# Running nmap NSE scan through socks proxy

**URL:** https://legacy-community.ine.com/t/running-nmap-nse-scan-through-socks-proxy/1099
**Category:** Penetration Testing Professional
**Tags:** red
**Created:** [September 19, 2021, 7:52am UTC](https://legacy-community.ine.com/t/running-nmap-nse-scan-through-socks-proxy/1099 "2021-09-19T07:52:26Z")
**Posts on this page:** 4
**Page:** 1

<div class="post-metadata">

### Author: ![JasonNguyen](https://avatars.discourse-cdn.com/v4/letter/j/7bcc69/32.png) [@JasonNguyen](https://legacy-community.ine.com/u/JasonNguyen)
#### Post date: [September 19, 2021, 7:52am UTC](https://legacy-community.ine.com/t/running-nmap-nse-scan-through-socks-proxy/1099/1 "2021-09-19T07:52:26Z")

</div>

Hello guys,

I’m trying to scan vuln using Nmap NSE through socks proxy but Nmap doesn’t give me the result just port is up or host is up.

 ![image](https://us1.discourse-cdn.com/flex015/uploads/ine/original/1X/5114fc263c919c999f0b9422d2b133524f46996b.png)

anything else without NSE script is work

 ![image](https://us1.discourse-cdn.com/flex015/uploads/ine/original/1X/fee281437cd520c4674d2f1cbbc4de6672563076.jpeg)

My proxy server is a windows session on Metasploit with Administrator prvilege.  
I have done all the necessary for the socks proxy to work (autoroute, …)

Does anyone know how to have NSE script work?

Thanks in advance

---

<div class="post-metadata">

### Author: ![X0RW3LL](https://sea1.discourse-cdn.com/flex015/user_avatar/legacy-community.ine.com/x0rw3ll/32/190_2.png) [@X0RW3LL](https://legacy-community.ine.com/u/X0RW3LL)
#### Post date: [September 23, 2021, 1:32pm UTC](https://legacy-community.ine.com/t/running-nmap-nse-scan-through-socks-proxy/1099/2 "2021-09-23T13:32:15Z")

</div>

Have you tried using the `--proxies` flag with nmap instead of proxychains?  
It’s experimental, but it might serve your purpose. Check `man nmap` for the correct syntax.

---

<div class="post-metadata">

### Author: ![JasonNguyen](https://avatars.discourse-cdn.com/v4/letter/j/7bcc69/32.png) [@JasonNguyen](https://legacy-community.ine.com/u/JasonNguyen)
#### Post date: [September 23, 2021, 2:14pm UTC](https://legacy-community.ine.com/t/running-nmap-nse-scan-through-socks-proxy/1099/3 "2021-09-23T14:14:30Z")

</div>

Yes, I did. But it returned the same result

---

<div class="post-metadata">

### Author: ![X0RW3LL](https://sea1.discourse-cdn.com/flex015/user_avatar/legacy-community.ine.com/x0rw3ll/32/190_2.png) [@X0RW3LL](https://legacy-community.ine.com/u/X0RW3LL)
#### Post date: [September 23, 2021, 2:38pm UTC](https://legacy-community.ine.com/t/running-nmap-nse-scan-through-socks-proxy/1099/4 "2021-09-23T14:38:01Z")

</div>

As per the RFC, you should probably try using SOCKS version 5 as it adds suport for UDP.

> **TL;DR**
>
> This new protocol extends the SOCKS Version 4 model to include UDP,  
> and extends the framework to include provisions for generalized  
> strong authentication schemes, and extends the addressing scheme to  
> encompass domain-name and V6 IP addresses.

[https://datatracker.ietf.org/doc/html/rfc1928#section-2](https://datatracker.ietf.org/doc/html/rfc1928#section-2)