3

I'm testing nmap's abilities, I started a socks5 proxy server with danted, and started it on port 10090

I tried the following command, and expect it to tell me port 10090 runs a socks server,

nmap ubuntu -p 10900 -sV -A

But it only tells me the port is open.

%> nmap ubuntu -p 10900 -sV -A

Starting Nmap 7.01 ( https://nmap.org ) at 2016-03-18 12:45 CST
Nmap scan report for ubuntu (172.16.177.200)
Host is up (0.00026s latency).
PORT      STATE SERVICE VERSION
10900/tcp open  unknown

Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 6.76 seconds

Did I miss something? It works perfectly if the socks server listens on port 1080

4

Nmap detects SOCKS proxies via 2 service probes defined in the nmap-service-probes file:

Probe TCP Socks4 q|\x04\x01\x00\x16\x7f\x00\x00\x01root\x00|
rarity 8
ports 199,1080,1090,1095,1100,1105,1109,3128,6588,6660-6669,8000,8008,8080,8088

and

Probe TCP Socks5 q|\x05\x04\x00\x01\x02\x80\x05\x01\x00\x03\x0agoogle.com\x00\x50GET / HTTP/1.0\r\n\r\n|
rarity 8
ports 199,1080,1090,1095,1100,1105,1109,3128,6588,6660-6669,7777,8000,8008,8010,8080,8088,9481

These probes will be sent to the ports listed. The rarity 8 part means that they will only run on non-matching ports if you specified a --version-intensity of 8 or more. The default is 7, the maximum is 9.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.