December 18th, 2001, 08:46 PM
Sock Chains in Windows
This is a tutorial on how to help you remain anonymous. This article was taken from Hideaway.net
This tutorial is an attempt to help you re-route all internet winsock applications in ms windows trough a socks chain, thus making your connections much more anonymous.
The more different hops you make your data jump, the more difficult it will be to trace it back. take this route for example:
you --> socks1 --> socks2 --> socks3 --> ... --> socksx --> target
People who want to trace you will have to contact x persons to ask their them for their logs. chances are one of them didn't log... and if they logged, the ip seen by each host/socks is the ip of the previous host/socks in the chain.
this works for:
. icq-like tools
. ftp clients
. mail clients
. telnet clients
. (just about anything that uses the internet)
it doesn't work on most irc servers since they often check for open wingates and proxies.
First you need to find some boxes running wingate. We look for wingates since the default installation of wingate includes a non-logging socks server on port 1080 visit these links: http://<br />
<a rel="nofol...ocks.shtml</a> or
for some wide-known wingate ips, or even better: you could try to find some yourself. to do this, i would suggest you use 'proxy hunter', available for download at:
Be sure to look for wingates (port 23) and not for socks, as we only want wingate socks. You could also use wingatescan, available for download at:
Speed is very important since we will be using multiple socks, and we don't want our programs to time out. with the klever dipstick tool, you can find out which are the fastest ones. (get the klever dipstick program at:
Just fire off Dipstick. Rightclick in the small green rectangular and
choose Show main window. To import a list of wingates, just click on Advanced, choose Import List and select your file.
You can also manually ping a simple host by clicking on Manual Ping. Use those wingates with the smallest average time. *duh*
Check if the wingates from the list are actually running
There are a lot of programs that can help you with this, one of them is server 2000, available for download at
Install a program that will intercept all outgoing networking calls. Use the great tool sockscap for this purpose. you can get it at http://www.socks.nec.com/sockscap.html
In the setting, enter this as socks server : 127.0.0.1 port 8000. Click on 'socks version 5'. click 'resolve all names remotely'.uncheck 'supported authentication'. In the main window, choose new and then browse to create a shortcut
for the internet client you want to give socks support.
Repeat this step for every program you want.
- Install socks chainer
download it at http://www.ufasoft.com/socks
in the service menu, click on new. enter 'Chain' as name and '8000' as port to accept connections on. Click on new and fill in the ips of the fastest wingates you found,
but this time, use port 1080 for this (and not the port 23)
using the '<' and '>', you can add and remove socks. be sure to test all socks one by one before adding them all to the list in once, because if one of them is bad, you chain will not work and you will not be able to locate the bad socks in the chain.
If all of them seem to work, you use the '<' key to add them all (mind speed problems. 4 or less is fine. I think 10 or 13 is the limit put by tcp/ip)
- Testing your anonymous setup
To check what socks your computer is connecting to, you can use x-ploiters to stat at:
Look for connections to port 1080, the remote ip found there should be the first ip found in your chain in sockschain.
Use the shortcut in sockscap that points to your browser, and connect to
Use your shortcut in sockcap to start your telnet client then telnet to ukanaix.cc.ukans.edu
You can also use
Test ssl or ftp.zedz.net to verify your ip via ftp.
In all the above cases, the remote server should show you the ip of the last server in the sockschain. if you look at the sockschain program while surfing you should see the chain being built up.
Never use internet explorer to do tricky stuff as it might reveal your ip. My personal favorite browser is opera 4.0 Available at: http://www.opera.com
If you looked carefully to what is displayed when you go to the
http://internet.junkbuster.com/cgi-b...w-http-headers page, you might have noticed that a lot of stuff about our client is being sent. to avoid this, we could install another proxy between the sockscap and the sockschainer proxy that would filter out those things. A4proxy is an example of a proxy capable of doing such things.
BTW oblio, I posted the source.
Unlike you, I'm trying to help people.
Stop bitching and go away.
December 18th, 2001, 09:05 PM
R_A_ gave credit to where he took it from - he is fine with what he did. BTW, good job R_A_.
[shadow]uraloony, Founder of Loony Services[/shadow]
Visit us at