Proxychains Cheat Sheet
Force TCP connections through SOCKS4/5 or HTTP proxies for pivoting during authorized internal assessments.
Overview
Proxychains-ng wraps CLI tools to route traffic through SOCKS/HTTP proxies—essential for reaching internal networks via compromised hosts or SSH dynamic forwards during authorized pivoting.
Authorized testing only. Use only on systems, networks, and accounts you own or have explicit written permission to test. Unauthorized access is illegal.
Install
sudo apt install -y proxychains4Essential commands
Run tool through proxy chain
proxychains4 nmap -sT -Pn 10.10.10.0/24proxychains4 smbclient -L //10.10.10.5 -Nproxychains4 curl http://internal.web/Common workflows
Attacker: dynamic SOCKS on 1080
ssh -D 1080 user@jump.hostsocks5 127.0.0.1 1080
proxychains4 nmap -sT -p 445,3389 10.10.10.5Chained proxies (multi-hop) —
# /etc/proxychains4.conf# strict_chain# proxy_dns# socks5 127.0.0.1 1080# socks5 10.10.10.100 1080proxychains4 impacket-psexec DOMAIN/user:pass@10.10.10.20socks5 127.0.0.1 9050
proxychains4 crackmapexec smb 10.10.10.0/24Enable proxy_dns in conf for hostname resolution via proxy
proxychains4 ldapsearch -x -H ldap://dc.target.local -b 'dc=target,dc=local'Flags reference
proxychains4 CMD | Run command via chain |
|---|---|
-f FILE | Alternate config file |
-q | Quiet mode |
strict_chain | Use proxies in order |
dynamic_chain | Skip dead proxies |
random_chain | Random proxy order |
proxy_dns | Resolve DNS through proxy |
socks4/5 host port | Proxy entry |
http host port | HTTP proxy entry |
remote_dns_subnet | DNS subnet routing |
Tips
- Only TCP is proxied; UDP/ICMP need other tunnels (e.g. socat, VPN).
- Prefer nmap -sT with proxychains; SYN scan (-sS) does not traverse SOCKS.
- Use proxychains4 -q to reduce noise in scripts.
- Test chain with proxychains4 curl -s ifconfig.me before long scans.
- Keep /etc/proxychains4.conf backups; comment unused proxy lines to avoid leaks to wrong hosts.