Tor and Proxies

Your IP address identifies where your traffic comes from. In authorized red-team work, research, or privacy contexts, you may need to obscure the source of your connections.

This lesson covers proxies and Tor, two foundational tools for hiding the origin of network traffic. We focus on how they work and their limits.

A proxy server sits between you and your destination. You send requests to the proxy, and it forwards them on your behalf, so the destination sees the proxy's IP instead of yours.

• HTTP proxy: handles web traffic.
• SOCKS proxy: protocol-agnostic, handles any TCP traffic.

A single proxy is weak for anonymity:

• The proxy operator sees your real IP and your destination, a single point that knows everything.
• Many free public proxies log traffic or inject content.
• Traffic between you and an HTTP proxy may be unencrypted.

Proxies are useful for redirection and bypassing simple filters, not for strong anonymity.

Tor (The Onion Router) is a network designed for anonymity. Instead of one hop, your traffic passes through three volunteer relays before reaching the destination.

No single relay knows both who you are and where you are going. This separation is the core of Tor's protection.

Tor wraps your data in layers of encryption, like an onion. Each relay peels off one layer to learn only the next hop:

• Guard (entry) node: knows your IP but not your destination.
• Middle relay: knows neither end, just the previous and next hop.
• Exit node: knows the destination but not your IP.

The easiest way is the Tor Browser, a hardened Firefox preconfigured for anonymity. For command-line tools, run the Tor service and route traffic through its local SOCKS proxy.

The exit node sees your traffic as it leaves Tor toward the destination. If you use unencrypted HTTP, a malicious exit node can read and modify it.

Always use HTTPS end-to-end over Tor. Tor anonymizes the source; it does not encrypt the final hop to a plain HTTP site.

Tor also hosts onion services (addresses ending in .onion). These services and their visitors are both anonymous, and the connection never leaves the Tor network, so there is no exit node exposure.

Onion services are reached only through Tor and are not indexed by normal search engines.

Tor protects network-level anonymity, but it does not protect against your own mistakes:

• Logging into a personal account deanonymizes you instantly.
• Browser plugins, JavaScript, or downloads can leak your real IP.
• Timing/correlation attacks by powerful adversaries can sometimes link traffic.

Anonymity is a system, not a single tool.

proxychains forces any command-line tool through one or more proxies, including Tor's SOCKS port. It is common in authorized pentests to route scans through a pivot.

Some networks block known Tor relays outright. Tor bridges are unlisted entry points that are harder to block.

Pluggable transports like obfs4 disguise Tor traffic so it does not look like Tor at all, helping users in heavily censored regions connect. These features matter when an adversary is actively trying to keep you off the network.

Reason about who can see what in the Tor circuit.

You learned how to hide traffic origin:

• Proxies forward your traffic but a single proxy sees everything; weak for anonymity.
• Tor uses three relays and layered onion encryption so no single node links you to your destination.
• The exit node can read unencrypted traffic; always use HTTPS.
• Tor does not protect against user mistakes; anonymity is a discipline.

Next: stacking VPNs and chaining for layered anonymity.