1080 - Pentesting Socks
Basic Information
SOCKS relays traffic between a client and a destination through a proxy. SOCKS5 negotiates authentication methods, supports TCP CONNECT and BIND, and can relay UDP through UDP ASSOCIATE. Username/password authentication is a separate optional sub-negotiation. socks5h is a client convention that asks the proxy to resolve hostnames, avoiding local DNS resolution.[1][2]
Default Port: 1080
Enumeration
Authentication Check
nmap -p 1080 <ip> --script socks-auth-infoThe Nmap script reports the SOCKS5 authentication methods offered by the server.[3]
Brute Force
Basic usage
nmap --script socks-brute -p 1080 <ip>Advanced usage
nmap --script socks-brute --script-args userdb=users.txt,passdb=rockyou.txt,unpwdb.timelimit=30m -p 1080 <ip>Output
PORT STATE SERVICE
1080/tcp open socks
| socks-brute:
| Accounts
| patrik:12345 - Valid credentials
| Statistics
|_ Performed 1921 guesses in 6 seconds, average tps: 320Hydra module
hydra -L users.txt -P passwords.txt -s 1080 -t 16 -V <ip> socks5Method & open-proxy enumeration
nmap -sV --script socks-methods,socks-open-proxy -p 1080 <ip>socks-methods asks the server about supported authentication types, while socks-open-proxy attempts an outbound connection to confirm whether the service can be abused as a relay.[3][4]
Raw handshake check
printf '\x05\x01\x00' | nc -nv <ip> 1080The three-byte request is VER=05, NMETHODS=01, METHOD=00. A successful two-byte reply of \x05\x00 selects no authentication; \x05\x02 selects username/password; \x05\xff means no offered method is acceptable.[1][2]
Quick egress validation
curl --socks5-hostname <ip>:1080 https://ifconfig.me
curl --socks5-hostname user:pass@<ip>:1080 http://internal.targetUse --socks5-hostname (or socks5h:// URLs) so DNS resolution happens remotely. Pair it with proxychains4 -q nmap -sT -Pn --top-ports 200 <internal-host> to verify whether the proxy truly provides internal reach.
Internet-wide discovery / fingerprinting
masscan 0.0.0.0/0 -p1080 --banners --rate 100000 -oX socks.xmlFeed results back into NSE, zgrab2, or custom python scripts to prioritize promising hosts (e.g., banner strings like 3proxy, Dante, MikroTik).
Tunneling and Port Forwarding
For info about tunneling and post forwarding check the page: Tunneling and Port Forwarding