Scenario 6: Low-Footprint Alternatives — When Nmap Says "Filtered"

Position: Scanning through SOCKS proxy or in low-noise environments
Goal: Discover open ports and services when Nmap returns "filtered" — using tools that work through proxies or generate less noise

Visual Overview

graph TD
    A[Need to scan ports?] --> B{Through SOCKS proxy?}
    B -->|Yes| C[Naabu -proxy OR proxychains+nmap -sT]
    B -->|No| D{Need stealth / low noise?}
    D -->|Yes| E[Naabu rate 100-300 OR curl]
    D -->|No| F{Fast subnet sweep?}
    F -->|Yes| G[Masscan rate 500]
    F -->|No| H{CTF / lab speed?}
    H -->|Yes| I[RustScan]
    H -->|No| J[Standard nmap]

    style A fill:#ff6600
    style C fill:#00aa00
    style E fill:#00aa00
    style G fill:#ffaa00
    style I fill:#ff4444

Why Nmap Shows 'Filtered' Through Proxies

This is the most common confusion when scanning through SOCKS proxies. The short answer: you're using the wrong scan type.

The Core Problem: SYN Scan vs SOCKS Proxy

When you run proxychains nmap -sS <target>, here's what actually happens:

• -sS (SYN scan) sends raw IP-layer SYN packets directly from your machine
• SOCKS5 proxies operate at the application layer — they expect a full TCP connect() call
• Raw SYN packets never enter the TCP stream the proxy mediates
• The packets either bypass the proxy entirely or get dropped by the proxy's firewall
• Result: nmap reports "filtered" because it never gets a response through the proxy

The Solution: TCP Connect Scan

-sT (TCP CONNECT scan) works because:

1. Calls the OS connect() syscall
2. libc intercepts it
3. proxychains LD_PRELOAD hooks connect() → routes through SOCKS5
4. Full 3-way handshake completes at the target through the proxy
5. nmap gets a real open/closed/filtered determination

Scan Type Compatibility

Mandatory Flags for Proxy Scanning

Always use these together when scanning through a SOCKS proxy:

Tool Selection Guide

Risk indicators: 🟢 Low · 🟡 Medium · 🟠 Elevated · 🔴 High

Naabu

Naabu is a fast port scanner from ProjectDiscovery with native SOCKS5 proxy support, rate control, and direct nmap handoff. It's the go-to replacement when nmap returns "filtered" through a proxy.

Installation

# Binary download (recommended — no Go toolchain needed)
NAABU_VER=$(curl -s https://api.github.com/repos/projectdiscovery/naabu/releases/latest | grep '"tag_name"' | cut -d'"' -f4 | tr -d 'v')
curl -sL "https://github.com/projectdiscovery/naabu/releases/download/v${NAABU_VER}/naabu_${NAABU_VER}_linux_amd64.zip" -o /tmp/naabu.zip
unzip -q /tmp/naabu.zip naabu -d /usr/local/bin/ && chmod +x /usr/local/bin/naabu

# Go install (requires Go toolchain)
go install -v github.com/projectdiscovery/naabu/v2/cmd/naabu@latest

Commands

# Quiet targeted scan — top 20 ports, rate-limited
naabu -host 172.30.0.100 -top-ports 20 -rate 200 -silent

# TCP CONNECT scan (no root required)
naabu -host 172.30.0.100 -s c -top-ports 100 -rate 300 -silent

# SYN scan (requires root/NET_ADMIN — faster, lower noise)
sudo naabu -host 172.30.0.100 -s s -top-ports 100 -rate 200 -silent

# Through SOCKS proxy — native support, no proxychains needed
naabu -host 172.30.0.100 -proxy 172.30.0.60:1080 -top-ports 20 -silent

# JSON output for pipeline processing
naabu -host 172.30.0.100 -top-ports 100 -json -silent

# Nmap handoff — discover ports fast, then deep-scan only open ones
echo 172.30.0.100 | naabu -silent -nmap-cli 'nmap -sV -sC -oA nmap-output'

# All ports scan
naabu -host 172.30.0.100 -p - -rate 500 -silent

# Passive mode (Shodan lookup — zero packets sent)
naabu -host example.com -passive -silent

OPSEC Risk

Key Flags

Pitfalls

Pipeline Integration

# Naabu → nmap (discover fast, enumerate deep)
naabu -host 172.30.0.100 -p - -rate 1000 -silent -o ports.txt
ports=$(cat ports.txt | cut -d: -f2 | tr '\n' ',' | sed 's/,$//')
nmap -p "$ports" -sV -sC 172.30.0.100

# Naabu → httpx (find web services)
echo 172.30.0.100 | naabu -silent | httpx -silent

# Subfinder → Naabu → httpx (full external recon pipeline)
subfinder -d example.com -silent | naabu -silent | httpx -silent

RustScan

RustScan is an ultra-fast port scanner designed for speed — it finds open ports in seconds then hands off to nmap for service detection. It has NO native SOCKS proxy support (GitHub issue #407). Use it for CTF/lab environments where speed matters more than stealth.

Installation

# .deb package (Ubuntu/Debian)
RUSTSCAN_VER=$(curl -s https://api.github.com/repos/RustScan/RustScan/releases/latest | grep '"tag_name"' | cut -d'"' -f4)
curl -sL "https://github.com/RustScan/RustScan/releases/download/${RUSTSCAN_VER}/rustscan_${RUSTSCAN_VER#v}_amd64.deb" -o /tmp/rustscan.deb
dpkg -i /tmp/rustscan.deb

# Docker (no install needed)
docker run -it --rm --ulimit nofile=5000 rustscan/rustscan -a 172.30.0.100

Commands

# Basic scan — top 1000 ports
rustscan -a 172.30.0.100

# With ulimit (CRITICAL — prevents "too many open files" error)
sudo rustscan --ulimit 5000 -a 172.30.0.100

# Stealth mode — slow batch, long timeout
rustscan -a 172.30.0.100 -b 10 -T 5000   # 10 ports/batch, 5s timeout

# Port range
rustscan --ulimit 5000 -a 172.30.0.100 --range 1-1000

# Nmap handoff — full service detection
sudo rustscan --ulimit 5000 -a 172.30.0.100 -- -sV -sC

# Full enum with scripts
sudo rustscan --ulimit 5000 -a 172.30.0.100 -- -n -Pn -sV --script "default,safe,vuln"

OPSEC Risk

Key Flags

Pitfalls

Masscan

Masscan uses its own TCP/IP stack for extreme speed — it can scan the entire internet in under 6 minutes. In lab environments, use low rates (100-500 pps) to avoid overwhelming targets and missing ports.

Installation

# Ubuntu/Debian
apt-get install -y masscan

# macOS
brew install masscan

# Build from source
git clone https://github.com/robertdavidgraham/masscan && cd masscan && make

Commands

# Targeted scan — common ports, controlled rate
sudo masscan -p80,443,8080,22,21,25 172.30.0.100 --rate=500

# Port range scan
sudo masscan -p1-1000 172.30.0.100 --rate=100

# Full port scan (all 65535)
sudo masscan -p1-65535 172.30.0.100 --rate=1000

# Specify interface (required on VPN/tun0)
sudo masscan -p1-1000 172.30.0.100 --rate=500 -e eth0

# Banner grabbing
sudo masscan -p80 172.30.0.100 --banners --source-port 61000

# Output formats
sudo masscan -p1-1000 172.30.0.100 --rate=500 -oL masscan.txt   # list format
sudo masscan -p1-1000 172.30.0.100 --rate=500 -oX masscan.xml   # XML
sudo masscan -p1-1000 172.30.0.100 --rate=500 -oJ masscan.json  # JSON

Port Extraction Pipeline

# Extract open ports from masscan list output → feed to nmap
sudo masscan -p1-65535 172.30.0.100 --rate=1000 -oL mscan.txt
ports=$(awk '/open/ {print $3}' mscan.txt | sort -un | tr '\n' ',' | sed 's/,$//')
nmap -p "$ports" -sV -sC 172.30.0.100

OPSEC Risk

Key Flags

Pitfalls

curl

curl is not a port scanner, but it's the lowest-footprint tool for HTTP service verification. It blends with normal web traffic, supports SOCKS5 natively, and provides timing metrics for latency analysis.

Commands

# HTTP status code check
curl -s -o /dev/null -w "%{http_code}" --connect-timeout 3 http://172.30.0.100/

# Response headers (service fingerprinting)
curl -sI --connect-timeout 3 http://172.30.0.100/

# Page title grab
curl -sL http://172.30.0.100/ | grep -i '<title>'

# Multi-port HTTP check loop
for port in 80 443 8080 8443 8888; do
  code=$(curl -sk -o /dev/null -w "%{http_code}" --connect-timeout 2 http://172.30.0.100:$port/ 2>/dev/null)
  echo "port $port: $code"
done

# Banner grab via telnet:// scheme (raw TCP)
curl -s --connect-timeout 2 telnet://172.30.0.100:22

# Timing metrics (latency analysis)
curl -s -o /dev/null -w "Connect: %{time_connect}s  Total: %{time_total}s  Code: %{http_code}\n" \
  --connect-timeout 5 http://172.30.0.100/

# Through SOCKS proxy (native support)
curl -s --socks5 172.30.0.60:1080 http://172.30.0.100/

# HTTPS through proxy (ignore cert)
curl -sk --socks5 172.30.0.60:1080 https://172.30.0.100/

# Parallel checks with xargs
echo -e "80\n443\n8080\n8443" | xargs -P4 -I{} curl -sk -o /dev/null \
  -w "port {}: %{http_code}\n" --connect-timeout 2 http://172.30.0.100:{}/

OPSEC Risk

Key Flags

Pitfalls

Proxy Scanning

Scanning through a SOCKS proxy requires specific tool choices and flags. See Why Nmap Shows 'Filtered' Through Proxies for the technical explanation. This section covers the practical commands.

Mandatory Flags Reference

When scanning through any SOCKS proxy, these flags are non-negotiable:

proxychains + nmap

The standard approach for tools without native proxy support. Uses a runtime config to avoid modifying the system-wide /etc/proxychains4.conf.

# Create runtime proxychains config (do NOT modify /etc/proxychains4.conf)
docker exec noise-attacker bash -c \
  'printf "strict_chain\nproxy_dns\n[ProxyList]\nsocks5 172.30.0.60 1080\n" > /tmp/proxychains-socks.conf'

# Basic proxy scan — top 20 ports
proxychains4 -f /tmp/proxychains-socks.conf -q nmap -sT -Pn -n --top-ports 20 -T2 172.30.0.100

# Quick recon with reason codes
proxychains4 -f /tmp/proxychains-socks.conf -q nmap -sT -Pn -n --top-ports 100 -T2 --reason 172.30.0.100

# Service detection through proxy
proxychains4 -f /tmp/proxychains-socks.conf -q nmap -sT -Pn -n -sV -T2 \
  --script=banner,http-title --data-length 50 -f 172.30.0.100

# Full port scan through proxy (slow — use only when needed)
proxychains4 -f /tmp/proxychains-socks.conf -q nmap -sT -Pn -n -p- -T2 \
  --reason --data-length 40 -f 172.30.0.100

Naabu Native Proxy (Recommended)

Naabu has built-in SOCKS5 support — no proxychains needed:

# Port scan through SOCKS proxy
naabu -host 172.30.0.100 -top-ports 20 -proxy 172.30.0.60:1080 -silent

# Full port scan through proxy
naabu -host 172.30.0.100 -p - -proxy 172.30.0.60:1080 -rate 200 -silent

# Reach internal-only target via proxy
naabu -host 172.30.1.100 -top-ports 20 -proxy 172.30.0.60:1080 -silent

curl Through SOCKS

For HTTP service verification through proxy:

# HTTP check through SOCKS
curl -s --socks5 172.30.0.60:1080 http://172.30.0.100/

# HTTPS (ignore cert)
curl -sk --socks5 172.30.0.60:1080 https://172.30.0.100/

# Status code only
curl -s --socks5 172.30.0.60:1080 -o /dev/null -w "%{http_code}" http://172.30.0.100/

# Reach internal-only target (not directly accessible from attacker)
curl -s --socks5 172.30.0.60:1080 http://172.30.1.100/ --connect-timeout 5

OPSEC Risk

proxychains4 Configuration Reference

# Minimal config for SOCKS5 proxy
strict_chain
proxy_dns
[ProxyList]
socks5 172.30.0.60 1080

# Dynamic chain (skip unavailable proxies)
dynamic_chain
proxy_dns
[ProxyList]
socks5 172.30.0.60 1080

# Multi-hop chain
strict_chain
proxy_dns
[ProxyList]
socks5 172.30.0.60 1080
socks5 172.30.1.50 1080

Multi-Stage Pipelines

The real power of these tools comes from chaining them together: fast discovery → deep enumeration → service fingerprinting.

The 4-Stage Workflow

Stage 1: Fast port discovery    → Naabu or Masscan (seconds)
Stage 2: Deep nmap enumeration  → nmap -sV -sC on discovered ports only (minutes)
Stage 3: HTTP service enum      → httpx on web ports (seconds)
Stage 4: Targeted scripts       → nmap NSE or manual checks

Naabu → nmap (Recommended)

# Discover all open ports fast, then deep-scan only those
naabu -host 172.30.0.100 -p - -rate 1000 -silent -o /tmp/ports.txt
ports=$(cat /tmp/ports.txt | cut -d: -f2 | tr '\n' ',' | sed 's/,$//')
nmap -p "$ports" -sV -sC 172.30.0.100

# One-liner using naabu's built-in nmap handoff
echo 172.30.0.100 | naabu -silent -nmap-cli 'nmap -sV -sC -oA /tmp/nmap-output'

Masscan → nmap

# Masscan for fast discovery, nmap for deep enumeration
sudo masscan -p1-65535 172.30.0.100 --rate=1000 -oL /tmp/mscan.txt
ports=$(awk '/open/ {print $3}' /tmp/mscan.txt | sort -un | tr '\n' ',' | sed 's/,$//')
nmap -p "$ports" -sV -sC 172.30.0.100

Naabu → httpx (Web Service Discovery)

# Find all web services across a subnet
echo 172.30.0.100 | naabu -silent | httpx -silent

# With status codes and titles
echo 172.30.0.100 | naabu -silent | httpx -status-code -title -silent

Proxy Pipeline (Through SOCKS)

# Discover ports through proxy, then enumerate via proxy
naabu -host 172.30.0.100 -p - -proxy 172.30.0.60:1080 -silent -o /tmp/proxy-ports.txt
ports=$(cat /tmp/proxy-ports.txt | cut -d: -f2 | tr '\n' ',' | sed 's/,$//')
proxychains4 -f /tmp/proxychains-socks.conf -q nmap -sT -Pn -n -p "$ports" -sV -T2 172.30.0.100

Port Extraction One-Liners

# From naabu output (format: ip:port)
cat naabu-output.txt | cut -d: -f2 | tr '\n' ',' | sed 's/,$//'

# From masscan list output (format: open tcp PORT IP DATE)
awk '/open/ {print $3}' masscan.txt | sort -un | tr '\n' ',' | sed 's/,$//'

# From nmap greppable output (-oG)
grep "Ports:" nmap.gnmap | grep -oP '\d+/open' | cut -d/ -f1 | tr '\n' ',' | sed 's/,$//'

Quick Reference

One Command Per Tool

Decision Matrix

Lab Testing

The noise-lab/ directory contains Docker-based test infrastructure to empirically measure the noise (packet counts) of each tool.

Setup

# Start all containers (including new socks-proxy, filtered-target, internal-web)
cd noise-lab
docker compose up -d --build

# Verify all containers running
docker compose ps

Run Alternative Scanner Tests (Scenario 5)

# Measures packet counts for naabu, rustscan, masscan, curl vs nmap baselines
bash noise-lab/tests/scenario5.sh

# Results in JSON format
ls noise-lab/results/scenario5/
cat noise-lab/results/scenario5/naabu_syn_top20.json

Run Proxy Scanning Tests (Scenario 6)

# Tests proxychains+nmap, naabu -proxy, curl --socks5, internal-only targets, filtered target
bash noise-lab/tests/scenario6.sh

# Results
ls noise-lab/results/scenario6/

Lab Network Layout