wiki created

2025-11-06 12:23:49 +01:00
parent 6cd3511962
commit 2fe9fa8254
60 changed files with 5012 additions and 142 deletions
@@ -0,0 +1,57 @@
+# socks - SOCKS5 Proxy
+
+Start or stop a SOCKS5 proxy server on the Mythic server.
+
+## Description
+
+The `socks` command starts or stops a SOCKS5 proxy server on the Mythic server. When started, the SOCKS proxy allows routing network traffic through the agent to access internal network resources. WARNING: SOCKS proxies generate continuous network traffic and may be detected by network monitoring tools.
+
+## Syntax
+
+```
+socks {"action":"start","port":7002}
+socks {"action":"stop","port":7002}
+```
+
+## Parameters
+
+- `action` (required): Either `"start"` or `"stop"`
+- `port` (optional): Port number for the SOCKS proxy (default: 7002)
+
+## Examples
+
+```
+socks {"action":"start","port":7002}
+socks {"action":"stop","port":7002}
+```
+
+## Features
+
+- When started, the SOCKS proxy allows routing network traffic through the agent to access internal network resources
+- The default port is 7002
+- The proxy runs on the Mythic server and uses the agent as a tunnel for network connections
+- WARNING: SOCKS proxies generate continuous network traffic and may be detected by network monitoring tools, firewall logging, EDR/XDR network monitoring, and network flow analysis
+- Use non-standard ports and be aware of high bandwidth usage
+
+## Output
+
+```
+[socks] SOCKS proxy started on port 7002
+```
+
+## OPSEC Considerations
+
+- SOCKS proxies generate continuous network traffic
+- May be detected by network monitoring tools, firewall logging, EDR/XDR network monitoring, and network flow analysis
+- Use non-standard ports
+- Be aware of high bandwidth usage
+- Consider the operational impact before starting
+
+## Related
+
+[SOCKS Proxy Support](../../../features.md#socks-proxy-support), [Usage Examples](../../../examples.md#socks-proxy-example)
+
+---
+
+**Command Category:** Network Tunneling  
+**Requires Admin:** No