3

This question already has an answer here:

My host machine IP : 192.168.0.108

Guest machine IP : 192.168.0.105

192.168.0.105 has a squid proxy at port 3128. Only through this proxy I can access 192.168.0.105:80 which can be used to detect shellshock vulnerability, which I already know.

But I tried nmap through proxy it doesn't work.

nmap with real porxy port 3128

sudo nmap -sV -p80 --script http-shellshock --proxy http://192.168.0.105:3128 192.168.0.105

Starting Nmap 7.60SVN ( https://nmap.org ) at 2018-02-10 12:28 IST
Nmap scan report for 192.168.0.105
Host is up (0.00039s latency).

PORT   STATE    SERVICE VERSION
80/tcp filtered http
MAC Address: 34:23:87:2D:DD:6B (Hon Hai Precision Ind.)

Observe it is filtered.

nmap with fake port number 3000

sudo nmap -sV -p80 --script http-shellshock --proxy http://192.168.0.105:3000 192.168.0.105

Starting Nmap 7.60SVN ( https://nmap.org ) at 2018-02-10 12:28 IST
Nmap scan report for 192.168.0.105
Host is up (0.00036s latency).

PORT   STATE    SERVICE VERSION
80/tcp filtered http
MAC Address: 34:23:87:2D:DD:6B (Hon Hai Precision Ind.)

Same results!!!

If I try to just check the port via proxy that also doesn't work

sudo nmap -sV -p80 --proxy http://192.168.0.105:3000 192.168.0.105

Starting Nmap 7.60SVN ( https://nmap.org ) at 2018-02-10 12:35 IST
Nmap scan report for 192.168.0.105
Host is up (0.00039s latency).

PORT   STATE    SERVICE VERSION
80/tcp filtered http
MAC Address: 34:23:87:2D:DD:6B (Hon Hai Precision Ind.)

Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 1.02 seconds

If I try nikto through proxy, using below command, it works fine.

$ nikto -useproxy http://192.168.0.105:3128 -h 192.168.0.105

WHen I used proxychains After editing its config file, it gave same output:

$ sudo proxychains nmap -sV 192.168.0.105 -p80
ProxyChains-3.1 (http://proxychains.sf.net)

Starting Nmap 7.60SVN ( https://nmap.org ) at 2018-02-10 13:26 IST
Nmap scan report for 192.168.0.105
Host is up (0.00039s latency).

PORT   STATE    SERVICE VERSION
80/tcp filtered http
MAC Address: 34:23:87:2D:DD:6B (Hon Hai Precision Ind.)

Am using Ubuntu 16.04 x64

marked as duplicate by Steffen Ullrich, forest, Anders, Graham Hill, Xiong Chiamiov Feb 12 '18 at 20:27

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.

  • 4
    Possible duplicate of Nmap through proxy, How to use nmap through proxychains? – Steffen Ullrich Feb 10 '18 at 7:33
  • That did not work – melvinjose Feb 10 '18 at 7:56
  • 2
    "That did not work" - I have no idea what you are talking about, i.e. what you've tried, what you've expected as result and what you've got as result. – Steffen Ullrich Feb 10 '18 at 8:00
  • I have editted my question. Please check – melvinjose Feb 10 '18 at 8:14
  • It looks like you did not follow the information in the accepted answers. To cite: "So you might need to skip the host discovery step if your targets are only accessible through the proxy (-Pn).". Again, I think this question is a duplicate since it stumbles over the same problems as described in the other questions. – Steffen Ullrich Feb 10 '18 at 9:07
4

nmap works mostly by observing the replies of the target host to abnormal packets on a wide range of ports.

Conversely, a HTTP proxy like Squid will only generate standard packets to very few ports (e.g. 80 and 443).

Imagine being the strongest man in the world, but that you needed to lift weights in a room you can't reach, by asking someone who's in there to lift them for you. All of a sudden, you can't "lift" very much, all your weightlifting tricks become useless, most of what you can do in your room seems not to help, and weights become "too heavy" even if you know that they aren't.

This is exactly what is happening here.

When using nmap through Squid, you're limited to whatever "scan" squid can do... and squid wasn't built to scan. Probably, just the equivalent of a simplified connect scan is left available.

4

In short: Nmap works on the tcp or udp layer, nikto works on the http layer, proxy is a function on the http layer.

Slightly longer: to traverse a proxy, the client needs to establish a http connection. Nmap only sends out ip packets and analyzes the responses.

  • So, are you saying I cannot use nmap to use proxy for pivoting? – melvinjose Feb 10 '18 at 7:57
  • In general, yes, but reading the answers to the question Steffen Ullrich linked to, I see that nmap has some proxy support. However, I think you need to have a good understanding of how the different protocols i the network stack works and interacts to get any useful information from this. – Rolf Rander Feb 10 '18 at 8:02

Not the answer you're looking for? Browse other questions tagged or ask your own question.