Skip to content

Pivoting, Tunneling & Port Forwarding

Breaching the perimeter is only the beginning. Learn to navigate segmented networks, chain tunnels through compromised hosts, and route your entire toolkit into networks you were never meant to reach.

01 / SSH & METERPRETER SSH & Meterpreter Tunneling Dynamic port forwarding, SOCKS tunneling, reverse SSH forwarding, and Meterpreter's autoroute and portfwd. Start tunneling → 02 / SOCAT Socat Redirection Bidirectional relays, reverse shell redirection, and bind shell forwarding with Socat. Redirect traffic → 03 / PIVOTING TOOLS Pivoting Tools plink.exe for Windows SSH, Rpivot for web server pivoting, and Netsh port forwarding. Explore the arsenal → 04 / ADVANCED TUNNELING Advanced Tunneling DNS tunneling with Dnscat2, SOCKS5 with Chisel, and ICMP tunneling with ptunnel-ng. Go deeper → 05 / DOUBLE PIVOTS Double Pivots Multi-hop pivot scenarios and RDP tunneling with SocksOverRDP for deep network access. Chain the pivots → 06 / BLUE TEAM Detection & Prevention Blue team strategies for detecting tunneling traffic, anomaly analysis, and network hardening. Defend the network →

🧭 Tool Deep Dives

The following guides provide comprehensive, tool-specific references. Use them alongside the technique pages above.

PIVOTING Ligolo-ng Advanced, lightweight, and fast tunneling utilizing TUN interfaces. Read guide → TUNNELING Proxychains Force any TCP connection to flow through proxies like SOCKS4, SOCKS5 or HTTP. Read guide → PORT FORWARDING SSH Tunneling Local, remote, and dynamic port forwarding using native SSH functionality. Read guide → VPN sshuttle Transparent proxy server that works as a poor man's VPN. Read guide →