GO KALI FREE

ProxyChains

Post Exploitation

Intermediatelow risk

ProxyChains forces TCP connections made by arbitrary applications to follow user-configured proxy networks (such as TOR or SOCKS4/5 configurations), useful for obfuscation and internal pivoting.

Installation

sudo apt install proxychains4

Basic Syntax

proxychains4 [program] [arguments]

Quick Facts

Full Name
ProxyChains-ng
License
GPL
Language
C
Interface
CLI (prepend to commands)
Category
Proxy Routing
Chaining
SOCKS4/5, HTTP, Dynamic/Strict/Random

Tool Overview

ProxyChains is a UNIX tool that forces network connections initiated by any TCP application to follow through user-defined proxy chains. It is essential for pivoting through networks and anonymizing penetration testing tools.

By intercepting the connect(), sendto(), and resolver functions via LD_PRELOAD, ProxyChains transparently routes traffic through proxy chains without requiring application modifications.

Common Commands

proxychains firefoxLaunch a program with its TCP connections forced through the proxy chain
proxychains4 nmap -sT -Pn 10.10.10.10Run a TCP connect scan tunneled through the proxy chain
proxychains -q curl http://example.comRun curl through the chain in quiet mode (suppress proxychains output)
proxychains -f /path/to/proxychains.conf nmap 10.10.10.10Use a specific configuration file instead of the default
proxychains ssh <USER>@10.10.10.10Tunnel an outbound SSH session through the proxy chain
proxychains nc 10.10.10.10 4444Route a raw TCP netcat connection through the chain
proxychains wget http://example.com/fileDownload a file over the proxy chain
proxychains sqlmap -u http://10.10.10.10/page?id=1Proxy a sqlmap request through the chain for anonymity/pivot
proxychains4 -q -f /etc/proxychains4.conf smbclient -L 10.10.10.10Enumerate SMB shares over the proxy chain quietly
cat /etc/proxychains4.confView the active proxychains-ng configuration
sudo nano /etc/proxychains4.confEdit the proxychains configuration (chain mode, DNS, ProxyList)
socks5 127.0.0.1 1080ProxyList entry: route through a local SOCKS5 proxy (e.g. an SSH -D tunnel)
socks4 127.0.0.1 9050ProxyList entry: route through a SOCKS4 proxy (e.g. Tor default port)
http 127.0.0.1 8080ProxyList entry: route through an HTTP CONNECT proxy (e.g. Burp)
socks5 127.0.0.1 1080 <USER> <PASS>ProxyList entry with SOCKS5 username/password authentication

Step-by-Step Guide

  1. 1Edit the configuration file located at /etc/proxychains4.conf
  2. 2Adjust the chaining rules and append your specific proxy addresses
  3. 3Save your changes and close the editor
  4. 4Prepend the command 'proxychains4' to any network tool to force it through the established route

Warnings

Use Cases

Anonymous Scanning

Route nmap through Tor or SOCKS proxies.

Pivoting

Chain through multiple compromised hosts.

Traffic Obfuscation

Hide source IP through proxy chains.

Access Restriction Bypass

Reach internal networks via intermediate hosts.

Key Features

Related Tools

Chisel

Maintaining Access

HTTP tunnel with SOCKS proxy.

sshuttle

Maintaining Access

Transparent VPN over SSH.

Socat

Maintaining Access

Advanced relay tool.

Frequently Asked Questions

What is ProxyChains used for?

ProxyChains forces any TCP-based application to route its traffic through a chain of SOCKS4/5 or HTTP proxies, enabling anonymous scanning, pivoting through multiple networks, and traffic obfuscation.

How does ProxyChains chain proxies?

ProxyChains supports three chaining modes: dynamic (skip dead proxies), strict (use all in order), and random (randomize proxy order). Configured in /etc/proxychains4.conf.

Does ProxyChains work with nmap?

Yes, but only TCP scans (-sT) work through ProxyChains because the tool cannot route raw packets. Use it with caution as scans through proxies are significantly slower.

Can I use ProxyChains with Tor?

Yes, configuring ProxyChains to use Tor's local SOCKS proxy (127.0.0.1:9050) is a common setup for anonymous scanning and browsing during security assessments.

Tags

#post-exploitation#pivoting#proxy#traffic-routing

Output Explanation

The console displays the routing path for each connection attempt, prefixed with [proxychains], confirming whether the network request succeeded or failed.

Ethical Usage Notice

This tool is designed for authorized security testing, educational purposes, and legitimate network administration only. Unauthorized access to computer systems is illegal.