The SOCKS5 handshake in real bytes (RFC 1928). Three phases cross the wire in order: method negotiation, an optional username/password auth, then the connection request that names the target. Each message is decoded field by field below. Toggle the auth mode, press Replay, or walk it with Prev / Next.
Client
pydoll / Chromeready
SOCKS5 proxy
proxy:1080listening
target
example.com:443waiting
DATA RELAY · encrypted tunnel, both ways
on the wire
authstep 0 / 0
Binary and efficient, but unreadable without a hex dump, which is what the decoder shows. Method codes: 00 no-auth, 01 GSSAPI, 02 username/password, FF none acceptable. With ATYP=domain the proxy resolves DNS on its side. Credentials travel in plaintext (RFC 1929); wrap SOCKS in TLS/SSH for sensitive use. Refs: RFC 1928, RFC 1929.