A proxy chain is a series of two or more proxy servers that a request passes through in order, so the destination site sees only the last proxy's IP address. The Tor network is a well-known example of routing traffic through multiple proxies.

In Tor, each relay knows only which relay gave it data, so no single relay sees the complete path.

How Proxy Chaining Works

The open-source tool proxychains-ng is a common way to chain proxies on UNIX systems:

  • How it hooks in: It hooks network functions in dynamically linked programs and redirects their connections through the listed proxies.
  • Protocols: It supports SOCKS4a, SOCKS5 and HTTP proxies, can mix types in one chain, and handles TCP only.
  • Chain order: Proxies can be used in a fixed order, in order while skipping dead proxies, or as a random selection of a length you set.

Trade-offs of Proxy Chaining

  • Harder to trace from the target: Chaining proxies that do not pass on client data makes it harder for the destination to trace the original requester.
  • More traces in the middle: Each intermediate hop can keep its own logs, which could still be used to trace the user.
  • False sense of security: If you do not know how every proxy in the chain handles data, the chain may protect less than it seems.
  • Speed: Every hop adds another network leg, which can raise latency.

Proxy Chains in Attacks and Defense

Attackers chain proxies to hide where malicious traffic comes from. MITRE ATT&CK tracks this as the Multi-hop Proxy technique (T1090.003).

  • Building blocks: Chains can use the Tor network, rented virtual private servers or compromised machines and routers.
  • Blocking: Network allow and block lists can stop traffic to known anonymity networks.
  • Detection: One signal is a tool that opens sessions to several nodes before it reaches the final destination.