tunneling-and-pivoting

A tunneling and pivoting playbook for moving traffic through compromised hosts to reach otherwise unreachable internal networks during an authorized penetration test. It catalogs the major techniques for building tunnels and routing traffic, organized so the practitioner can select a method based on what egress the pivot host allows. Coverage spans SSH port forwarding in all its forms (local, remote, dynamic SOCKS, and ProxyJump), the Chisel reverse SOCKS proxy, Ligolo-ng transparent TUN-interface pivoting, socat relays, and ProxyChains configuration for chaining proxies.

Reach for this after initial access is established and the next objective is to enumerate or exploit services that sit behind the pivot. The material walks through single and multi-layer (double) pivots, Windows-specific forwarding via netsh portproxy and plink, and covert channels for locked-down environments: DNS tunneling with iodine and dnscat2, ICMP tunneling with icmpsh and ptunnel-ng, and HTTP tunneling through web shells using Neo-reGeorg and Tunna.

The core decision aid is an egress-aware matrix mapping allowed outbound traffic (any TCP, only 80/443, DNS only, ICMP only, no outbound, or web-shell only) to the appropriate tool, plus a decision tree for choosing an approach based on whether tools can be installed on the compromised host. Concrete command examples accompany each technique, and the skill cross-references related playbooks for reverse shells, network-protocol attacks, service exploitation, and privilege escalation once a new host is reached.