{"id":47699711,"url":"https://github.com/vladkotov92/unseen","last_synced_at":"2026-04-21T09:00:53.556Z","repository":{"id":347577579,"uuid":"1194513203","full_name":"vladkotov92/Unseen","owner":"vladkotov92","description":"Route your internet traffic anonymously through the Tor network, directly from your terminal.","archived":false,"fork":false,"pushed_at":"2026-04-10T13:42:07.000Z","size":17,"stargazers_count":1,"open_issues_count":0,"forks_count":0,"subscribers_count":0,"default_branch":"main","last_synced_at":"2026-04-10T15:26:47.888Z","etag":null,"topics":["bash","bash-script","bash-scripting","bashtool","cybersecurity","cybersecurity-tools","ethical-hacking","ethical-hacking-tools","ethicalhacking","ipaddresschanger","ipchanger","kali-linux-tools","privacy","privacy-enhancing-technologies","privacy-protection","privacy-tools","unseen"],"latest_commit_sha":null,"homepage":"https://russianboy.netlify.app/","language":"Shell","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"mit","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/vladkotov92.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null,"notice":null,"maintainers":null,"copyright":null,"agents":null,"dco":null,"cla":null}},"created_at":"2026-03-28T13:11:12.000Z","updated_at":"2026-04-10T14:04:42.000Z","dependencies_parsed_at":"2026-04-02T18:04:33.880Z","dependency_job_id":"b56e2fbc-11bc-4513-a83f-1b765112bd01","html_url":"https://github.com/vladkotov92/Unseen","commit_stats":null,"previous_names":["vladkotov92/unseen"],"tags_count":4,"template":false,"template_full_name":null,"purl":"pkg:github/vladkotov92/Unseen","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/vladkotov92%2FUnseen","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/vladkotov92%2FUnseen/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/vladkotov92%2FUnseen/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/vladkotov92%2FUnseen/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/vladkotov92","download_url":"https://codeload.github.com/vladkotov92/Unseen/tar.gz/refs/heads/main","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/vladkotov92%2FUnseen/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":286080680,"owners_count":31922399,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-04-16T18:22:33.417Z","status":"online","status_checked_at":"2026-04-17T02:00:06.879Z","response_time":62,"last_error":null,"robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":true,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["bash","bash-script","bash-scripting","bashtool","cybersecurity","cybersecurity-tools","ethical-hacking","ethical-hacking-tools","ethicalhacking","ipaddresschanger","ipchanger","kali-linux-tools","privacy","privacy-enhancing-technologies","privacy-protection","privacy-tools","unseen"],"created_at":"2026-04-02T17:03:42.828Z","updated_at":"2026-04-21T09:00:53.549Z","avatar_url":"https://github.com/vladkotov92.png","language":"Shell","readme":"# Unseen\n\nRoute your internet traffic anonymously through the Tor network, directly from your terminal.\n\n```\n  _    _ _   _  _____ ______ ______ _   _\n | |  | | \\ | |/ ____|  ____|  ____| \\ | |\n | |  | |  \\| | (___ | |__  | |__  |  \\| |\n | |  | | . ` |\\___ \\|  __| |  __| | . ` |\n | |__| | |\\  |____) | |____| |____| |\\  |\n  \\____/|_| \\_|_____/|______|______|_| \\_|\n\n```\n\n\u003e Unseen is not a traditional VPN — it is a Tor-based anonymizer that routes your traffic through the onion network.\n\n## What it does\n\n- Starts a Tor process on your machine\n- Optionally rotates your IP automatically at a chosen interval\n- Optionally enables a Kill Switch to block all traffic if Tor drops unexpectedly\n- Lets you choose a fixed exit node country, or let Tor pick automatically (only when rotation is disabled)\n- Detects if Tor ignores the exit node constraint and lets you retry or switch\n- Routes all network traffic through the Tor SOCKS5 proxy (`127.0.0.1:9050`)\n- **DNS leak protection** — forces every DNS query through Tor's `DNSPort` so your ISP cannot see what you're resolving\n- **Transparent proxy** (Linux) — redirects all TCP traffic through Tor via `iptables` NAT, so every application is routed through Tor even if it ignores system proxy settings\n- **Split tunneling** — list domains or IPs in `domains.txt` to bypass Tor for specific destinations (useful for streaming, banking, or sites that block Tor)\n- Shows your anonymous IP, country, region and city once connected\n- On exit (`CTRL+C`), automatically stops Tor and resets all proxy, DNS and firewall settings\n\n## Installation\n\nClone the repository and run the installer:\n\n```bash\ngit clone https://github.com/vladkotov92/unseen.git\ncd unseen\nbash install.sh\n```\n\n## Usage\n\n```bash\nbash unseen.sh\n```\n\nOn virtual machines (VMs), configure the browser's Network Settings to use Manual proxy configuration. Set the SOCKS Host to 127.0.0.1 and the Port to 9050.\n\nOn every run you will be asked a series of questions before connecting:\n\n**1. IP rotation**\n\n```\n[?] Enable IP rotation? [y/n]:\n```\n\n**If you choose `y`**, you will be asked how often to rotate (in seconds):\n\n```\n[?] Rotate every how many seconds? (min 10):\n```\n\nTor will start with a random exit node and automatically change identity at the specified interval, refreshing your IP and location info each time.\n\n**2. Kill Switch**\n\n```\n[?] Enable Kill Switch? (blocks all traffic if Tor drops) [y/n]:\n```\n\nIf enabled, all outbound traffic is blocked the moment Tor drops unexpectedly — your real IP is never exposed. On **Linux** this is enforced via `iptables`; on **macOS** via a background monitor that triggers an immediate disconnect.\n\n**3. Exit node country** *(only when rotation is disabled)*\n\n```\n[+] Exit node country (e.g. US, DE, NL, FR, IT)\n    Press ENTER to let Tor choose automatically:\n```\n\nType a country code (e.g. `DE`, `NL`, `US`) or press `ENTER` to let Tor choose automatically.\n\nOnce connected you will see:\n\n```\nConnection active\n──────────────────────\nIP:      192.42.116.100\nCountry: The Netherlands\nRegion:  North Holland\nCity:    Amsterdam\n──────────────────────\n\nPress CTRL+C to disconnect  |  CTRL+R to restart\n```\n\nIf the requested exit country is unavailable, the script will detect it and ask:\n\n```\n[!] Tor ignored StrictNodes: got DE instead of RU\n\n[?] What do you want to do?\n    1) Choose a different country\n    2) Let Tor choose automatically\n    Choice [1/2]:\n```\n\nPress `CTRL+C` at any time to disconnect. The script will automatically stop Tor and restore your original network settings.\n\nPress `CTRL+R` at any time to do a full restart — cleans up Tor, the Kill Switch, the transparent proxy and the DNS overrides, then re-runs the script from the beginning so you can choose new settings.\n\n## DNS leak protection\n\nDNS leak protection is **always enabled** — no prompt, no opt-out.\n\nTor is configured with `DNSPort 9053` and `AutomapHostsOnResolve 1`, so it acts as a local DNS resolver that routes queries through the onion network.\n\n- On **Linux**, `/etc/resolv.conf` is locked (`chattr +i`) to `nameserver 127.0.0.1` and an `iptables` NAT rule redirects all port 53 traffic (UDP/TCP) to `127.0.0.1:9053`. Your ISP never sees a single DNS query.\n- On **macOS**, every active network service has its DNS servers overridden to `127.0.0.1` via `networksetup -setdnsservers`, with the original values backed up and restored on exit.\n\n## Transparent proxy (Linux)\n\nOn Linux, Unseen adds a transparent proxy layer so that **every application** — including browsers that ignore system proxy settings — goes through Tor.\n\nIt works by:\n- Adding `TransPort 9040` and `VirtualAddrNetworkIPv4 10.192.0.0/10` to Tor's config\n- Creating an `iptables` NAT chain (`UNSEEN_TP`) that redirects all outgoing TCP traffic to `127.0.0.1:9040`, while:\n  - Leaving Tor's own traffic untouched (matched by its system user, e.g. `debian-tor`)\n  - Skipping loopback and private LAN ranges\n  - Redirecting Tor's virtual address range (`10.192.0.0/10`) back to the TransPort\n\nRequires a dedicated Tor system user (`debian-tor`, `tor`, or `_tor`) to avoid traffic loops. The installer ensures Tor is installed from your distro's package manager, which creates this user automatically.\n\nOn macOS the transparent proxy is not needed — `networksetup -setsocksfirewallproxy` applies system-wide and browsers honor it.\n\n## Split tunneling\n\nUnseen supports split tunneling via a plain-text file at the repo root: `domains.txt`.\n\nAny destination listed there **bypasses Tor** and uses your real connection. Useful for:\n- Streaming services that block Tor exits (Netflix, banking portals)\n- Local servers, NAS, internal corporate resources\n- Any site that flat-out refuses Tor traffic\n\n### Format\n\nOne entry per line. Comments start with `#`. Three formats are accepted:\n\n```text\n# Domain name (resolved to its real IP at script startup)\ngithub.com\n\n# IPv4 address\n1.1.1.1\n\n# CIDR range (Linux only)\n192.168.10.0/24\n```\n\n### How it works\n\n- **Linux**: domains are resolved with `getent ahostsv4` *before* DNS is dirottato on Tor. The resolved IPs are written to `/etc/hosts` (so future lookups skip Tor) and added as `RETURN` rules in the `UNSEEN_TP` iptables NAT chain. If the Kill Switch is active, the same IPs are also added as `ACCEPT` rules in `UNSEEN_KS`.\n- **macOS**: domains are resolved with `dscacheutil -q host` and written to `/etc/hosts`. All entries are also added to every network service's SOCKS proxy bypass list via `networksetup -setproxybypassdomains`.\n\nBoth platforms back up `/etc/hosts` (and the macOS bypass lists) before modifying them and restore them cleanly on exit.\n\n### Caveats\n\n- **IPs are resolved once at script startup.** If the domain's IPs change (common with large CDNs like Cloudflare), press `CTRL+R` to reload `domains.txt`.\n- Browsers cache DNS — you may need to restart the browser (or flush its internal DNS cache) after enabling/disabling split tunneling for an already-open session.\n- If the destination is in `domains.txt` but still appears to go through Tor, check `sudo iptables -t nat -L UNSEEN_TP -n` (Linux) or `networksetup -getproxybypassdomains \u003cservice\u003e` (macOS).\n\n## Testing for leaks\n\nOnce connected, verify that everything is actually routed through Tor:\n\n1. **IP check** — https://check.torproject.org\n   Should say *\"Congratulations. This browser is configured to use Tor.\"*\n2. **DNS leak test** — https://dnsleaktest.com → run the *Extended test*\n   You should see **only** Tor exit-relay resolvers. No ISP, Google (`8.8.8.8`), or Cloudflare (`1.1.1.1`) resolvers.\n3. **IPv6 / WebRTC** — https://ipleak.net\n   The IP shown must match the Tor exit node, not your real address.\n4. **Split tunnel check** — with a domain (e.g. `ifconfig.me`) listed in `domains.txt`:\n   ```bash\n   curl ifconfig.me                                   # → your real IP (bypassed Tor)\n   curl --socks5 127.0.0.1:9050 https://icanhazip.com # → a Tor exit IP\n   ```\n\n## Exit node country codes\n\nSome countries have many reliable exit nodes, others have few or none.\n\n| Works well                   | Unreliable or unavailable               |\n| ---------------------------- | --------------------------------------- |\n| `NL`, `DE`, `FR`, `SE`, `CH` | `RU`, `CN`, `IR`, `BY`                  |\n| `US`, `CA`, `FI`, `GB`, `AT` | (blocked or removed from Tor consensus) |\n\n## How it works\n\n1. Asks whether to enable IP rotation\n2. Asks whether to enable the Kill Switch\n3. If rotation is disabled, asks for an exit node country (optional); if enabled, exit node is picked randomly\n4. Writes a `torrc` with `SocksPort 9050`, `DNSPort 9053`, and (on Linux) `TransPort 9040`\n5. Stops any existing Tor instance to avoid conflicts\n6. Starts Tor and waits for a full bootstrap (100%)\n7. Enables the SOCKS5 proxy on all active network interfaces\n8. Reads `domains.txt` (if present) — resolves any domains to real IPs while the original DNS is still active, writes `/etc/hosts` entries and records the IPs for firewall exceptions\n9. Locks system DNS to `127.0.0.1` so all queries go through Tor's DNSPort\n10. (Linux) Installs `iptables` NAT rules to transparently redirect all TCP + DNS traffic through Tor, with `RETURN` exceptions for the split tunnel IPs\n11. If Kill Switch is enabled, enforces traffic blocking rules (Linux: `iptables` chain with `ACCEPT` for split tunnel IPs; macOS: background monitor)\n12. Fetches your anonymous IP and location through the Tor circuit\n13. Verifies the exit country matches the requested one (only when rotation is off) — if not, prompts to retry\n14. If rotation is on, changes Tor identity and refreshes connection info at the chosen interval\n15. On exit, tears down in reverse order: Kill Switch → transparent proxy → split tunnel (`/etc/hosts` + bypass list) → DNS overrides → SOCKS proxy → Tor process\n\n## Notes\n\n- Your exit node IP may differ between requests — this is normal Tor behavior\n- `StrictNodes 1` tells Tor to only use the specified country, but some countries have no usable exit nodes and Tor may fall back to another country\n- Some websites may block known Tor exit nodes\n\n## Developer\n\n**A Russian Boy**  \nGitHub: [https://github.com/vladkotov92](https://github.com/vladkotov92)\n\n## License\n\nMIT — see [LICENSE](LICENSE)\n","funding_links":[],"categories":[],"sub_categories":[],"project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fvladkotov92%2Funseen","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fvladkotov92%2Funseen","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fvladkotov92%2Funseen/lists"}