Nmap 通过代理

信息安全 代理人 匿名 地图 网络扫描仪 ip欺骗
2021-08-12 07:51:14

使用以下命令:

nmap --proxy socks4://*.*.*.*:25074 -sV -O --reason scanme.nmap.org

我不确定 nmap 是否真的在使用指定的代理

在使用 netcat 侦听 nmap 参数中预定义的特定端口时扫描“localhost”或“127.0.0.1”的想法(除了上面的确切示例)但 netcat 不显示扫描的源地址,它只是回显 GET 请求(我想对于端口版本检测)

并且无论我将什么作为无效的袜子服务器 IP 地址与 nmap 一起放置,它仍然会进行扫描

并且不给出任何错误信息

如果我将袜子类型从 socks4 更改为 socks5,我收到的唯一错误消息是:

Invalid protocol in proxy specification string: socks5://*.*.*.*:25074
QUITTING!

也试过 tcpdump 但我没有找到数据包请求

所以我不确定它是否真的使用定义的袜子代理

如何确保 nmap 实际使用代理?

除了自己设置远程机器并对其进行扫描之外,还有其他方法可以确保它(我想它不应该在同一个局域网上,这目前很难完成)

使用代理链或通过 vpn 扫描时会发生同样的问题

在 Linux 上使用 Nmap 7.12 版

2个回答

TL;DR: proxy support is limited right now but there are also theoretical limits of what you could do when using a proxy.

nmap can do only CONNECT and SOCKS4 and these protocols can do only TCP. Apart from that using any kind of proxy means that nmap communicates with the IP stack of the proxy and not of the target. This means:

  • ICMP ping can not be done to see if a host is alive, since ICMP is not TCP. So you might need to skip the host discovery step if your targets are only accessible through the proxy (-Pn). Since (the unsupported) SOCKS5 ICMP does not support ICMP either this will not change in the future.
  • Service discovery can be done for TCP based services only. With SOCKS5 support this could be extended to UDP.
  • OS fingerprinting based on features of the IP stack is not possible because nmap does not speak with the targets IP stack when using a proxy, but instead with the proxies IP stack. This is a theoretical limit you have with any kind of proxy protocol.

For now, use an external tool like proxychains.

The nmap documentation for --proxies states, that the feature is not fully implemented yet:

Warning: this feature is still under development and has limitations. It is implemented within the nsock library and thus has no effect on the ping, port scanning and OS discovery phases of a scan. Only NSE and version scan benefit from this option so far—other features may disclose your true address. SSL connections are not yet supported, nor is proxy-side DNS resolution (hostnames are always resolved by Nmap).

You can follow this guide on how to use proxychains with nmap. After setting up a ProxyList, you will simply run the command from above like this:

proxychains nmap -sV -O --reason scanme.nmap.org

Still be careful about sidechannel identity leaks (such as DNS leaks), though. Adding the -n flag to prevent DNS resolutions by nmap might be a good practice.