Take the 2-minute tour ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.

Is it possible to runnmap via Tor?

When I googled around, I got the impression that Tor uses Polipo / Privoxy, which are socks5 proxies. So any TCP / UDP aware applications should be able to use them as a gateway to route their traffic. But somewhere it also said that nmap uses raw packets, so it can't be run over Tor!

share|improve this question

1 Answer 1

up vote 6 down vote accepted

Short answer

Yes it is possible, use tsocks nmap -sT IP

Long answer

First of all Tor doesn't use privoxy, Tor provides an socks proxy for connecting via the Tor network.

This means you won't see any network routes or things like that on your system but you have to configure your applications to use the Tor socks proxy to connect via Tor.

Typical Tor installations have privoxy or other proxy serves to provide HTTP Proxies as some browsers try to resolve the hostname locally if they are using a socks proxy. But these http proxy servers have nothing to do with connecting arbitrary applications through Tor.

Applications like tsocks allow to use arbitrary applications to connect via the Tor network. This is done by hooking into specific syscalls like connect and connect them automatically via the socks proxy. This only works if the program uses the specific syscalls and is dynamically linked.

To use nmap via Tor you have to use a program like tsocks to redirect the connections via the socks proxy and use a scanning options which uses the connect syscall. Fortunately nmap provides the -sT option:

-sT (TCP connect scan)

TCP connect scan is the default TCP scan type when SYN scan is not an option. This is the case when a user does not have raw packet privileges.

So yes it is possible to run specific nmap scans (the TCP connect scan) via the TOR network if you use tsocks.

share|improve this answer
    
You can also use the --unprivileged argument, which will prevent Nmap from doing any strange things with sockets that require privilege, making it more likely that your scan will work through the proxy. –  bonsaiviking Aug 5 '12 at 21:49

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.