Re: GSoC : Proxy support with working Code

[David Fifield <david () bamsoftware com>]

On Sun, Mar 28, 2010 at 10:55:15AM +0530, Rahul Golwalkar wrote:
> Hello Everyone,
>      Having used nmap for some time I realised the need for proxy support in
> nmap. Later I found out that the it was in the TODO list at
> http://nmap.org/svn/docs/TODO  (proxy server = relay server)
>     As such adding this facility will make nmap more useful as a security
> assessment tool and has got several advantages but had has got some
> difficulties too in achieving this ability. The benefits and the
> difficulties faced are classified as follows
>
> Benefits:
>      By adding this support one can route the port scanning through TOR or
> an anonymous proxy server, thus concealing his identity.
>      Secondly, any person who is forced to use internet via a proxy
> server(generally those people using internet while in some organization or
> institution) shall be able to use nmap normally.
>
> Difficulties:
>    Many times a proxy server does not support all the types of request. As
> in, by default a Squid proxy server will not support the CONNECT request on
> any port except for port 443. But I guess this short coming cannot be
> resolved easily.
>    The other problems faced are that it would be really difficult to program
> the SYN scanning or the FIN scanning as we cannot manipulate the packets
> that are sent by the proxy server.
>
> I have written a sample working code that works for the following set of
> constraints.
> The Proxy server should be an "http proxy server"(i.e. not SOCKS) and should
> support CONNECTing to all port numbers. And shall work only on port numbers
> less than 1024. The program tries to CONNECT to each port and waits for 5
> seconds for a response.
>
> I have used multithreading to speed up the port scanning using 10
> simultaneous threads(u may increase the threads to speed up the process)
> Here is a video of its demo. http://www.youtube.com/watch?v=p9lZ1NRN7c8
> I have tested it in Vista with Cygwin along with CCproxy as the proxy server
> ,as well as in Ubuntu with squid as the proxy server.  Am attaching the C
> source code as well as the windows binary.

This is good! It always helps when a proposal comes with working code.

What will be the syntax for choosing proxies on the command line?
Remember that proxy chaining must be supported. What about proxies that
require authentication?

What data structure will you use to represent a proxy (and proxy chain)?
It is data structures, and not algorithms, that drive programs.

Nmap's parallelism isn't based on threading. How does the proxy scan fit
in with the other scan modes? Is it just a modification of TCP connect
scan, or should it be considered a completely new scan type? Will is use
the existing scan_engine.cc engine, or will it require a new scanning
loop?

You might try the proof-of-concept proxy scanner from
svn co --username guest --password "" svn://svn.insecure.org/nmap-exp/ioerror/nmap-proxy
and comment on it.

For future reference, when a program just has simple text output, it's
better to just paste the output into your email than post a video.

David Fifield
_______________________________________________
Sent through the nmap-dev mailing list
http://cgi.insecure.org/mailman/listinfo/nmap-dev
Archived at http://seclists.org/nmap-dev/