Becoming the Hacker

Behind seven proxies

These days, it is fairly common for more mature companies to implement IDS, intrusion prevention systems (IPS), and security information and event management (SIEM) with alerting for when they detect abuse against a particular application. When an unknown IP is performing too many operations in a short time on a protected application, IDS or IPS may take action against the source. If we are conducting a password spraying attack, we may avoid lockouts but we're still hammering the server from one source: our machine.

A good way to evade these types of detection systems is to distribute the connection requests from the attacker machine over many IPs, which is commonly done by malicious actors through networks of compromised hosts. ...