# socks - SOCKS5 Proxy

Start or stop a SOCKS5 proxy server on the Mythic server.

## Description

The `socks` command starts or stops a SOCKS5 proxy server on the Mythic server. When started, the SOCKS proxy allows routing network traffic through the agent to access internal network resources. WARNING: SOCKS proxies generate continuous network traffic and may be detected by network monitoring tools.

## Syntax

```
socks {"action":"start","port":7002}
socks {"action":"stop","port":7002}
```

## Parameters

- `action` (required): Either `"start"` or `"stop"`
- `port` (optional): Port number for the SOCKS proxy (default: 7002)

## Examples

```
socks {"action":"start","port":7002}
socks {"action":"stop","port":7002}
```

## Features

- When started, the SOCKS proxy allows routing network traffic through the agent to access internal network resources
- The default port is 7002
- The proxy runs on the Mythic server and uses the agent as a tunnel for network connections
- WARNING: SOCKS proxies generate continuous network traffic and may be detected by network monitoring tools, firewall logging, EDR/XDR network monitoring, and network flow analysis
- Use non-standard ports and be aware of high bandwidth usage

## Output

```
[socks] SOCKS proxy started on port 7002
```

## OPSEC Considerations

- SOCKS proxies generate continuous network traffic
- May be detected by network monitoring tools, firewall logging, EDR/XDR network monitoring, and network flow analysis
- Use non-standard ports
- Be aware of high bandwidth usage
- Consider the operational impact before starting

## Related

[SOCKS Proxy Support](../../../features.md#socks-proxy-support), [Usage Examples](../../../examples.md#socks-proxy-example)

---

**Command Category:** Network Tunneling  
**Requires Admin:** No