[margincall]

What is the safest way of not putting out footprints for a hacker?

[SIM-1986823]

I'd say a good VPN would be pretty good to invest in

[CyberStrike]

Well .. IP's are cheap combine that with a router using DDWRT which you gain root access to ... then you can have that IP redirect your scans of a target and forward results on to you. I should tell you that most SOHO devices also do not have a permanent memory so after you changed the prerouting once the device is rebooted it won't hold unto those configs. Also I always say have infrastructure, because let's say you have a legit domain with legit content from a provider well you can place your email/payload/exfil/teamserver behind that and using codesigning certs to get your payload through and SSL you will blend right in with the "normal" traffic".

Once inside of the target network I tend to use a 1:3 ratio, for each 1 attacking machine I have 3 machines inside the target network with no tools or data only changed the config to redirect to the next target from the attacking machine. So let's say that the admin wakes up finally and starts to look at their logs, they will focus on the machines redirecting our traffic. Windows can redirect and forward traffic not sure but generally these types of things are not really covered in CEH or most books and it ends up being learn it while you

Edit: Are you talking about a company to make it harder for someone to gather up info and start targeting their networks? Or just how does a hacker hide themselves?

[margincall]

Well .. IP's are cheap combine that with a router using DDWRT which you gain root access to ... then you can have that IP redirect your scans of a target and forward results on to you. I should tell you that most SOHO devices also do not have a permanent memory so after you changed the prerouting once the device is rebooted it won't hold unto those configs.  Also I always say have infrastructure, because let's say you have a legit domain with legit content from a provider well you can place your email/payload/exfil/teamserver behind that and using codesigning certs to get your payload through and SSL you will blend right in with the "normal" traffic".

Once inside of the target network I tend to use a 1:3 ratio, for each 1 attacking machine I have 3 machines inside the target network with no tools or data only changed the config to redirect to the next target from the attacking machine.  So let's say that the admin wakes up finally and starts to look at their logs, they will focus on the machines redirecting our traffic.  Windows can redirect and forward traffic not sure but generally these types of things are not really covered in CEH or most books and it ends up being learn it while you

Edit: Are you talking about a company to make it harder for someone to gather up info and start targeting their networks?  Or just how does a hacker hide themselves?

---

i was looking for the second option that you gave: " Or just how does a hacker hide themselves?".

[o hai there]

If you're really hardcore hiding your shit:
Never use the same password
Never use the same username
Linux
VPN
SOCKS 5
Linux Laptop on public wifi
with the hard drive wiped everytime you do something you don't want traced via DoD 5220.22-M ECE method

[CyberStrike]

---

i was looking for the second option that you gave: " Or just how does a hacker hide themselves?".

Well then the original answer should help out you can also set a dynamic DNS and use a vpn that allows tor then use that in conjunction with the DDWRT option that should pretty much keep you going.  We do this exact thing because often during scans IP's are blocked and if we just have say a VPN you will find yourself running out of IP's if their WAF or firewalls in general have a low tolerance. And tor well lots of sites block or ask for recaptcha but using maybe 8 redirects in this fashion you can scan a good sized corporate network.

Sidenote: It is amazing at the number of people who leave DDWRT devices to remote management and the default root passwd out there on the interwebz.  The redirects that I was talking about also can be used for xfil of data, of course don't go imaging a system then xfil that seen it so don't do it.