DΛΣMӨП

// HackTricks · Network Services

1080 - Pentesting Socks

1080 - Pentesting Socks

Basic Information

SOCKS relays traffic between a client and a destination through a proxy. SOCKS5 negotiates authentication methods, supports TCP CONNECT and BIND, and can relay UDP through UDP ASSOCIATE. Username/password authentication is a separate optional sub-negotiation. socks5h is a client convention that asks the proxy to resolve hostnames, avoiding local DNS resolution.[1][2]

Default Port: 1080

Enumeration

Authentication Check

nmap -p 1080 <ip> --script socks-auth-info

The Nmap script reports the SOCKS5 authentication methods offered by the server.[3]

Brute Force

Basic usage

nmap --script socks-brute -p 1080 <ip>

Advanced usage

nmap  --script socks-brute --script-args userdb=users.txt,passdb=rockyou.txt,unpwdb.timelimit=30m -p 1080 <ip>

Output

PORT     STATE SERVICE
1080/tcp open  socks
| socks-brute:
|   Accounts
|     patrik:12345 - Valid credentials
|   Statistics
|_    Performed 1921 guesses in 6 seconds, average tps: 320

Hydra module

hydra -L users.txt -P passwords.txt -s 1080 -t 16 -V <ip> socks5

Method & open-proxy enumeration

nmap -sV --script socks-methods,socks-open-proxy -p 1080 <ip>

socks-methods asks the server about supported authentication types, while socks-open-proxy attempts an outbound connection to confirm whether the service can be abused as a relay.[3][4]

Raw handshake check

printf '\x05\x01\x00' | nc -nv <ip> 1080

The three-byte request is VER=05, NMETHODS=01, METHOD=00. A successful two-byte reply of \x05\x00 selects no authentication; \x05\x02 selects username/password; \x05\xff means no offered method is acceptable.[1][2]

Quick egress validation

curl --socks5-hostname <ip>:1080 https://ifconfig.me
curl --socks5-hostname user:pass@<ip>:1080 http://internal.target

Use --socks5-hostname (or socks5h:// URLs) so DNS resolution happens remotely. Pair it with proxychains4 -q nmap -sT -Pn --top-ports 200 <internal-host> to verify whether the proxy truly provides internal reach.

Internet-wide discovery / fingerprinting

masscan 0.0.0.0/0 -p1080 --banners --rate 100000 -oX socks.xml

Feed results back into NSE, zgrab2, or custom python scripts to prioritize promising hosts (e.g., banner strings like 3proxy, Dante, MikroTik).

Tunneling and Port Forwarding

For info about tunneling and post forwarding check the page: Tunneling and Port Forwarding

References