ops-proxyns

OPS-PROXYNS — 内核级代理 / OPSEC 保护

为什么选择 proxy-ns 而不是 proxychains

功能	proxychains	proxy-ns
支持 Go/Rust 静态二进制文件	否（LD_PRELOAD 会失效）	是（内核命名空间）
DNS 泄漏保护	部分	完全
UDP 隔离	否	是
可被应用绕过	是（直接使用套接字）	否
IPv6 泄漏	常见	已阻止
所有流量类型	仅 TCP	TCP+UDP+DNS+ICMP

proxy-ns 使用 Linux 网络命名空间，将进程的所有流量通过 Tor 代理路由。应用无法检测或绕过它，只能看到 Tor 出口节点的 IP。

---

安装

# Prerequisites
sudo apt update && sudo apt install -y tor proxychains4 git make gcc curl

# Clone and build proxy-ns
git clone https://github.com/OkamiW/proxy-ns.git /tmp/proxy-ns
cd /tmp/proxy-ns
CGO_ENABLED=0 make
sudo cp proxy-ns /usr/local/bin/

# Configure Tor
sudo tee /etc/tor/torrc << 'EOF'
SOCKSPort 9050
ControlPort 9051
CookieAuthentication 0
DataDirectory /var/lib/tor
EOF

# Restart Tor
sudo systemctl restart tor 2>/dev/null || sudo tor &
sleep 3

---

基本用法

# Run a single command through Tor
sudo proxy-ns curl --max-time 30 --connect-timeout 10 -s ifconfig.me
# Output: [Tor exit node IP]

# Run a full shell through Tor (ALL commands go through Tor)
sudo proxy-ns $SHELL

# Inside the proxy-ns shell:
curl --max-time 30 --connect-timeout 10 -s ifconfig.me   # Tor IP
nmap -sT target.com   # Works (Go binary)
masscan 10.0.0.0/24 -p80 --rate 100  # Works
python3 -c "import requests; print(requests.get('https://ifconfig.me').text)"  # Works
whois target.com      # Works (DNS queries also routed through Tor)

---

Tor 电路轮换

# Rotate to a new exit node IP
echo -e "AUTHENTICATE\r\nSIGNAL NEWNYM\r" | nc -w1 127.0.0.1 9051
sleep 2

# Verify new IP
sudo proxy-ns curl --max-time 30 --connect-timeout 10 -s ifconfig.me

自动轮换脚本

#!/bin/bash
# rotate-tor.sh — Rotate Tor circuit and wait for new IP
rotate() {
    echo -e "AUTHENTICATE\r\nSIGNAL NEWNYM\r" | nc -w1 127.0.0.1 9051
    sleep $(awk -v min=3 -v max=8 'BEGIN{srand(); print int(min+rand()*(max-min+1))}')
}
NEW_IP=$(sudo proxy-ns curl --max-time 30 --connect-timeout 10 -s ifconfig.me 2>/dev/null)
echo "[+] New Tor IP: $NEW_IP"

# Usage: rotate between every N requests

---

防止 IPv6 泄漏

proxy-ns 会自动阻止 IPv6。验证方法：

# Inside proxy-ns shell, test for leaks:
sudo proxy-ns bash -c '
  echo "=== IPv4 check ==="
  curl --max-time 30 --connect-timeout 10 -s ifconfig.me
  echo ""
  echo "=== IPv6 check (should fail) ==="
  curl --max-time 30 --connect-timeout 10 -6 -s ifconfig.me 2>&1 || echo "[OK] No IPv6"
  echo "=== DNS leak check ==="
  dig +short myip.opendns.com @resolver1.opendns.com
'

---

隐蔽请求头和抖动

始终使用轮换的 User-Agent，并在请求之间加入抖动：

# stealth_headers.py — Use inside proxy-ns shell
import requests, random, time

USER_AGENTS = [
    "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Chrome/[REDACTED_IP]",
    "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 Safari/605.1.15",
    "Mozilla/5.0 (X11; Linux x86_64; rv:121.0) Gecko/20100101 Firefox/121.0",
    "Mozilla/5.0 (iPhone; CPU iPhone OS 17_0 like Mac OS X) AppleWebKit/605.1.15",
]

ACCEPT_LANGS = ["en-US,en;q=0.9", "en-GB,en;q=0.8", "en-CA,en;q=0.7"]

def stealth_session():
    s = requests.Session()
    s.headers.update({
        "User-Agent": random.choice(USER_AGENTS),
        "Accept": "text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8",
        "Accept-Language": random.choice(ACCEPT_LANGS),
        "Accept-Encoding": "gzip, deflate",
        "Connection": "keep-alive",
        "Upgrade-Insecure-Requests": "1",
    })
    return s

def stealth_get(url, session=None, min_delay=2, max_delay=6):
    """Make a stealth GET with jitter"""
    s = session or stealth_session()
    time.sleep(random.uniform(min_delay, max_delay))
    return s.get(url, timeout=30)

# Usage:
# session = stealth_session()
# r = stealth_get("https://target.com/.env", session=session)

---

真实暴露风险

风险	发生方式	后果
IP 泄漏	服务器日志、WebRTC、DNS 泄漏	被封锁、跟踪
指纹识别	User-Agent、TLS 指纹（JA3）、请求头	被识别为机器人
速率限制	短时间内请求过多	IP 被永久封锁
蜜罐	向安全团队发出警报的虚假端点	法律行动
SIEM/Splunk	集中式日志检测到相关模式	向安全团队发出警报
Cloudflare WAF	连续出现大量 403/503	IP 被加入黑名单
被追踪的 SA 密钥	服务账号使用过度	密钥被撤销
GitHub API	搜索 API 查询过多	触发速率限制，令牌被撤销

测试前 OPSEC 检查清单

向目标发出任何请求之前：

[ ] VPN/Tor active and verified (ifconfig.me shows non-originating IP)
[ ] IP not leaking? (check https://ipleak.net)
[ ] DNS not leaking (dig myip.opendns.com @resolver1.opendns.com)
[ ] WebRTC disabled?
[ ] IPv6 disabled/blocked (curl -6 ifconfig.me should fail)
[ ] Generic and rotating User-Agent?
[ ] Random delay (2-6s jitter between requests)?
[ ] GitHub credentials NOT logged in (or use dedicated burner account)
[ ] Nmap using -sT (SYN scan -sS is unsupported via proxy)
[ ] proxy-ns shell active for ALL commands (not just curl)
[ ] GitHub credentials logged in only when needed?

---

速率限制保护

# Rotate IP between every N requests automatically
for i in $(seq 1 10); do
  echo "Request $i"
  sudo proxy-ns curl --max-time 30 --connect-timeout 10 -s "https://target.com/.env" > /dev/null
  sleep 3
done

# After 10 requests, rotate Tor circuit
echo -e "AUTHENTICATE\r\nSIGNAL NEWNYM\r" | nc -w1 127.0.0.1 9051
sleep 3
NEW_IP=$(sudo proxy-ns curl --max-time 30 --connect-timeout 10 -s ifconfig.me)
echo "[+] Rotated to IP: $NEW_IP"

---

在 proxy-ns 中进行侦察

在 proxy-ns 内运行整套侦察工具链：

# Start proxy-ns shell
sudo proxy-ns $SHELL

# Inside the protected shell:
TARGET="target.com"

# subfinder works (Go binary)
subfinder -d "$TARGET" -silent > subs.txt

# httpx works
cat subs.txt | httpx -silent -status-code > live.txt

# curl works
curl --max-time 30 --connect-timeout 10 -sk "https://$TARGET/.env" | grep -i "DB_PASSWORD"

# nuclei works
nuclei -l live.txt -t ~/nuclei-templates/ -severity critical,high

# Python requests work
python3 -c "
import requests
r = requests.get('https://target.com/wp-json/wp/v2/users')
print(r.status_code, len(r.text))
"

---

常见问题

问题	解决方案
sudo: proxy-ns: command not found	重新构建：cd /tmp/proxy-ns && sudo make install
Tor 未运行	sudo systemctl start tor 或 sudo tor &
端口 9050 上出现 Connection refused	检查 `sudo netstat -tlnp
Nmap SYN 扫描失败	使用 nmap -sT（TCP 连接扫描），而不是 -sS
Masscan 横幅抓取	使用 --source-ip，并指定主机上的接口 IP
Go 二进制文件仍显示真实 IP	确认已正确安装 proxy-ns：CGO_ENABLED=0 make
速度太慢（Tor 延迟）	Tor 本身速度较慢。增加抖动，或改用高端 VPN。

---

替代方案

如果 proxy-ns 无法在你的内核上运行：

# Level 1: proxychains (works for Python/curl, NOT for Go/static binaries)
sudo apt install proxychains4
proxychains4 curl ifconfig.me

# Level 2: Full VPN (best performance, worst OPSEC — VPN logs)
# Level 3: Tails OS / Whonix (entire OS is Tor-routed)
# Level 4: Dedicated pentest VPS (separate jurisdiction)

---

验证

1. 代理测试 — 确认代理连接正常：

   curl --max-time 30 --connect-timeout 10 -s --proxy "http://127.0.0.1:8080" "https://httpbin.org/ip" 2>/dev/null | python3 -m json.tool 2>/dev/null || echo "NOTE: no proxy configured locally"
   

2. DNS 泄漏测试 — 验证 DNS 解析路径：

   dig +short example.com 2>/dev/null | head -1 && echo "PASS: DNS resolution works" || echo "FAIL: dig not available"
   

所有测试均可验证代理是否就绪。

---

注意事项

• 代理未轮换 — 如果所有请求都使用同一个 IP，触发速率限制和 IP 封禁在所难免。请确认轮换确实有效。
• 代理日志包含凭据 — HTTP 代理会记录完整的请求 URL。分享前请确保代理日志已脱敏。
• 通过代理发生 DNS 泄漏 — 某些代理配置会导致 DNS 泄漏。执行敏感操作前，请使用与 dnsleaktest.com 等效的服务进行测试。
• 代理链延迟 — 多跳代理链会增加延迟，导致基于时序的攻击失效。运行对时间敏感的探测前，请测试吞吐量。
• 混淆 SOCKS 与 HTTP 代理 — SOCKS5 代理会隧道传输 TCP；HTTP 代理只会隧道传输 HTTP。请为对应协议选择正确的代理。