I'm working with proxychains (3.1 and 4). I have a VM that is running Squid Proxy 3.1.19. I have properly configured proxychains to use Squid Proxy, ie. 'http squidip squidport'. Proxychains works as expected in all conditions except one, if I try to connect to a port that is blocked from external networks through the proxy via proxychains it returns "connection refused".

In this case the VM has port 22 open to all networks, and port 80 open only to the host. I can connect to port 80 by configuring the Squid Proxy in my web browser, or by using the proxy option of other tools such as Nikto. I can route traffic via proxychains to port 22, but not port 80.

I don't believe the problem is with Squid Proxy, or I wouldn't be able to connect to internal ports from a web browser or other tool, it's just proxychains.

Proxychains is working properly for all other intents, I've ensured that the traffic is flowing through Squid Proxy to its destination. Yet it still wont connect to ports that aren't already externally accessible.

While I now know the port that's open in this case and other ways to connect to it, I want to be able to use nmap to scan through proxychains and discover that port 80 is open.

Has anyone seen this issue before? What could be causing proxychains to act like this?

Edit: I've found that the nmap --proxies setting behaves like proxychains. It routes through the HTTP proxy, but only lists ports that are externally accessible as open. I'm still confused at this because Nikto and Metasploit can find the internal port without any issues.

For those that want to test it themselves, this VM is available at https://www.vulnhub.com/entry/sickos-11,132/ but I have run into this issue before on other hosts.


For anyone else that runs in to this I figured it out. Proxychains uses the CONNECT to send it's requests to Squid Proxy. Squid Proxy is allowing any verb to pass through to ports that externally accessible, but only allowing certain verbs such as GET and HEAD to be used to connect to ports that externally blocked. The CONNECT verb receives a '403 forbidden' from the Squid Proxy, the request is never passed through to the port I'm trying to access.

To get around this I'm writing my own port scanner in bash that use netcat to send HEAD requests through the proxy.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.