ops-proxyns

OPS-PROXYNS — Kernel-Level Proxy / OPSEC Protection

Why proxy-ns Over proxychains

Feature	proxychains	proxy-ns
Covers Go/Rust static binaries	NO (LD_PRELOAD fails)	YES (kernel namespace)
DNS leak protection	Partial	Complete
UDP isolation	NO	YES
Bypassable by app	YES (direct socket)	NO
IPv6 leak	Common	Blocked
All traffic types	TCP only	TCP+UDP+DNS+ICMP

proxy-ns uses Linux network namespaces to route ALL traffic from a process through a Tor proxy. The application has no way to detect or bypass it — it sees only the Tor exit node's IP.

---

Installation

# Prerequisites
sudo apt update && sudo apt install -y tor proxychains4 git make gcc curl

# Clone and build proxy-ns
git clone https://github.com/OkamiW/proxy-ns.git /tmp/proxy-ns
cd /tmp/proxy-ns
CGO_ENABLED=0 make
sudo cp proxy-ns /usr/local/bin/

# Configure Tor
sudo tee /etc/tor/torrc << 'EOF'
SOCKSPort 9050
ControlPort 9051
CookieAuthentication 0
DataDirectory /var/lib/tor
EOF

# Restart Tor
sudo systemctl restart tor 2>/dev/null || sudo tor &
sleep 3

---

Basic Usage

# Run a single command through Tor
sudo proxy-ns curl --max-time 30 --connect-timeout 10 -s ifconfig.me
# Output: [Tor exit node IP]

# Run a full shell through Tor (ALL commands go through Tor)
sudo proxy-ns $SHELL

# Inside the proxy-ns shell:
curl --max-time 30 --connect-timeout 10 -s ifconfig.me   # Tor IP
nmap -sT target.com   # Works (Go binary)
masscan 10.0.0.0/24 -p80 --rate 100  # Works
python3 -c "import requests; print(requests.get('https://ifconfig.me').text)"  # Works
whois target.com      # Works (DNS queries also routed through Tor)

---

Tor Circuit Rotation

# Rotate to a new exit node IP
echo -e "AUTHENTICATE\r\nSIGNAL NEWNYM\r" | nc -w1 127.0.0.1 9051
sleep 2

# Verify new IP
sudo proxy-ns curl --max-time 30 --connect-timeout 10 -s ifconfig.me

Automated Rotation Script

#!/bin/bash
# rotate-tor.sh — Rotate Tor circuit and wait for new IP
rotate() {
    echo -e "AUTHENTICATE\r\nSIGNAL NEWNYM\r" | nc -w1 127.0.0.1 9051
    sleep $(awk -v min=3 -v max=8 'BEGIN{srand(); print int(min+rand()*(max-min+1))}')
}
NEW_IP=$(sudo proxy-ns curl --max-time 30 --connect-timeout 10 -s ifconfig.me 2>/dev/null)
echo "[+] New Tor IP: $NEW_IP"

# Usage: rotate between every N requests

---

IPv6 Leak Prevention

proxy-ns automatically blocks IPv6. Verify:

# Inside proxy-ns shell, test for leaks:
sudo proxy-ns bash -c '
  echo "=== IPv4 check ==="
  curl --max-time 30 --connect-timeout 10 -s ifconfig.me
  echo ""
  echo "=== IPv6 check (should fail) ==="
  curl --max-time 30 --connect-timeout 10 -6 -s ifconfig.me 2>&1 || echo "[OK] No IPv6"
  echo "=== DNS leak check ==="
  dig +short myip.opendns.com @resolver1.opendns.com
'

---

Stealth Headers and Jitter

Always use rotating User-Agent and jitter between requests:

# stealth_headers.py — Use inside proxy-ns shell
import requests, random, time

USER_AGENTS = [
    "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Chrome/[REDACTED_IP]",
    "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 Safari/605.1.15",
    "Mozilla/5.0 (X11; Linux x86_64; rv:121.0) Gecko/20100101 Firefox/121.0",
    "Mozilla/5.0 (iPhone; CPU iPhone OS 17_0 like Mac OS X) AppleWebKit/605.1.15",
]

ACCEPT_LANGS = ["en-US,en;q=0.9", "en-GB,en;q=0.8", "en-CA,en;q=0.7"]

def stealth_session():
    s = requests.Session()
    s.headers.update({
        "User-Agent": random.choice(USER_AGENTS),
        "Accept": "text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8",
        "Accept-Language": random.choice(ACCEPT_LANGS),
        "Accept-Encoding": "gzip, deflate",
        "Connection": "keep-alive",
        "Upgrade-Insecure-Requests": "1",
    })
    return s

def stealth_get(url, session=None, min_delay=2, max_delay=6):
    """Make a stealth GET with jitter"""
    s = session or stealth_session()
    time.sleep(random.uniform(min_delay, max_delay))
    return s.get(url, timeout=30)

# Usage:
# session = stealth_session()
# r = stealth_get("https://target.com/.env", session=session)

---

Real Exposure Risks

Risk	How It Happens	Consequence
Leaked IP	Server logs, WebRTC, DNS leaks	Blocking, tracking
Fingerprinting	User-Agent, TLS fingerprint (JA3), headers	Identified as bot
Rate Limit	Too many requests in a short period	IP permanently blocked
Honeypot	Fake endpoint that alerts the security team	Legal action
SIEM/Splunk	Centralized logs detect patterns	Security team alerted
Cloudflare WAF	Many sequential 403/503	IP added to blacklist
Tracked SA Key	Excessive service account usage	Key revoked
GitHub API	Too many queries on the search API	Rate limit, token revoked

Pre-Test OPSEC Checklist

Before making ANY request to a target:

[ ] VPN/Tor active and verified (ifconfig.me shows non-originating IP)
[ ] IP not leaking? (check https://ipleak.net)
[ ] DNS not leaking (dig myip.opendns.com @resolver1.opendns.com)
[ ] WebRTC disabled?
[ ] IPv6 disabled/blocked (curl -6 ifconfig.me should fail)
[ ] Generic and rotating User-Agent?
[ ] Random delay (2-6s jitter between requests)?
[ ] GitHub credentials NOT logged in (or use dedicated burner account)
[ ] Nmap using -sT (SYN scan -sS is unsupported via proxy)
[ ] proxy-ns shell active for ALL commands (not just curl)
[ ] GitHub credentials logged in only when needed?

---

Rate Limiting Protection

# Rotate IP between every N requests automatically
for i in $(seq 1 10); do
  echo "Request $i"
  sudo proxy-ns curl --max-time 30 --connect-timeout 10 -s "https://target.com/.env" > /dev/null
  sleep 3
done

# After 10 requests, rotate Tor circuit
echo -e "AUTHENTICATE\r\nSIGNAL NEWNYM\r" | nc -w1 127.0.0.1 9051
sleep 3
NEW_IP=$(sudo proxy-ns curl --max-time 30 --connect-timeout 10 -s ifconfig.me)
echo "[+] Rotated to IP: $NEW_IP"

---

Recon Under proxy-ns

Run the entire recon toolchain inside proxy-ns:

# Start proxy-ns shell
sudo proxy-ns $SHELL

# Inside the protected shell:
TARGET="target.com"

# subfinder works (Go binary)
subfinder -d "$TARGET" -silent > subs.txt

# httpx works
cat subs.txt | httpx -silent -status-code > live.txt

# curl works
curl --max-time 30 --connect-timeout 10 -sk "https://$TARGET/.env" | grep -i "DB_PASSWORD"

# nuclei works
nuclei -l live.txt -t ~/nuclei-templates/ -severity critical,high

# Python requests work
python3 -c "
import requests
r = requests.get('https://target.com/wp-json/wp/v2/users')
print(r.status_code, len(r.text))
"

---

Common Pitfalls

Issue	Solution
sudo: proxy-ns: command not found	Rebuild: cd /tmp/proxy-ns && sudo make install
Tor not running	sudo systemctl start tor or sudo tor &
Connection refused on port 9050	Check `sudo netstat -tlnp
Nmap SYN scan fails	Use nmap -sT (TCP connect scan) instead of -sS
Masscan banner grabbing	Use --source-ip with an interface IP on the host
Go binaries still show real IP	Ensure proxy-ns is installed correctly: CGO_ENABLED=0 make
Too slow (Tor latency)	Tor is naturally slow. Increase jitter or use a premium VPN as alternative.

---

Alternatives

If proxy-ns doesn't work on your kernel:

# Level 1: proxychains (works for Python/curl, NOT for Go/static binaries)
sudo apt install proxychains4
proxychains4 curl ifconfig.me

# Level 2: Full VPN (best performance, worst OPSEC — VPN logs)
# Level 3: Tails OS / Whonix (entire OS is Tor-routed)
# Level 4: Dedicated pentest VPS (separate jurisdiction)

---

Verification

1. Proxy test — confirm proxy connectivity:

   curl --max-time 30 --connect-timeout 10 -s --proxy "http://127.0.0.1:8080" "https://httpbin.org/ip" 2>/dev/null | python3 -m json.tool 2>/dev/null || echo "NOTE: no proxy configured locally"
   

2. DNS leak test — verify DNS resolution path:

   dig +short example.com 2>/dev/null | head -1 && echo "PASS: DNS resolution works" || echo "FAIL: dig not available"
   

All tests verify proxy readiness.

---

Pitfalls

• Proxy not rotating — if the same IP is used for all requests, rate limiting and IP bans are inevitable. Verify rotation is actually working.
• Proxy logs containing credentials — HTTP proxies log full request URLs. Ensure proxy logs are sanitized before sharing.
• DNS leaks through proxy — some proxy configurations leak DNS. Test with dnsleaktest.com-equivalent before running sensitive operations.
• Proxy chain latency — multi-hop proxy chains add latency that breaks timing-based attacks. Test throughput before running time-sensitive probes.
• SOCKS vs HTTP proxy confusion — SOCKS5 proxies tunnel TCP; HTTP proxies only tunnel HTTP. Use the right proxy for the protocol.