Socks - Port 1080
Last updated
Was this helpful?
Last updated
Was this helpful?
Become VeryLazyTech ! 🎁
Follow us on:
✖ Twitter .
👾 Github .
📜 Medium .
📺 YouTube .
📩 Telegram .
🕵️♂️ My Site .
Visit our for e-books and courses. 📚
Penetration testing SOCKS proxies is a vital aspect of assessing the security of networked environments where anonymity and traffic relaying are employed. SOCKS proxies (SOCKSv4, SOCKSv5) are often used in environments that aim to obscure source IPs or facilitate internal network access through tunneling. In this guide, we explore every practical angle of pentesting SOCKS proxies, from enumeration and fingerprinting to authentication bypasses and pivoting techniques.
SOCKS is a transport layer proxy protocol that relays traffic between a client and server through a proxy server. Two main versions are commonly in use:
SOCKS4: Supports TCP only and lacks authentication.
SOCKS5: Supports TCP/UDP, domain name resolution, and various authentication methods (e.g., username/password, GSSAPI).
The typical ports used include 1080, but custom configurations may use non-standard ports.
Initial discovery can be performed using mass scanning techniques or through Shodan and Censys. To verify a suspected SOCKS proxy:
For more aggressive testing:
Use tools such as nmap, proxycheck, or custom Python scripts to identify whether the proxy supports SOCKSv4 or SOCKSv5.
SOCKSv5 may implement various authentication schemes. Testing includes:
If the server accepts no-auth (00):
Use hydra or medusa for brute-force attacks:
In some configurations, proxies accept arbitrary credentials. This can be detected by repeatedly submitting invalid data and analyzing responses.
proxychains
Route traffic through SOCKS proxies
nmap
Enumeration, script-based testing
msfconsole
Proxy-aware exploits and modules
socat
Port forwarding, chaining proxies
hydra
Credential brute-forcing on SOCKSv5
proxycheck
Identify open SOCKS proxies
When internal access is possible via SOCKS:
Use Metasploit with route add and SOCKS proxy modules.
Then chain internal scans via:
Then test access via proxychains:
Test internal HTTP apps, DNS services, and SMB shares:
Configure proxy in Metasploit:
Then launch modules like exploit/windows/smb/ms17_010_eternalblue.
In complex environments, multiple proxies may be chained:
Or using socat:
Learn & practice
Become VeryLazyTech ! 🎁
✖ Twitter .
👾 Github .
📜 Medium .
📺 YouTube .
📩 Telegram .
🕵️♂️ My Site .
Visit our for e-books and courses. 📚