SocksChain - user manual

SocksChain

Version 3.8

Sockschain is a program that allows to work with any Internet service through a chain of SOCKS or HTTP proxies to hide the real IP-address. SocksChain can function as a usual SOCKS-server that transmits queries through a chain of proxies. SocksChain can be used with client programs that do not support the SOCKS protocol, but work with one TCP-connection, such as TELNET, HTTP, IRC... (FTP uses 2 connections). And your IP-address will not be seen in the server's logs or mail headers.

What is new

Version 3.8

  • Functionality of utility SocksCAP (automatic capturing WinSockets-API calls of client programs and relaying them through proxy-chain)
  • Support of non-standard port numbers
  • Remote domain name resolving (required if you have not access to DNS) & SOCKS4A protocol

Version 3.6

  • Auto-upgrade function
  • More robust testing of proxies

Version 3.0

  • Support of HTTP-proxies with HTTP-tunneling support
  • Function of proxy operability testing
  • Setting of Internet connection type (i.e. it is possible to specify a fixed proxy that will be the first in all connections )
  • Big database of proxies (a few hundreds of addresses)

Principle of operation

SocksChain transmits the TCP-call of a client program in such a way that it successively goes through a chain of proxies. SocksChain itself is connected only with the first element of this chain. That one in its turn is connected with the second and so on...

So, to track where the query was initiated from with the help of server logs is very complex. To do that, one should analyze the logs of all intermediates one by one in the reverse order. If somewhere the logs are not kept, the thread will be lost. Theoretically it provides a high degree of anonymity. But it affects the speed of data transmission as it is inversely proportional to the chain length.

SocksChain subsystems

Proxies manager

What is proxy

Proxy is a network computer that can serve as an intermediate for connection with other computers. They are usually used for the following two purposes:

  • As firewall, which protects the local network from outside access
  • As IP-addresses multiplexer, which allows to connect a number of computers to Internet when having only one IP-address

The program WinGate is often used as proxy.

Quite a number of such proxies are open to easy access.

In all variety of proxies there are 2 basic types of universal services, i.e. allowing to transmit any TCP-connections (not only, say, HTTP and FTP). Only they make a chain possible and, therefore, are useful for SocksChain:

  • SOCK4 and SOCKS5 services. Their default port is 1080. SOCKS5 is the most universal service, as it allows not only establish TCP-connections but open a port for incoming TCP-connections (BIND operation ) and transmit/receive UDP-datagrams as well.
  • HTTP-proxy with a possibility of SSL-tunneling. The default ports are 80, 8080, 3128. This service is less universal than SOCKS5, but by far more widespread.

Proxies manager deals entirely with proxies database support. It is called from the menu Options|Proxy Manager. The manager's functions include:

  • Storing the list as an XML-file
  • Refreshing the list from the server (Download button)
  • Operability testing (Test All button). (By default it tests the connection with the server www.microsoft.com port 80, as the most powerful and accessible from everywhere).
  • Notifying the server of the operability degree of the used proxies

Thus, the list of proxies is kept in a distributed way. The server script collects statistics on the most frequently used proxies. It is important since easy access to the proxy is often closed.

Format of XML-file SocksChain.xml

This file contains the table of known proxies. You can enlarge the file both from the program and manually according to the following example:

<SocksChain>
    <Proxies>
        <Proxy IP="12.1.68.100" SOCKSPORT="1080" SOCKS4="" SOCKS5="" />
        <Proxy IP="12.2.81.50" HTTPPORT="8080" HTTPTUNNEL=""/>
    </Proxies>
</SocksChain>

The presence of IP parameter is required. The presence of other parameters is optional and means:

  • SOCKSPORT - port for services SOCKS4/5 (by default - 1080)
  • HTTPPORT - port for HTTP-tunneling (by default 80, 8080, 3128)
  • SOCKS4, SOCKS5, HTTPTUNNEL - parameters without specifying a value. Their presence means that the given IP-address has been checked on the functioning of a corresponding service.

If a few proxies have been checked for one IP-address, the priority goes to SOCKS5, then SOCKS and HTTP.

Server

The server deals with processing queries of Internet-clients. Its task is to redirect TCP- and UDP-connections to a certain route of proxies. The route can be specified manually or it can be made up automatically (here its length must be specified) with the available list of proxies.

The server allows to add a few Services on different ports. Each service may have its individual route and target server. The target server is needed only if the client program does not directly support SOCKS-protocol .

Here is the approximate list of popular programs that support SOCKS (no need to fill out the field TargetServer):

  • mIRC
  • ICQ
  • InternetExplorer
  • AdvancedDirectRemailer - remailer with built-in SMTP server that supports mailing lists, plug-ins and SOCKS-5 proxy
  • WinGate

The programs that do not support SOCKS but allow to work through SocksChain:

  • MS Outlook & OutlookExpress
  • Telnet
  • MS TerminalClient

Unfortunately the majority of FTP-clients cannot work through SOCKS. And since FTP uses not only outgoing TCP-threads, their redirecting through SocksChain is impossible.

When installing, the service is created by default on port 1081 (not 1080 since port 1080 is often occupied by some standard proxy, for instance, WinGate). You can change the proxy number to any vacant one on your machine. Respectively you specify 127.0.0.1:1081 as server address in the client's program. That is you need to connect your client's program, SocksChain, intermediate proxy and target server in a logic chain.

When the clients call the services, the process of successive connecting to the chain elements appears in the right bar of the main window.

When the server is added or modified, the setting window appears on the screen. Its basic elements include:

  • Name - service name, it does not perform any function and it just has to be unique.
  • Accept on port - port on your machine that is not occupied by any other service. It can be assigned arbitrarily. This particular number must be specified as server's port or proxy in the settings of clients program. If we, say, chose port 1081, then in the mailing client we enter SMTP-server: 127.0.0.1 port 1081 (127.0.0.1 always stands for the machine where the client is running)
  • Auto-creating chain - automatic chain creation. When this option is selected, one should clear the list-box "Chain".
  • Length of chain - length of chain that must be automatically created. Recommended values: 2-5. Longer chain makes being detected less possible but it affects the speed.
  • Chain list-box - list of proxies through which the connection is transmitted.
  • Target Host - a couple of host:port kind, the aim of the clients that do not support connection through proxies. For instance, Telnet: somehost.com:23. This address does not have to be a proxy.
  • ProxyList - table of known proxies. Not all of them work continuously. That is why it is recommended to test them from time to time with the proxies manager .

If we leave the list and Target blank and disable Auto-creating, SocksChain will function as an ordinary SOCKS4/5 proxy. This mode can be helpful if you create the chain manually. In this case it is possible to do that step by step, set the client to work simply through SocksChain without proxies and then add them one by one.

General settings

The following parameters are set in the Tools|Options menu:

The program is created in conformity with the following documents:

  • SOCKS 4 protocol
  • SOCK 5 protocol (RFC 1928)
  • Upgrading to TLS Within HTTP/1.1 (RFC 2817)


SocksChain registration

Registration

The cost of registration is $49.

To register the SocksChain you can make online payment by following URLs:

RegNow

RegSoft

PayPal

On payment approval (usually, in one-two business days), we'll send you the registration key which will remove all limitations of unregistered version. Your registration will be valid for all future versions of SocksChain.


SocksChain with ADR

Advanced Direct Remailer (ADR)

ADR is remailer software, essentially allowing you to create an SMTP server on your own machine. It incudes built-in Socks5 support.*

  1. From the ADR menu, choose “Delivery->General Settings…”
  2. Select the “Proxy” tab.
  3. Ensure that the “Connection through Socks v5 proxy server” checkbox is checked.
  4. In the “Socks v5 proxy settings” section, enter 127.0.0.1 for the Address and 1081 for the Port. **
  5. Ensure that the “Use RFC1929 authentication (cleartext) ” checkbox is unchecked.
  6. If the last proxy in your list is running Wingate3.0 or otherwise does not properly support UDP, check the “Use mapping for DNS” checkbox and see the “Port Mapping” section below.*
  7. Click the OK button at the bottom.

* When using this program or other that require Socks5 support, you should ensure that the last proxy server in your chain supports Socks5.

** If you have configured a different port for SocksCap connections in the Edit Listener window, use that port number instead.

*** The “help” button at the bottom of the ADR “Proxy” tab gives further details.

Note: Due to the abuse of Socks proxies by spammers (individuals who indiscriminately [and illegally] send unsolicited advertisements to large numbers of email addresses), some Socks proxies block port 25 and are unusable for mail delivery. Others are rejected by various mail services, or appear on the MAPS Realtime Blackhole List. This makes it difficult to find a Socks proxy which will reliably deliver mail to all addresses. (While an 80% delivery rate may be fine for spammers, it is unacceptable for legitimate personal or business purposes.) Be careful in selecting a proxy for using with a direct mailer, and DO NOT abuse it, or you will ruin it for legitimate purposes and earn the well-deserved contempt of its rightful users.


SocksChain with InternetExplorer

Internet Explorer*

  1. In the browser menu bar, select “Tools->Internet Options…”**
  2. Select the “Connections” tab.
  3. If you are setting up for a dial-up connection, double-click that connection in the list window. If you are setting up for a LAN connection, click the “LAN Settings…” button near the bottom.
  4. In the Proxy Server section, make sure that the checkbox for “Use a proxy server” is checked.
  5. Click on the “Advanced…” button.
  6. In the “Servers” section, in the text box next to “Socks,” type 127.0.0.1 for the host name. Tab to the “Port” window next to it, and type 1081 for the port number.***
  7. Make sure that the Exceptions text box includes 127.0.0.1 (if there are already entries in this window, a semicolon [;] may be used to separate the new one).
  8. Click “OK” in each of the three configuration windows to return to Internet Explorer.
* If you’re already using a utility such as MultiProxy or Proxomitron as a local HTTP proxy, be sure to configure that utility as described in the SocksCap section below.

** This will affect not only Internet Explorer, but other programs such as Outlook or Outlook Express which get configuration information from the Windows Internet Options control panel applet.

*** If you have configured a different port for SocksCap connections in the Edit Listener window, use that port number instead.


SocksChain with Netscape Navigator

Netscape Navigator

  1. In the browser menu bar, select “Edit->Preferences…”
  2. In the “Category” list, expand the “Advanced” submenu and select “Proxies.”
  3. Select the “Manual proxy configuration” radio button.
  4. In the text box next to “SOCKS v5 Host,” enter 127.0.0.1 as the hostname.
  5. Tab to the “Port:” text box next to it and enter 1081 as the port number.**
  6. Click “OK” in each of the three configuration windows to return to Internet Explorer.

* If you’re already using a utility such as MultiProxy or Proxomitron as a local HTTP proxy, be sure to configure that utility as described in the SocksCap section below.

** If you have configured a different port for SocksCap connections in the Edit Listener window, use that port number instead.


SocksChain with ICQ

ICQ

  1. Click on the ICQ logo in the lower left of the window, and choose “Preferences” from the drop-down menu.
  2. In the Owner Preferences dialog box, clock “Connections” in the left-hand list window and select the “Firewall” tab.
  3. Choose “Socks 5” from the list offered.
  4. In the “Host:” text box, enter 127.0.0.1
  5. In the “Port:” text box, enter 1081.*
  6. Ensure that the “Authentication” checkbox is unchecked.
  7. Ensure that the “External proxy IP:” checkbox is unchecked.
  8. You may check the “Use proxy to resolve hostnames” checkbox. This will require Socks5.

* If you have configured a different port for SocksCap connections in the Edit Listener window, use that port number instead.


SocksChain with mIRC

mIRC

  1. From the mIRC menu, select “File->Options…”
  2. Open the “Connect” list and click “Firewall.”
  3. Ensure that the “Use Firewall” checkbox is checked.
  4. In the “Protocol:” section, click “Socks5.”
  5. In the “Hostname:” text box, enter 127.0.0.1
  6. Leave the “User ID:” and “Password:” text boxes blank.
  7. In the “Port:” text box, enter 1081.*
  8. You may check the checkbox “Initiate DCCs through firewall.” If you do, you must ensure that the last proxy in your chain supports SOCKS5. If you do not, your IP may not be hidden when initiating DCC connections. Further details are available from the mIRC help file.
  9. Click the OK button at the bottom.

* If you have configured a different port for SocksCap connections in the Edit Listener window, use that port number instead.


SocksChain with SocksCAP

SocksCap

  1. From the SocksCap menu, select “File->Settings…”
  2. In the Server section, enter 127.0.0.1 in the “SOCKS Server:” text box.
  3. In the Server section, enter 8081 in the “Port:” text box.*
  4. In the “Protocol:” section, click “Socks Version 5.”
  5. Under “Name Resolution” select “Attempt local then remote.”
  6. Ensure that the “Username/Password” checkbox is unchecked.
  7. Click the OK button at the bottom.

* If you have configured a different port for SocksCap connections in the Edit Listener window, use that port number instead.

Once you have SocksCap set up, there are three ways to invoke an application under SocksCap control (all connections will go through SocksCap, and thus through SocksChain if configured as above).

  1. You can drag the application or shortcut into the SocksCap Control window. This will give you the option to enter a “New Application Profile” or “Run Socksified.” Select “Run Socksified” and the application will start up under SocksCap control.
  2. If you selected “New Application Profile” instead, and approved (or modified and approved) the information in the popup, an icon will appear in the control window. You may double-click this icon to launch the application under SocksCap control, or alternatively, you can right-click the SocksCap icon in the system tray and select it from the list which appears.
  3. You can precede the application command line with the complete path to the SocksCap executable (e.g., "C:\Program Files\SocksCapV2\sc32.exe" "C:\Program Files\Proximotron\Proxomitron.exe" to start Proxomitron under SocksCap control). This can be easily done in the shortcut to the application, although the shortcut icon will change to the SocksCap icon and will need to be changed back manually.


SocksChain with SmartFTP

SmartFTP

SmartFTP is one of the few FTP clients with built-in Socks support.

  1. From the SmartFTP menu, choose “Tools->Settings…”
  2. Select the “Proxy” tab.
  3. Click the button in the “Type” section (by default, it will be set to “None”).
  4. Select Socks5 from the drop-down list. * **
  5. In the “Options” section, enter 127.0.0.1 for the Host and 1081 for the Port. ***
  6. Ensure that the “Login to Proxy” checkbox is unchecked.
  7. Click the OK button at the bottom.

* If you click on the rotating arrow icon to the left of the box, it will switch to the next option in the list instead of producing a drop-down list.

** Socks4 and Socks4a should also work, but Socks5 is preferable.

*** If you have configured a different port for SocksCap connections in the Edit Listener window, use that port number instead.


Individual ports

Individual ports (SMTP example)

In some cases, there will be difficulty connecting through a SOCKS server. For example, some SMTP servers refuse connections from servers which have been used in the past for spamming or other illegal activities. This is annoying to privacy advocates, as email is probably the biggest security hole in terms of publicizing a user’s IP. An easy workaround exists, though, since your SMTP connection is generally always to the same port on the same server. In this example, it is assumed that you have your email client (Outlook, Outlook Express, Eudora, Netscape, etc.) already set up to connect directly to your SMTP server, which is named smtp.example.com and accepts SMTP connections on port 25.

Configuring SocksChain

  1. With the SocksChain window active, hit control-N to open a new service (or select “Service->New…”).
  2. In the “Name:” text box, enter a name to list the service by in the SocksChain window (this does not affect the operation).
  3. In the “Accept connections on Port” text box, enter 25.*
  4. Ensure that the “Auto-creating chain” box is unchecked.
  5. Below the proxy chain window, in the “Target (host:port):” text box, enter “smtp.example.com:25” **

* This may be any unused port on your machine. However, most email clients assume by default that SMTP servers will operate on port 25. If you use a different port, you will have to find out how to configure your email client to use that port as well. If you are running a remailer or other software on your machine that uses port 25, or if you are setting up multiple SMTP services in SocksChain, you will have to use a different port.

** You will replace “smtp.example.com:25” with the real name of your SMTP server and port, without the quotes.

Configuring your email client

  1. In the account setup section of your email client, find the SMTP server entry (e.g., smtp.example.com:25 or Host: smtp.example.com Port: 25)
  2. Replace “smtp.example.com” with “127.0.0.1” in the configuration. Do not change the POP or IMAP server.
  3. If the port number you used in step 3 above is different than the port number used by your SMTP server, enter the one from step 3 above.*
  4. Leave all other configuration information as it is.

* To configure Eudora to use a port other than 25 for SMTP, you must add the parameter “SMTPPort=xxx” to your eudora.ini file, replacing xxx with the alternate port number.

When you have completed configuration of SocksChain and your email client, test it by sending email to yourself with no SOCKS proxies selected. If you receive the email, the configuration is working so far. Then, choose a proxy from the list and add it to your chain (with the <- button between the chain box and the list box) and try again. If the proxy supports your SMTP port, and your server accepts SMTP connections from that proxy, you should receive the mail with your own IP replaced by that of the SOCKS proxy.

When you have found a proxy that works with your SMTP server, you may add others to the chain, but make sure the last one is the one tested with your SMTP server. If you prefer to use a randomly generated chain, SocksChain 3.5 allows you to maintain a separate list of proxy servers which are allowed to be the last in a randomly generated chain.

This technique will work not only for SMTP, but for other applications which frequently or exclusively use a specific machine or port.