0

I have got a vps for test nmap over tor. I installed psad on the vps.

This is where 9050 port is listening (my desktop):

 roto Recv-Q Send-Q Local Address           Foreign Address         State       PID/Program 
 name    
 tcp        0      0 localhost:9050          0.0.0.0:*               LISTEN      -                   
 tcp        0      0 host.****.****:40966    tor-proxy-03.for-p:9002 ESTABLISHED -              

These are the nmap options I'm using:

sudo nmap --proxy socks4://127.0.0.1:9050 -sS -Pn 123.66.98.2 -p22,5555,6666,7777

note -Pn ( no icmp )

This is how I test my ip and it works

curl -x socks4://127.0.0.1:9050  ifconfig.io

this is what psad returns:

Mar 22 20:33:59 vm5656.server.net psad[14413]: src: 75.xx.xxx.2 signature match: 
"P2P Napster Client Data communication attempt" (sid: 563) tcp port: 6666
Mar 22 20:33:59 vm5656.server.net psad[14413]: src: 75.xx.xxx.2 signature match: 
"P2P Napster Client Data communication attempt" (sid: 564) tcp port: 5555
Mar 22 20:33:59 vm5656.server.net psad[14413]: src: 75.xx.xxx.2 signature match: 
"P2P Napster Client Data communication attempt" (sid: 562) tcp port: 7777
Mar 22 20:33:59 vm5656.server.net psad[14413]: scan detected (Nmap -sT or -sS 
scan): 75.xx.xxx.2 -> 123.66.98.2 tcp: [5555-7777] flags: SYN tcp pkts: 9 DL: 5

The psad can read my real ip 75.xx.xxx.2 and I don't understand maybe the wrong option on nmap Can yo help me ?Thanks

1

Tor cannot help you perform a SYN scan. Tor anonymizes client TCP connections and a SYN scan does not establish a full TCP connection. In this case nmap does not use your SOCKS proxy at all as it does not establish any TCP connections.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.