Port 1080 – SOCKS Proxy

TCP

Port 1080 is the SOCKS proxy port. SOCKS proxies relay TCP connections at the network layer – they work with any protocol (HTTP, SMTP, SSH) without understanding the application data. SOCKS5 (RFC 1928) adds UDP relay and authentication. Open SOCKS proxies on port 1080 are heavily abused for anonymizing malicious traffic.

Port Number

1080

Protocol

TCP

Service

SOCKS Proxy Protocol

Range

IANA Registered (1024–49151)

Description

SOCKS on port 1080 provides circuit-level proxy functionality. Unlike HTTP proxies that understand HTTP, SOCKS operates at the TCP layer and relays arbitrary connections. SOCKS5 adds DNS resolution at the proxy, UDP relay, and username/password or GSSAPI authentication. SSH dynamic port forwarding (-D flag) creates a local SOCKS5 proxy that tunnels all traffic through the SSH connection. Tor also uses SOCKS5 on port 9050/9150 for application connections. Open SOCKS proxies on port 1080 are exploited for spam relay, credential stuffing, and hiding attack origin – scan your network for unintentional SOCKS listeners.

Security risks

1Open proxy abuse: exposed SOCKS proxies without authentication are used for: anonymizing attacks, bypassing geo-restrictions, spamming, credential stuffing, and distributing malware – your IP appears in abuse reports
2CVE-2023-0286 (Dante SOCKS): X.509 certificate parsing vulnerability in Dante SOCKS proxy allows remote DoS or potential code execution
3Lateral movement tool: attackers install SOCKS proxies (Chisel, revsocks, EarthWorm) on compromised hosts to tunnel into internal networks – port 1080 is the first port defenders check
4DNS leak via SOCKS4: SOCKS4 does not support DNS resolution on the proxy side – client resolves DNS locally, revealing intended destinations to the local network even when traffic is proxied
5Traffic interception: a malicious SOCKS proxy sees all traffic routed through it (HTTP, SMTP, SSH) – credentials and data from any protocol traversing the proxy are exposed to the proxy operator

Firewall guidance

Port 1080 should never be open to the internet – open SOCKS proxies are automatically discovered and abused within hours. If running an internal SOCKS proxy: bind to localhost or restrict to specific client IPs. For SSH-based SOCKS: ssh -D 1080 only listens on 127.0.0.1 by default (safe). Monitor for unauthorized SOCKS proxies (Chisel, EarthWorm) on any port – attackers don't always use 1080.

Diagnosis commands

Test SOCKS5 proxy connectivity (shows the proxy's external IP)

shell

curl --socks5 localhost:1080 http://ifconfig.me

Check if target is an open SOCKS proxy (security audit)

shell

nmap -p 1080 --script socks-open-proxy target

Identify which process is running a SOCKS proxy locally

shell

ss -tlnp | grep 1080

Create SSH-based SOCKS5 proxy through bastion host (secure alternative)

shell

ssh -D 1080 -N -f user@bastion

Usage examples

Port 1080 – SOCKS Proxy

shell

ssh -D 1080 user@host
curl --socks5 127.0.0.1:1080 http://example.com
proxychains -f /etc/proxychains.conf nmap target

Common services on this port

Dante (danted)ShadowsocksSSH dynamic port forwarding (-D)Tor (local SOCKS)Chisel (penetration testing)Proxychains

Related ports

1080

SOCKS (this port)

3128

HTTP proxy (Squid default)

8080

HTTP proxy alternate

9050

Tor SOCKS (local only)

History

SOCKS (Socket Secure) was created by David Koblas at MIPS Computer Systems in 1990. SOCKS4 (1996) supported TCP proxying. SOCKS5 (RFC 1928, 1996) added UDP support, authentication (username/password, GSSAPI), and DNS resolution on the proxy side. Port 1080 was the conventional default (not IANA-registered for SOCKS specifically). The protocol gained renewed relevance with Tor (SOCKS on port 9050), Shadowsocks (China firewall circumvention), and SSH dynamic forwarding (-D flag).

FAQ

SOCKS4 vs SOCKS5 – what is the difference?

SOCKS4: TCP only, no authentication, client resolves DNS (leaks destinations), no IPv6. SOCKS4a: adds proxy-side DNS resolution (client sends hostname). SOCKS5 (RFC 1928): TCP + UDP, authentication methods (none, user/pass, GSSAPI), proxy-side DNS, IPv6 support. Always use SOCKS5. SOCKS4 leaks DNS queries to the local network, defeating the purpose of proxying for privacy.

How do I detect unauthorized SOCKS proxies on my network?

1. Scan for common ports: nmap -p 1080,1081,9050,7890,8388 --open <subnet>. 2. Monitor for outbound connections on unusual ports (Chisel often uses 8080 or random high ports). 3. Look for SSH tunnels: ps aux | grep 'ssh.*-D' on servers. 4. Network traffic analysis: SOCKS5 handshake starts with 0x05 (version byte) – DPI/IDS can detect it. 5. EDR: alert on Chisel, EarthWorm, revsocks, or frp binaries.

Specification

RFC 1928 – Port 1080 specification →