This is a problem while im doing practice in a Cyber Range in which i wanna use sqlmap to scan a target machine through a socks4 proxy with proxychains4

Environment Overview:

I'm working on a three-layer pivot lab:

• Kali Attack Machine: 192.168.1.128

• Target 1: 192.168.1.11 (compromised, facing Kali) and 192.168.22.22 (internal NIC, facing Target 2)

• Target 2: 192.168.22.33 and 192.168.33.22

• Target 3: 192.168.33.33

I have a Meterpreter session on Target 1. I configured MSF's SOCKS proxy module on Kali:

text

use auxiliary/server/socks_proxy
set SRVHOST 0.0.0.0
set SRVPORT 5555
set version 4a
run

The proxychains4.conf is set to use socks4 192.168.1.128 5555. The Meterpreter session handles forwarding traffic from port 5555 through Target 1 into the internal network. I've also verified the routing is correctly set up using the routes command in MSF.

What Works:

Running curl through the proxy successfully returns the page content:

bash

curl --socks4 192.168.1.128:5555 "http://192.168.22.22/index.php?r=vul&keyword=1"

Output: Array ( ) — confirming the proxy chain is fully functional.

What Doesn't Work:

Running sqlmap via proxychains fails consistently:

bash

sudo proxychains4 sqlmap -u "http://192.168.22.22/index.php?r=vul&keyword=1" --dbs --random-agent

The proxychains debug output shows Strict chain ... OK, indicating the TCP connection was established successfully. However, sqlmap still reports:

text

[CRITICAL] unable to connect to the target URL

I've also tried bypassing proxychains entirely and letting sqlmap handle the SOCKS proxy directly:

bash

sudo sqlmap -u "http://192.168.22.22/index.php?r=vul&keyword=1" --dbs --random-agent --proxy="socks4://192.168.1.128:5555"

Same result.

Question:

Since curl confirms the proxy chain works perfectly, what could be causing sqlmap to fail? Is this a known compatibility issue between proxychains and sqlmap's Python urllib internals? What's the correct way to run sqlmap over a multi-layer SOCKS proxy in this scenario?