PWNMI

Cheatsheets

Proxychains Cheat Sheet

Updated July 27, 2026 · Written by PWNMI — see About.

Proxychains forces any command-line tool's network traffic through a proxy — most often a SOCKS proxy set up over a compromised host — without that tool needing any built-in proxy support of its own. On an engagement, that's usually the difference between a tool only working on your attack box and being able to run it against a network you can only reach through a pivot.

Red Team / Offensive Use

Once you have a foothold and a SOCKS proxy set up (an SSH dynamic port forward, a Meterpreter autoroute and socks_proxy module, or a Chisel tunnel), proxychains lets you route tools that were never built with pivoting in mind — nmap, curl, even a full browser — through that tunnel to reach an internal network segment your attack box can't touch directly. It's the standard way to keep using your normal toolset after a pivot instead of relying only on what's available on the compromised host itself.

Established Cheatsheet

rofl0r/proxychains-ng — the actively maintained fork (the original proxychains project is unmaintained); covers configuration and chaining modes in the README.

PWNMI's Top 5 Use Cases

  • proxychains nmap -sT -Pn 10.10.10.0/24 — scan through a pivot; -sT (full TCP connect) is required since proxychains can't proxy raw SYN scans, and -Pn skips host discovery, which won't work through a proxy either
  • proxychains curl http://10.10.10.5 — reach an internal web service through the tunnel with a tool that has no native proxy config for the situation
  • proxychains firefox — browse an internal network segment through the proxy directly, useful for interacting with an internal web app rather than just curling it
  • proxychains4 -f /etc/proxychains4.conf nmap ... — specify a config file explicitly rather than relying on the default, useful when juggling multiple pivots with different configs
  • Edit /etc/proxychains4.conf to point at your actual proxy (socks5 127.0.0.1 1080 for an SSH -D dynamic forward) — the tool does nothing useful until this matches your actual tunnel

Next step

Set up the tunnel proxychains routes through first — see the Chisel cheatsheet for one common way to build that pivot, or domains and Cloudflare Tunnels for the reverse case of exposing a lab service outward instead. For why a SOCKS proxy needs proxychains at all, see Pivoting and Tunneling Fundamentals.