# Squid Pentest

> Pentest Squid HTTP proxy on port 3128. Use this skill whenever you discover a Squid proxy service, need to enumerate proxy capabilities, pivot through a proxy to scan internal networks, or configure proxychains for HTTP interaction. Trigger on mentions of Squid, HTTP proxy, port 3128, proxy pivoting, or internal network scanning through proxies.

- Skill: `abelrguezr/squid-pentest` (Agent Skill, multi-file: 5 files)
- Install (CLI): `npx skillmds@latest add abelrguezr/squid-pentest`
- Raw SKILL.md: https://api.skillmd.com/api/skills/abelrguezr/squid-pentest/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Coding & Dev Tools
- Author: abelrguezr (https://skillmd.com/u/abelrguezr)
- Updated: 2026-09-10
- Page: https://skillmd.com/skills/abelrguezr/squid-pentest

---


# Squid Proxy Pentesting

A skill for testing and exploiting Squid HTTP proxy services (default port 3128) during penetration testing engagements.

## What this skill does

This skill helps you:
- Enumerate Squid proxy capabilities and configuration
- Test proxy authentication and access controls
- Pivot through Squid to scan internal networks
- Configure proxychains for transparent HTTP interaction
- Chain browser/Burp tools through Squid for interception

## When to use this skill

Use this skill when:
- You discover a Squid proxy service (port 3128/tcp, http-proxy)
- You need to test proxy authentication or access controls
- You want to scan internal networks through a discovered proxy
- You need to configure proxychains for HTTP proxy interaction
- You're pivoting through a proxy to reach internal services

## Quick Start

### 1. Basic Proxy Enumeration

Test if the proxy is accessible and check for authentication:

```bash
# Test proxy connectivity
curl --proxy http://TARGET_IP:3128 http://TARGET_IP

# Check proxy banner
curl -v --proxy http://TARGET_IP:3128 http://example.com 2>&1 | head -20
```

If authentication is required, you'll see a 407 Proxy Authentication Required response.

### 2. Scan Internal Networks Through Proxy

Use the bundled SPOSE scanner to enumerate ports reachable from the proxy:

```bash
# Scan all TCP ports through Squid
./scripts/squid-pivot-scan.sh TARGET_IP

# Or with uv (if available)
uv run spose.py --proxy http://TARGET_IP:3128 --target localhost --allports
```

### 3. Configure Proxychains

Set up proxychains for transparent HTTP interaction:

```bash
# Configure proxychains with Squid
./scripts/configure-proxychains.sh TARGET_IP 3128

# Test with curl
proxychains curl http://127.0.0.1:9191 -v

# Scan internal hosts
proxychains nmap -sT -n -p- localhost
```

### 4. Chain Browser/Burp Through Squid

Configure Burp Suite to route through Squid:

1. Open Burp → Proxy → Settings → Network → Connections → Upstream proxy servers
2. Add: `http://TARGET_IP:3128`
3. Requests will flow: Browser → Burp → Squid → Internal Target

This enables interception of services bound to 127.0.0.1 or internal networks.

## Detailed Techniques

### Proxy Authentication Testing

If the proxy requires authentication:

```bash
# Test with credentials
curl --proxy http://user:pass@TARGET_IP:3128 http://TARGET_IP

# Try common credentials (if authorized)
for user in admin root guest; do
  for pass in admin password 123456; do
    curl -s --proxy http://$user:$pass@TARGET_IP:3128 http://TARGET_IP | grep -q "200" && echo "Found: $user:$pass"
  done
done
```

### Nmap Through Proxy

Scan internal networks using proxychains:

```bash
# Configure proxychains (see script above)
# Then scan
proxychains nmap -sT -n -p- 127.0.0.1
proxychains nmap -sT -n -p- 10.0.0.0/24
```

### SPOSE Scanner

SPOSE (Squid Pivoting Open Port Scanner) is optimized for proxy pivoting:

```bash
# Basic scan
python spose.py --proxy http://TARGET_IP:3128 --target TARGET_IP

# Scan all ports
python spose.py --proxy http://TARGET_IP:3128 --target localhost --allports

# With uv package manager
uv add --script spose.py -r requirements.txt
uv run spose.py --proxy http://TARGET_IP:3128 --target localhost --allports
```

## Common Squid Configurations

### Open Proxy (No Auth)

```bash
# Will return 200 OK or redirect
curl --proxy http://TARGET_IP:3128 http://example.com
```

### Authenticated Proxy

```bash
# Returns 407 Proxy Authentication Required
curl -v --proxy http://TARGET_IP:3128 http://example.com
```

### ACL-Restricted Proxy

May allow only specific destinations or methods. Test with:

```bash
# Test different methods
curl -X CONNECT --proxy http://TARGET_IP:3128 example.com:443
curl -X GET --proxy http://TARGET_IP:3128 http://example.com
```

## Security Considerations

- **Authorization**: Only test proxies you have permission to assess
- **Rate limiting**: Be mindful of scan rates to avoid triggering alerts
- **Logging**: Proxy access is typically logged; document your testing
- **Legal**: Ensure you have written authorization before pivoting through proxies

## References

- [SPOSE – Squid Pivoting Open Port Scanner](https://github.com/aancw/spose)
- [Squid Documentation](https://www.squid-cache.org/Doc/)
- [Proxychains-ng](https://github.com/haad/proxychains-ng)

## Bundled Scripts

- `scripts/squid-enumerate.sh` - Basic proxy enumeration and testing
- `scripts/squid-pivot-scan.sh` - SPOSE-based internal network scanning
- `scripts/configure-proxychains.sh` - Proxychains configuration helper