Skip to main content
Pivoting is how you reach a network segment you don’t have direct access to, by routing traffic through a host you’ve already compromised. In practice this almost always comes down to one of two techniques: forwarding a single port, or standing up a full proxy that routes anything through the pivot.

Port Forwarding

Maps one specific port on one host to another. Simple and reliable, but you need a new forward for every service you want to reach.

SOCKS Proxy / Tunneling

Routes arbitrary traffic through the pivot via tools like proxychains. More setup up front, but you get access to the whole subnet instead of one port at a time.
Most of the SSH-based techniques below need an actual shell with credentials or keys on the pivot host. Chisel and Ligolo-ng are the better choice when you’ve only got a foothold and no SSH access.

​
SSH Forwarding

If you’ve got SSH access to the pivot host, its built-in forwarding flags cover local, dynamic, and remote forwarding without needing to drop any extra tools on the target.
Forwards a port on your own machine to a service only reachable from the pivot host, like a database sitting on its internal network.
Multiple forwards can be chained in a single connection:

​
Proxychains

Proxychains wraps any command and routes its traffic through a SOCKS proxy, which is what turns an ssh -D or Chisel SOCKS listener into something every other tool on your box can use.
Prefix any tool with proxychains to route it through the tunnel:

​
Chisel

Chisel tunnels traffic over HTTP, which makes it a solid option when raw socket connections get blocked but outbound HTTP doesn’t. It runs in two modes depending on which direction traffic can actually flow. Standard setup, when the pivot host can accept inbound connections from you:
If inbound traffic to the pivot is blocked, flip it around so the pivot connects out to you instead:
Chisel on GitHub · 0xdf’s Chisel cheatsheet

​
Ligolo-ng

Ligolo-ng sets up a tunnel using a virtual network interface instead of a SOCKS proxy, which means tools work against the target network directly rather than needing proxychains in front of every command.
Once the agent shows as joined, add a route to the network you want to reach and Ligolo creates a local interface for it:
Ligolo-ng on GitHub

​
DNS and ICMP Tunneling

Both of these exist for the same reason: getting data out when every normal egress path is blocked except for a protocol defenders rarely filter closely. DNSCat2 encrypts traffic inside DNS queries, which makes it one of the stealthier tunneling options since DNS is almost never blocked outbound.
ICMP tunneling hides traffic inside ping packets, which only works if ICMP is actually allowed out of the target network.
From there you can layer SSH dynamic forwarding on top of the tunnel:
ptunnel-ng on GitHub
dnscat2 · dnscat2-powershell client

​
Metasploit Pivoting

When you’re already working through a Meterpreter session, autoroute and the built-in SOCKS proxy module let you pivot without dropping any extra binaries on the target.
Point proxychains at the port you just opened and scan as usual:
For forwarding a single port instead of a whole subnet:
Windows has its own built-in forwarder if you’d rather avoid Metasploit entirely. netsh.exe interface portproxy add v4tov4 listenport=8080 listenaddress=PIVOT_HOST connectport=3389 connectaddress=TARGET_HOST, checked with netsh.exe interface portproxy show v4tov4.
When RDP is the only access you have to a pivot host, SocksOverRDP tunnels a SOCKS connection through the RDP session itself.Load the plugin on your own machine before connecting:
Open the RDP session as normal with mstsc.exe, then transfer SocksOverRDP-Server.exe to the target and run it with admin rights. Point a proxy client like Proxifier at 127.0.0.1:1080 to route traffic through it.SocksOverRDP releases

​
Quick Reference Tools

Ligolo-ng

Interface-based tunneling, no SOCKS proxy required.

Chisel

HTTP-based tunneling with forward and reverse modes.

0xdf Chisel Cheatsheet

Practical Chisel usage patterns across different scenarios.

Proxifier

Windows GUI proxy client, pairs well with SocksOverRDP.
Replace ATTACKER_IP, PIVOT_IP, TARGET_IP and ports with your real infrastructure details. For authorized penetration tests, CTFs, and lab environments only.