Socks Chains in Windows

this  tutorial  is an  attempt to  help you  re-route  all  internet  winsock
applications in ms windows trough a socks chain, thus making your connections
much more anonymous.

+----------------------+----------------------------------------------------+
|   SECURAX TUTORIAL   |         ANONYMOUS CONNECTIONS OVER THE NET:        |
|                      |               Socks Chains in Windows              |
+----------------------+----------------------------------------------------+
| written by Zoa_Chien |      HTML version with screenshots available at    |
| design by nostalg1c  |           http://www.securax.org/ZC/anon/          |
+----------------------+----------------------------------------------------+

__/ introduction ___________________________________________________________

this  tutorial  is an  attempt to  help you  re-route  all  internet  winsock
applications in ms windows trough a socks chain, thus making your connections
much more anonymous.

__/ theory _________________________________________________________________

the more different hops you make your data jump, the more difficult it will
be to trace it back. take this route for example:

     you --> socks1 --> socks2 --> socks3 --> ... --> socksx --> target

people who want to trace you will have to contact x persons to ask their them
for their logs. chances are one of them didn't log... and if they logged, the
ip seen by each host/socks is the ip of the previous host/socks in the chain.

this works for:
. icq-like tools
. ftp clients
. mail clients
. telnet clients
. portscanners
. (just about anything that uses the internet)

it doesn't work on most irc servers since  they often check for open wingates
and proxies.

__/ now let's do it ________________________________________________________

- first you need to find some boxes running wingate

     we look for  wingates since the default installation of wingate includes
     a non-logging socks  server on port 1080

     visit
     http://proxys4all.cgi.net/win-tel-socks.shtml       or
     http://www.cyberarmy.com/lists/wingate/             for some wide-known
     wingate ips, or even better: you could try to find some yourself.
     to do  this,  i would  suggest  you  use  'proxy hunter',  available for
     download at http://www.securax.org/ZC/anon/proxyht300beta5.exe
     be sure to look  for wingates (port 23)  and not  for socks,  as we only
     want wingate socks.

     you   could   also  use   wingatescan,   available   for   download   at
     http://www.securax.org/ZC/anon/wgatescan-22.zip

     speed is  very important  since we will be using  multiple socks, and we
     don't want  our programs  to time out. with  the  klever dipstick  tool,
     you can find out  which are the fastest  ones. (get the klever  dipstick
     program at http://klever.net/kin/static/dipstick.exe)

     Just fire off Dipstick.  Rightclick  in  the small green rectangular and
     choose  Show  main  window. To  import a list of wingates, just click on
     Advanced, choose Import List and select your file.
     You  can also  manually ping a  simple host  by clicking on Manual Ping.
     Use those wingates with the smallest average time. *duh*

- second, check  if   the  wingates  from  the  list  are actually running :)

     there are  a lot of  programs that can  help you with this,  one of them
     is    server    2000,    available    for    download    at
     http://freespace.virgin.net/david.wood6/Server/Server.htm

- third,  install  a  program  that  will  intercept all  outgoing networking
  calls.

     i  use the  great tool  sockscap for  this purpose.  you can  get it  at
     http://www.socks.nec.com/sockscap.html

     in the  setting, enter  this  as  socks server  : 127.0.0.1  port  8000.
     click  on  'socks  version  5'.  click  'resolve  all  names  remotely'.
     uncheck 'supported authentication'.

     in  the main  window, choose new  and then browse  to create a  shortcut
     for the internet client you want to give socks support.

     repeat this step for every program you want.

- install socks chainer

     download it at http://www.ufasoft.com/socks

     in the service  menu, click on new. enter 'Chain'  as name and '8000' as
     port to aclearcase/" target="_blank" >ccept connections on.

     click on  new and fill  in the ips of  the fastest  wingates you  found,
     but this time, use port 1080 for this (and not the port 23)

     using the  '<' and '>',  you can add and  remove socks.  be sure to test
     all socks  one by  one  before  adding  them  all to  the list  in once,
     because if  one of  them is  bad, you  chain will not work  and you will
     not be able to locate the bad socks in the chain.

     if all  of them  seem to  work, you  use the  '<' key  to add  them  all
     (mind  speed  problems. 4  or less  is fine.  i think  10 or  13 is  the
     limit put by tcp/ip)

__/ testing your anonymous setup ___________________________________________

to check  what socks  your computer  is connecting to, you can use x-ploiters
totostat (http://idirect.tucows.com/files/totostat_install.exe).
look for connections  to port 1080,  the remote ip  found there should be the
first ip found in your chain in sockschain.

use the shortcut  in sockscap that  points to your  browser, and connect  to
http://cavency.virtualave.net/cgi-bin/env.cgi or
http://internet.junkbuster.com/cgi-bin/show-http-headers

use your shortcut  in sockcap to  start your  telnet  client then  telnet to
ukanaix.cc.ukans.edu

you can also use https://sites.inka.de:8001/cgi-bin/pyca/browser-check.py to
test ssl or ftp.zedz.net to verify your ip via ftp.

in all the above cases, the remote server should show you the ip of the last
server in  the  sockschain.  if you  look at  the  sockschain  program while
surfing you should see the chain being built up.

__/ some final remarks ____________________________________________________

never use  internet explorer to do tricky  stuff as it might reveal your ip.
my personal favorite browser is opera 4.0 (http://www.opera.com/)

if   you  looked   carefully   to   what  is   displayed  when   you  go  to
the http://internet.junkbuster.com/cgi-bin/show-http-headers page, you might
have  noticed  that  a  lot  of  stuff  about  our  client  is  being  sent.
to avoid this, we  could install another proxy  between the sockscap and the
sockschainer proxy that would filter out those things.
A4proxy is an example of a proxy capable of doing such things.

remember, if you want to do the real stuff, better switch to linux.

Zoa_chien, 22/5/error
#securax on EFNET