1 ProxyChains-NG ver 4.16 README
2 =============================
4 ProxyChains is a UNIX program, that hooks network-related libc functions
5 in DYNAMICALLY LINKED programs via a preloaded DLL (dlsym(), LD_PRELOAD)
6 and redirects the connections through SOCKS4a/5 or HTTP proxies.
7 It supports TCP only (no UDP/ICMP etc).
9 The way it works is basically a HACK; so it is possible that it doesn't
10 work with your program, especially when it's a script, or starts
11 numerous processes like background daemons or uses dlopen() to load
12 "modules" (bug in glibc dynlinker).
13 It should work with simple compiled (C/C++) dynamically linked programs
16 If your program doesn't work with proxychains, consider using an
17 iptables based solution instead; this is much more robust.
19 Supported Platforms: Linux, BSD, Mac, Haiku.
22 *********** ATTENTION ***********
24 this program can be used to circumvent censorship.
25 doing so can be VERY DANGEROUS in certain countries.
27 ALWAYS MAKE SURE THAT PROXYCHAINS WORKS AS EXPECTED
28 BEFORE USING IT FOR ANYTHING SERIOUS.
30 this involves both the program and the proxy that you're going to
33 for example, you can connect to some "what is my ip" service
34 like ifconfig.me to make sure that it's not using your real ip.
36 ONLY USE PROXYCHAINS IF YOU KNOW WHAT YOU'RE DOING.
38 THE AUTHORS AND MAINTAINERS OF PROXYCHAINS DO NOT TAKE ANY
39 RESPONSIBILITY FOR ANY ABUSE OR MISUSE OF THIS SOFTWARE AND
40 THE RESULTING CONSEQUENCES.
44 # needs a working C compiler, preferably gcc
45 ./configure --prefix=/usr --sysconfdir=/etc
47 [optional] sudo make install
48 [optional] sudo make install-config (installs proxychains.conf)
50 if you dont install, you can use proxychains from the build directory
51 like this: ./proxychains4 -f src/proxychains.conf telnet google.com 80
56 - fix regression in configure script linker flag detection
57 - remove 10 year old workaround for wrong glibc getnameinfo signature
58 - support for new DYLD hooking method for OSX Monterey
59 - netbsd compilation fix
60 - support IPv6 localnets
61 - more user-friendly error message when execvp fails
62 - proxy_getaddrinfo(): fill in ai_socktype if requested
65 - fix configure script for buggy binutils version
66 - initialize rand_seed with nano-second granularity
67 - add support for numeric ipv6 in getaddrinfo
68 - fix bug in getaddrinfo when node is null and !passive
72 - add proxy_dns_old to emulate proxychains 3.1 behaviour
73 - add new proxy_dns_daemon feature (experimental)
77 - allow alternative proto://user:pass@ip:port syntax for proxylist
78 - fix endless loop in round robin mode when all proxies are down (#147)
79 - fix compilation on android (#265)
80 - fix fd leak in forked processes (#273)
81 - skip connection attempt to nullrouted ips
82 - allow hostnames for proxylist under specific circumstances
85 - fix robustness of DNS lookup thread and a segfault
86 - fix socks5 user/pass auth on non-conforming servers
88 - add support for Solaris
91 - fix several build issues
95 - compatibility fix for some GUI apps (8870140)
96 - compatibility fix for some HTTP proxies (cf9a16d)
97 - fix several warnings for cleaner build on debian
98 - fix random_chain on OSX (0f6b226)
101 - preliminary IPv6 support
102 - fixed bug in hostsreader
103 - preliminary support for usage on OpenBSD (caveat emptor)
106 - fix regression in linking order with custom LDFLAGS
107 - fix segfault in DNS mapping code in programs with > ~400 different lookups
110 - fix a security issue CVE-2015-3887
111 - add sendto hook to handle MSG_FASTOPEN flag
112 - replace problematic hostentdb with hostsreader
113 - fix compilation on OpenBSD (although doesn't work there)
116 - fix regression in 4.8 install-config Makefile target
119 - fix for odd cornercase where getaddrinfo was used with AI_NUMERICHOST
120 to test for a numeric ip instead of resolving it (fixes nmap).
121 - allow usage with programs that rely on LD_PRELOAD themselves
122 - reject wrong entries in config file
123 - print version number on startup
126 - new round_robin chaintype by crass.
127 - fix bug with lazy allocation when GCC constructor was not used.
128 - new configure flag --fat-binary to create a "fat" binary/library on OS X
129 - return EBADF rather than EINTR in close hook.
130 it's legal for a program to retry close() calls when they receive
131 EINTR, which could cause an infinite loop, as seen in chromium.
134 - some cosmetic fixes to Makefile, fix a bug when non-numeric ip was
135 used as proxy server address.
138 - hook close() to prevent OpenSSH from messing with internal infrastructure.
139 this caused ssh client to segfault when proxified.
143 - fixes some installation issues on Debian and Mac.
146 - fixes programs that do dns-lookups in child processes (fork()ed),
147 like irssi. to achieve this, support for compilation without pthreads
149 - fixes thread safety for gethostent() calls.
150 - improved DNS handling speed, since hostent db is cached.
153 - fixes compilation issues with ubuntu 12.04 toolchain
154 - fixes segfault in rare codepath
157 - support for mac os x (all archs)
158 - all internal functions are threadsafe when compiled with -DTHREAD_SAFE
162 - replaced dnsresolver script (which required a dynamically linked "dig"
163 binary to be present) with remote DNS lookup.
164 this speeds up any operation involving DNS, as the old script had to use TCP.
165 additionally it allows to use .onion urls when used with TOR.
166 - removed broken autoconf build system with a simple Makefile.
167 there's a ./configure script though for convenience.
168 it also adds support for a config file passed via command line switches/
169 environment variables.
172 - support for DNS resolving through proxy
173 supports SOCKS4, SOCKS5 and HTTP CONNECT proxy servers.
174 Auth-types: socks - "user/pass" , http - "basic".
177 1) When the only way to get "outside" from your LAN is through proxy server.
178 2) To get out from behind restrictive firewall which filters outgoing ports.
179 3) To use two (or more) proxies in chain:
180 like: your_host <--> proxy1 <--> proxy2 <--> target_host
181 4) To "proxify" some program with no proxy support built-in (like telnet)
182 5) Access intranet from outside via proxy.
183 6) To use DNS behind proxy.
184 7) To access hidden tor onion services.
188 * This program can mix different proxy types in the same chain
189 like: your_host <-->socks5 <--> http <--> socks4 <--> target_host
190 * Different chaining options supported
191 random order from the list ( user defined length of chain ).
192 exact order (as they appear in the list )
193 dynamic order (smart exclude dead proxies from chain)
194 * You can use it with most TCP client applications, possibly even network
195 scanners, as long as they use standard libc functionality.
196 pcap based scanning does not work.
197 * You can use it with servers, like squid, sendmail, or whatever.
198 * DNS resolving through proxy.
204 proxychains looks for config file in following order:
205 1) file listed in environment variable PROXYCHAINS_CONF_FILE or
206 provided as a -f argument to proxychains script or binary.
207 2) ./proxychains.conf
208 3) $(HOME)/.proxychains/proxychains.conf
209 4) $(sysconfdir)/proxychains.conf **
211 ** usually /etc/proxychains.conf
215 $ proxychains telnet targethost.com
217 in this example it will run telnet through proxy(or chained proxies)
218 specified by proxychains.conf
222 $ proxychains -f /etc/proxychains-other.conf telnet targethost2.com
224 in this example it will use different configuration file then proxychains.conf
225 to connect to targethost2.com host.
229 $ proxyresolv targethost.com
231 in this example it will resolve targethost.com through proxy(or chained proxies)
232 specified by proxychains.conf
236 - newer versions of nmap try to determine the network interface to use
237 even if it's not needed (like when doing simple syn scans which use the
238 standard POSIX socket API. this results in errors when proxychains hands
239 out an ip address to a reserved address space.
240 possible workarounds: disable proxy_dns, use a numeric ip, or use nmap's
241 native support for SOCKS proxies.
243 - Mac OS X 10.11 (El Capitan) ships with a new security feature called SIP
244 that prevents hooking of system apps.
245 workarounds are to partially disable SIP by issuing
246 csrutil enable --without debug in recovery mode,
247 or to copy the system binary into the home directory and run it from there.
248 see github issue #78 for details.
250 - the glibc dynlinker has a bug or security feature that inhibits dlopen()ed
251 modules from being subject to the same dlsym hooks as installed for the main
252 program. this mainly affects scripting languages such as perl or python
253 that heavily rely on dlopen() for modules written in C to work.
254 there are unconfirmed reports that it works as root though.
255 musl libc is unaffected from the bug.
260 #proxychains on irc.libera.chat
264 bitcoins donations are welcome - please send to this address:
265 1C9LBpuy56veBqw5N33sZMoZW8mwCw3tPh