nmap through proxy doesn't work [duplicate]

Question

My host machine IP : 192.168.0.108

Guest machine IP : 192.168.0.105

192.168.0.105 has a squid proxy at port 3128. Only through this proxy I can access 192.168.0.105:80 which can be used to detect shellshock vulnerability, which I already know.

But I tried nmap through proxy it doesn't work.

nmap with real porxy port 3128

sudo nmap -sV -p80 --script http-shellshock --proxy http://192.168.0.105:3128 192.168.0.105

Starting Nmap 7.60SVN ( https://nmap.org ) at 2018-02-10 12:28 IST
Nmap scan report for 192.168.0.105
Host is up (0.00039s latency).

PORT   STATE    SERVICE VERSION
80/tcp filtered http
MAC Address: 34:23:87:2D:DD:6B (Hon Hai Precision Ind.)

Observe it is filtered.

nmap with fake port number 3000

sudo nmap -sV -p80 --script http-shellshock --proxy http://192.168.0.105:3000 192.168.0.105

Starting Nmap 7.60SVN ( https://nmap.org ) at 2018-02-10 12:28 IST
Nmap scan report for 192.168.0.105
Host is up (0.00036s latency).

PORT   STATE    SERVICE VERSION
80/tcp filtered http
MAC Address: 34:23:87:2D:DD:6B (Hon Hai Precision Ind.)

Same results!!!

If I try to just check the port via proxy that also doesn't work

sudo nmap -sV -p80 --proxy http://192.168.0.105:3000 192.168.0.105

Starting Nmap 7.60SVN ( https://nmap.org ) at 2018-02-10 12:35 IST
Nmap scan report for 192.168.0.105
Host is up (0.00039s latency).

PORT   STATE    SERVICE VERSION
80/tcp filtered http
MAC Address: 34:23:87:2D:DD:6B (Hon Hai Precision Ind.)

Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 1.02 seconds

If I try nikto through proxy, using below command, it works fine.

$ nikto -useproxy http://192.168.0.105:3128 -h 192.168.0.105

WHen I used proxychains After editing its config file, it gave same output:

$ sudo proxychains nmap -sV 192.168.0.105 -p80
ProxyChains-3.1 (http://proxychains.sf.net)

Starting Nmap 7.60SVN ( https://nmap.org ) at 2018-02-10 13:26 IST
Nmap scan report for 192.168.0.105
Host is up (0.00039s latency).

PORT   STATE    SERVICE VERSION
80/tcp filtered http
MAC Address: 34:23:87:2D:DD:6B (Hon Hai Precision Ind.)

Am using Ubuntu 16.04 x64

Answer 1

nmap works mostly by observing the replies of the target host to abnormal packets on a wide range of ports.

Conversely, a HTTP proxy like Squid will only generate standard packets to very few ports (e.g. 80 and 443).

Imagine being the strongest man in the world, but that you needed to lift weights in a room you can't reach, by asking someone who's in there to lift them for you. All of a sudden, you can't "lift" very much, all your weightlifting tricks become useless, most of what you can do in your room seems not to help, and weights become "too heavy" even if you know that they aren't.

This is exactly what is happening here.

When using nmap through Squid, you're limited to whatever "scan" squid can do... and squid wasn't built to scan. Probably, just the equivalent of a simplified connect scan is left available.

Answer 2

In short: Nmap works on the tcp or udp layer, nikto works on the http layer, proxy is a function on the http layer.

Slightly longer: to traverse a proxy, the client needs to establish a http connection. Nmap only sends out ip packets and analyzes the responses.