TechKnowSurge

VideoSecurityFree

Stealth Technique: Proxies

Proxy servers mask an attacker's true IP address by routing traffic through an intermediary, preventing defenders from tracing packets directly back to the source.

⚑ Complete this video to capture a CTF flag worth 1 point.

About this video

Effective operational security for an attacker depends heavily on preventing defenders from identifying the true origin of network traffic. Without any countermeasures, packets sent during an attack carry IP address information that can be examined and traced directly back to the source, exposing the attacker's location or infrastructure. Proxy servers address this vulnerability by acting as an intermediary between the attacker and the target network. When a proxy is in use, outbound packets are addressed to the proxy server's IP rather than to the attacker directly. Traffic flows to the proxy first and is then forwarded to its intended destination, and inbound responses follow the same path in reverse. From a defender's perspective, packet inspection reveals only the proxy's IP address, not the attacker's, effectively breaking the direct trail. This additional layer of indirection is a foundational method of covering tracks and maintaining anonymity during offensive operations.

What you'll learn

Explain how proxy servers are used by threat actors to obscure the origin of malicious traffic and evade attribution

What's covered

Proxy Servers

Purpose of Proxies
- Mask adversary address
- Add extra protection layer
How Packets Are Routed
- Destination IP required
- IP exposes adversary
Proxy Server Function
- Traffic routes to proxy first
- Then forwarded to adversary
- Hides direct IP address

Key terms

Proxy Server: An intermediary server that handles requests between clients and other servers, providing anonymity and content filtering.
IP Address: A numerical label assigned to each device connected to a network that uses the Internet Protocol.
Threat Actor: An individual or group responsible for a security incident or attack.
Packet: A unit of data formatted for transmission over a network, containing a header, payload, and sometimes a trailer.
Attribution: The process of identifying the individual, group, or nation-state responsible for a cyberattack or malicious activity.

Topics

Proxy Servers Threat Actor Techniques Ip Obfuscation Traffic Anonymization Attribution Evasion Network Security Stealth Techniques

Transcript

Another thing that we could cover our tracks with is proxy servers. In order for packets to be routed, there needs to be some sort of destination IP address, and that gets put on these as it comes to us as the adversary. Well, the defender in here will be able to easily take a look at those packets and see where the IP address is and track us down. So this can expose us, by having the IP addresses send it directly to us.

A proxy server helps shield us as the adversary. So here we are right here, and now we've got an extra layer: this proxy server. Now the destination IP addresses that go on all of these packets that are being sent is the IP address of the proxy server, not us directly. And then that can come to us. So there's an extra layer of security here. They can't track this data directly back to us.

So this is what proxy servers do, and it allows us to have that extra layer of protection for us as an adversary. Proxy servers are a way to mask our address, so the traffic will go to a proxy server and then come to us.

Read the full transcript Show less

About TechKnowSurge

TechKnowSurge builds IT and cybersecurity professionals through hands-on, concept-first training built around real understanding — not memorization. Free interactive tools, structured programs, and 25+ years of real-world experience, all in one place.

Explore free tools and programs →