tunneling-and-pivoting
Master network tunneling and pivoting techniques to access internal systems from compromised hosts. This skill covers SSH port forwarding, reverse SOCKS proxies via Chisel, transparent TUN-based pivoting with Ligolo-ng, socat relays, DNS/ICMP/HTTP tunneling, ProxyChains configuration, Windows pivoting methods, and multi-layer chaining strategies.
Tunneling and Pivoting teaches you to establish network tunnels through compromised hosts for internal network access.
AI-generated summary based on this skill's SKILL.md
Decision gist · record as of 2026-06-16
Tunneling and Pivoting teaches you to establish network tunnels through compromised hosts for internal network access. Master network tunneling and pivoting techniques to access internal systems from compromised hosts. This skill covers SSH port forwarding, reverse SOCKS proxies via Chisel, transparent TUN-based pivoting with Ligolo-ng, socat relays, DNS/ICMP/HTTP tunneling, ProxyChains configuration, Windows pivoting methods, and multi-layer chaining strategies.
Use it when
- tunneling-and-pivoting covers SSH port forwarding techniques where you configure local or remote port forwards through a compromised host.
- tunneling-and-pivoting includes Chisel, a fast TCP/UDP tunnel over HTTP.
Verify before relying
Read SKILL.md below before installing (1 file). Open directory: indexed for reading, not audited.
Install
yaklang/hack-skills/tunneling-and-pivoting · repository language: CSS
Open directory. Skills are indexed for reading, not audited. Review a skill's body before installing it.
Frequently asked questions
AI-generated answers based on this skill's SKILL.md and metadata
What is tunneling-and-pivoting and why use it?
tunneling-and-pivoting is a skill for establishing network tunnels through compromised hosts to access internal systems. It enables you to pivot from an initial foothold into deeper network layers, bypass egress filtering, and chain multiple hops together for lateral movement and reconnaissance.
How do you set up SSH tunneling and port forwarding for pivoting?
tunneling-and-pivoting covers SSH port forwarding techniques where you configure local or remote port forwards through a compromised host. You can also establish dynamic SOCKS proxies via SSH to route traffic through the pivot point, allowing tools like ProxyChains to transparently redirect connections through the tunnel.
What is Chisel reverse SOCKS proxy setup?
tunneling-and-pivoting includes Chisel, a fast TCP/UDP tunnel over HTTP. You deploy a Chisel server on your control machine and run a client on the compromised host in reverse mode, creating a SOCKS proxy that routes your traffic back through the pivot for multi-layer network access.
How does tunneling-and-pivoting handle egress filtering bypass?
tunneling-and-pivoting teaches DNS tunneling (iodine, dnscat2), ICMP tunneling (ptunnel-ng, icmpsh), and HTTP tunneling (Neo-reGeorg) to bypass egress restrictions. These techniques encapsulate traffic in allowed protocols, enabling command and control or data exfiltration when standard ports are blocked.
How do you establish tunnel through firewall on Windows?
tunneling-and-pivoting covers Windows pivoting with netsh portproxy for local forwarding, plink for SSH-based tunnels, and SSH dynamic SOCKS configuration. These methods let you chain Windows hosts together and access internal services even when direct egress is restricted.
What transparent routing and multi-layer pivoting tools does tunneling-and-pivoting teach?
tunneling-and-pivoting includes Ligolo-ng for transparent TUN-based routing and socat TCP relays for flexible chaining. These enable multi-layer pivoting where traffic flows transparently through multiple compromised hosts, creating complex attack paths for deep internal network access.
SKILL.md
Rendered from the published skill. Quoted content, verbatim.
SKILL: Tunneling & Pivoting — Expert Attack Playbook
> AI LOAD INSTRUCTION: Expert tunneling and pivoting techniques. Covers SSH port forwarding (local/remote/dynamic/jump), Chisel reverse SOCKS, Ligolo-ng transparent TUN pivoting, socat relays, DNS/ICMP/HTTP tunneling, ProxyChains configuration, Windows pivoting (netsh/plink), and multi-layer chaining. Base models miss egress-aware tool selection and transparent routing setup.
0. RELATED ROUTING
Before going deep, consider loading:
- network-protocol-attacks for network-level attacks from pivot positions
- reverse-shell-techniques for establishing initial access shells
-
unauthorized-access-common-services for exploiting services discovered through pivots
(truncated - see the full file via the links below)
File tree — 1 file
skills/tunneling-and-pivoting/SKILL.md
Let your AI agent find skills like this
Example. Real query, live index.
You found this page by searching. An agent finds it by wishing: SkillFed indexes 56,283 agent skills by what they can do, searchable in plain language.
wish › “Establish network tunnels through compromised hosts for internal network access”
Give your agent the search over MCP, or paste the wish link into any chat. No install? Search from any chat →
Related skills
This skill guides you through pivoting and tunneling strategies to reach internal networks from a compromised host during authorized penetration tests. It covers SSH port forwarding, SOCKS proxies, and specialized tools like Chisel, Ligolo-ng, and sshuttle, with a decision tree to select the right approach based on available access and network constraints.
This skill applies falsification-first methodology to network and streaming incidents where the obvious cause is likely a red herring. Rather than stacking assumptions, it guides you through layered isolation—testing the same request across different paths to pinpoint exactly which hop (client, CDN, proxy, or backend) is responsible. Use it for connection resets, SSE stalls, fixed-time drops, certificate errors, or LAN mysteries where symptoms like "works sometimes" or "fails after N seconds" point to multiple possible layers.
Rustunnel lets you create public tunnels for local services across HTTP, TCP, UDP, and peer-to-peer protocols. Use it to test webhooks, share development environments, access databases remotely, or run load-balanced pools—all controlled through MCP tools that integrate with Claude Code and other AI agents.
Pinggy Tunnel creates instant public URLs for local services using SSH reverse tunnels, with no daemon installation needed. Free tier offers 60-minute tunnels with random subdomains; Pro tier ($3/mo) adds persistent URLs and longer session times. Supports HTTP, HTTPS, TCP, and TLS tunneling with optional access controls like basic auth, bearer tokens, IP whitelisting, and CORS.
Tunnel Doctor isolates and resolves conflicts when Tailscale coexists with proxy/VPN tools like Shadowrocket, Clash, or Surge on macOS. It addresses route table corruption, environment variable misconfigurations, system proxy bypass issues, SSH double-tunneling, and VM/container proxy propagation problems—covering scenarios from browser 503 errors to Docker timeouts and WSL SSH access.
This skill teaches advanced techniques for moving between Linux hosts after initial compromise. Master SSH agent hijacking, private key discovery, credential extraction from system files and process memory, D-Bus service abuse, and internal network tunneling to expand your foothold across infrastructure.
More skills network-attack (MIT) · Auth Coercion Relay (GPL-3.0) · network-protocol-attacks (MIT) · symmetric-cipher-attacks (MIT)