1080 - Pentesting Socks

Tip

Jifunze na fanya mazoezi ya AWS Hacking:HackTricks Training AWS Red Team Expert (ARTE)
Jifunze na fanya mazoezi ya GCP Hacking: HackTricks Training GCP Red Team Expert (GRTE) Jifunze na fanya mazoezi ya Azure Hacking: HackTricks Training Azure Red Team Expert (AzRTE)

Support HackTricks

Taarifa za Msingi

SOCKS ni itifaki inayotumiwa kuhamisha data kati ya mteja na seva kupitia proxy. Toleo la tano, SOCKS5, linaongeza kipengele cha uthibitishaji chenye hiari, kuruhusu watumiaji waliothibitishwa pekee kufikia seva. Inashughulikia hasa proxy ya muunganisho wa TCP na kupitisha vifurushi vya UDP (kupitia amri ya UDP ASSOCIATE), ikifanya kazi kwenye tabaka la session (Layer 5) la modeli ya OSI. Wakati zana zinapoelea msaada kwa mpangilio wa socks5h, utatuaji wa DNS unalazimishwa kupitia proxy, kuzuia DNS leaks za ndani na kufanya iwe ngumu zaidi kupiga fingerprint kwenye mwenyeji wa asili.

Bandari ya chaguo-msingi: 1080

Enumeration

Authentication Check

nmap -p 1080 <ip> --script socks-auth-info

Brute Force

Matumizi ya msingi

nmap --script socks-brute -p 1080 <ip>

Matumizi ya juu

nmap  --script socks-brute --script-args userdb=users.txt,passdb=rockyou.txt,unpwdb.timelimit=30m -p 1080 <ip>

Output

PORT     STATE SERVICE
1080/tcp open  socks
| socks-brute:
|   Accounts
|     patrik:12345 - Valid credentials
|   Statistics
|_    Performed 1921 guesses in 6 seconds, average tps: 320

Moduli ya Hydra

hydra -L users.txt -P passwords.txt -s 1080 -t 16 -V <ip> socks5

Njia & uorodheshaji wa open-proxy

nmap -sV --script socks-methods,socks-open-proxy -p 1080 <ip>

socks-methods inalazimisha server kuorodhesha supported authentication types, wakati socks-open-proxy inajaribu outbound CONNECT ili kuthibitisha kama service inaweza kutumiwa kama relay.

Ukaguzi wa raw handshake

printf '\x05\x01\x00' | nc -nv <ip> 1080

Majibu ya \x05 01 00 yanaonyesha SOCKS5 inatoa “no authentication”. Kila \x00 ikifuatiwa na \x02 inamaanisha username/password inahitajika, jambo linalofaa kwa quickly fingerprinting vifaa vilivyo wazi kupitia scripts.

Uthibitishaji wa egress kwa haraka

curl --socks5-hostname <ip>:1080 https://ifconfig.me
curl --socks5-hostname user:pass@<ip>:1080 http://internal.target

Tumia --socks5-hostname (or socks5h:// URLs) ili utatuzi wa DNS ufanyike kwa mbali. Tumia pamoja na proxychains4 -q nmap -sT -Pn --top-ports 200 <internal-host> ili kuthibitisha kama proxy kwa kweli inatoa upatikanaji wa mtandao wa ndani.

Ugunduzi mpana wa Internet / fingerprinting

masscan 0.0.0.0/0 -p1080 --banners --rate 100000 -oX socks.xml

Rejesha matokeo kwa NSE, zgrab2, au script za python maalum ili kuipa kipaumbele hosts zenye uwezekano (kwa mfano, banner strings kama 3proxy, Dante, MikroTik).

Tunneling and Port Forwarding

Kwa taarifa kuhusu tunneling and post forwarding angalia ukurasa: Tunneling and Port Forwarding

Marejeleo

Tip

Jifunze na fanya mazoezi ya AWS Hacking:HackTricks Training AWS Red Team Expert (ARTE)
Jifunze na fanya mazoezi ya GCP Hacking: HackTricks Training GCP Red Team Expert (GRTE) Jifunze na fanya mazoezi ya Azure Hacking: HackTricks Training Azure Red Team Expert (AzRTE)

Support HackTricks