Verify the Proxy Chains???

Hello everybody.


I recently got my proxy chaining apps running, and stuffed it with a few valid proxies. I tried it on several applications, like ftp, web, ssh, irc, nmap etc and it works fine. The target shows the last proxy server in the list of chains. My questions is:

How do i know that its acutally going through all the proxies in the list. It says its chaining through them all, but how can i be certain of that?

Better said, how can i trace it back each proxy at a time? Or would i have to view the logfies of each proxy server it goes through (time stamps)?


Any solution would be much appreciated.

Cheers everyone. :)

Pop a packet sniffer on your box and look at the traffic going outbound from your comp. If it is the first proxy in the chain then you can be pretty sure that the packets are making the rounds of all the proxies in your list because you have already determined that the last one is making the final connection.

/me slaps myelf for not thinking bout it.

I used ethereal to monitor the traffic, and indeed i can see the first proxy, which differs from the last one :) So it works, and all is well.

Thank you alot Tiger shark.

NP Insi..... Sometimes the answer is sat right on the end of our noses, it just takes someone else to point it out..... Kinda like boogers..... ;)

What chaining software do you use, if one may so boldly ask? :)

diddo

I personally use proxychains for mine. I use yaph with the --use_nmap switchto find em. Works great for me.


hjack

Thanx hjack, I came across both those two pieces of 'equipmtn' after the post, haven't checked them yet cuz of stressful philosophy paper due tomorrow :\

Yup, just like hjack pointed out, thats the 2 i use. I recomend reading the following too, before attempting to use this sort of software, since it does bring in a LARGE security issue.

http://www.faqs.org/rfcs/rfc2607.html

Its important that you understand what it is exactly, and how it works. Not just download and use it.
And never never use it if your gonna type anything sensitive, such as passwords, personal info etc.....

This so called proxy chaining also makes you vurnerable to a "man-in-the-middle" attack, where someone captures your packets (encrypted or not) and can resend them to gain access, as well as remote session hijacking. Also make sure if you use it that you have the correct proxies for the wanted use, such as "GET" for web, and "CONNECT" for other tcp connection type applications.

Cheers.