to an irc server with ssl and tor you are going to get errors about the SSL_Handshake failing. The reason
for this is because ssl_conncect is using https as its request and tor is not a http proxy, remember that is why we use privoxy and polipo.
So what do we do?

We need to use 'socat' to create a relay and then use this relay to connect to irc servers, i will show you...

run the following commands:

socat TCP4-LISTEN:5000,fork
SOCKS4A:127.0.0.1:irc.efnet.org:6697,socksport=9050     -> ( SEE WE CONNECT TO TOR AT PORT 9050, run netstat -ntl to check its running)
                                                        -> ( ALSO CHANGE THE IRC SSL SERVER 6697 TO WHATEVER YOU NEED TO )

now we just connect to localhost with irssi

start irssi then do /connect 127.0.0.1 5000

When you run irssi with tor you are going to get a lot of error warning and information leakage. To quiet this down so you are not getting
information leakage and other errors you can run this command on irssi:

/ignore * CTCPS


NOTE: You may want to run certain plugins like "torify irssi" for irc servers like freenode. Also, you may want to run sasl plugins with
DH-BLOWFISH encryption. To do that is fairly simple you just need to install the required plugins. Most linux distro's will have the plugins
so all you need to do is run "apt-get" or "yum install"


NOTE: for other users that want to run tor with other irc clients such as Mirc and BitchX please go to this website which gives excellent
instructions on how to setup tor with your favorite irc client.


https://trac.torproject.org/projects/tor/wiki/doc/TorifyHOWTO/IrcSilc#X-Chat        -> (BE SURE TO GO TO THIS WEBSITE)


The above website is a great, please make sure to look at it if you have any further questions. They also provide scripts and plugins
to make irc with tor a lot easier for irc networks that don't support tor so make sure to check it out. They even offer tips to again
make things easier.


Thats a lot of work right? I know like i said its tradeoffs. Again, it all comes down to what you need.


When it comes to connecting to irc servers this is one of the best ways to be secure with ssl and anonymous (with tor).


######## END

Well i hope this tutorial has been helpful for you, and i really hope it has answered a lot of questions out there. I want to give a big
shout out to the guys on irc.anonops.li in #antisec

You guys are why i do this....

If you have any questions you can find me in #antisec in irc.anonops.li

Take care everyone, again i hope this has been helful!

-gh0st