Tunneling & Pivoting

SSH Tunneling

Local/remote/dynamic port forwarding built into SSH.

beginner

Linux

macOS

Windows

Lateral Movement

Post-Exploitation

Authorized testing only. Practice on systems you own, isolated labs, or targets with written permission. Unauthorized access is illegal.

You have SSH and need access to internal services.

-L local, -R remote, -D dynamic SOCKS; combine with ProxyJump.

Often the simplest pivot — no extra binaries.

Commands & usage

ssh -L 8080:127.0.0.1:80 user@host

ssh -D 9050 user@host

ssh -R 8080:127.0.0.1:80 user@attacker

ssh -J jump@bastion user@internal

Commands are educational examples. Adapt hosts, paths, and rates to your authorized scope.

Chisel

Fast TCP/UDP tunnel over HTTP secured with SSH-like crypto.

Ligolo-ng

Advanced pivoting tool using a TUN interface — no SOCKS headaches.

sshuttle

Transparent proxy VPN over SSH without needing admin on remote.

socat

Multipurpose relay for bidirectional data transfer (sockets, files, exec).

Proxychains-ng

Force TCP connections from dynamic tools through a proxy/SOCKS.