I always got proxies from proxylist websites but I never asked me how these sites discover new proxy. So how?
Looking over ProxyFire it seems like a good option. Although, I prefer using protocols rather than programs. So, looking through the features of ProxyFire, it performs some port scanning which Nmap can supply. Socks proxy servers scanning with Nmap.
Above I described how to discover SOCKS proxy servers by port scanning. Another, option would be looking through forums where users dump lists of SOCKS proxies. See, My-Proxy Forum.
Alternatively, the websites may host the proxies themselves. Either by servers volunteered to them, physical servers owned by them, or using data centre VPSs.