Purpose
Use this skill when the engagement explicitly permits a proxy path and the current goal is to force a tool through that approved route.
Phase Fit
- Primary: Validation and Controlled Impact Demonstration
- Secondary: Retest and Closure
Use When
- Need to ensure a tool uses an approved proxy or SOCKS path.
- Need to validate segmented reachability through a named pivot path.
- Need repeatable routing for retest.
Avoid When
- The proxy path is not explicitly approved.
- The wrapped tool scope exceeds the approved target boundary.
Inputs
- Approved proxy or SOCKS route
- Wrapped tool and exact target scope
- Stop conditions and evidence needs
Procedure
- Confirm the proxy path is approved and operational.
- Wrap only the minimum tool and target needed.
- Record the exact route and wrapped command used.
- Stop once the path question is answered.
- Preserve the route and command for retest.
Command Syntax
Replace sample commands with approved in-scope tools and targets.
# Configure SOCKS5 proxy in /etc/proxychains.conf:
# socks5 127.0.0.1 1080
# Tunnel nmap TCP connect scan (no SYN scans through SOCKS)
proxychains nmap -sT -Pn -n -p 22,80,443,3389,8080 192.168.1.100
# Tunnel netexec SMB scan
proxychains netexec smb 192.168.1.0/24 -u auditor -p '<password>'
# Tunnel curl
proxychains curl http://192.168.1.100/
# Tunnel evil-winrm
proxychains evil-winrm -i 192.168.1.100 -u auditor -p '<password>'
# Tunnel SSH
proxychains ssh auditor@192.168.1.100
# Use proxychains4 with dynamic chain
proxychains4 nmap -sT -Pn 192.168.1.100
Evidence to Capture
- Whether the approved proxy path worked for the named tool
- Exact route and wrapped command used
- Minimal proof needed for remediation
Safety Boundaries
- Use only with explicit written approval.
- Wrap only tools and targets already approved in scope.