Jumping into SOCKS

This post details a custom C# SOCKS4/4a/5 proxy built for red-team/pentest scenarios to authenticate over TLS using a victim host’s non-exportable client certificate via Windows CryptoAPI. It reviews SOCKS protocol flows, implements SOCKS5 support for tools like Burp, addresses connection edge cases (RST handling), and adds TLS termination with a self-signed server certificate while injecting a selected client certificate upstream—all demonstrated against BadSSL to prove end-to-end functionality without exporting private keys.