tunneling-and-pivoting
Master network tunneling and pivoting techniques to access internal systems from compromised hosts. This skill covers SSH port forwarding, reverse SOCKS proxies via Chisel, transparent TUN-based pivoting with Ligolo-ng, socat relays, DNS/ICMP/HTTP tunneling, ProxyChains configuration, Windows pivoting methods, and multi-layer chaining strategies.
Tunneling and Pivoting teaches you to establish network tunnels through compromised hosts for internal network access.
AI-generated summary based on this skill's SKILL.md
Install
yaklang/hack-skills/tunneling-and-pivoting · repository language: CSS
git clone https://github.com/yaklang/hack-skills
cp -r hack-skills/skills/tunneling-and-pivoting ~/.claude/skills/tunneling-and-pivotingnpx skillfed install yaklang/hack-skills/tunneling-and-pivotingFrequently asked questions
AI-generated answers based on this skill's SKILL.md and metadata
What is tunneling-and-pivoting and why use it?
tunneling-and-pivoting is a skill for establishing network tunnels through compromised hosts to access internal systems. It enables you to pivot from an initial foothold into deeper network layers, bypass egress filtering, and chain multiple hops together for lateral movement and reconnaissance.
How do you set up SSH tunneling and port forwarding for pivoting?
tunneling-and-pivoting covers SSH port forwarding techniques where you configure local or remote port forwards through a compromised host. You can also establish dynamic SOCKS proxies via SSH to route traffic through the pivot point, allowing tools like ProxyChains to transparently redirect connections through the tunnel.
What is Chisel reverse SOCKS proxy setup?
tunneling-and-pivoting includes Chisel, a fast TCP/UDP tunnel over HTTP. You deploy a Chisel server on your control machine and run a client on the compromised host in reverse mode, creating a SOCKS proxy that routes your traffic back through the pivot for multi-layer network access.
How does tunneling-and-pivoting handle egress filtering bypass?
tunneling-and-pivoting teaches DNS tunneling (iodine, dnscat2), ICMP tunneling (ptunnel-ng, icmpsh), and HTTP tunneling (Neo-reGeorg) to bypass egress restrictions. These techniques encapsulate traffic in allowed protocols, enabling command and control or data exfiltration when standard ports are blocked.
How do you establish tunnel through firewall on Windows?
tunneling-and-pivoting covers Windows pivoting with netsh portproxy for local forwarding, plink for SSH-based tunnels, and SSH dynamic SOCKS configuration. These methods let you chain Windows hosts together and access internal services even when direct egress is restricted.
What transparent routing and multi-layer pivoting tools does tunneling-and-pivoting teach?
tunneling-and-pivoting includes Ligolo-ng for transparent TUN-based routing and socat TCP relays for flexible chaining. These enable multi-layer pivoting where traffic flows transparently through multiple compromised hosts, creating complex attack paths for deep internal network access.
SKILL.md
rendered from the published skill — quoted content, verbatim
SKILL: Tunneling & Pivoting — Expert Attack Playbook
> AI LOAD INSTRUCTION: Expert tunneling and pivoting techniques. Covers SSH port forwarding (local/remote/dynamic/jump), Chisel reverse SOCKS, Ligolo-ng transparent TUN pivoting, socat relays, DNS/ICMP/HTTP tunneling, ProxyChains configuration, Windows pivoting (netsh/plink), and multi-layer chaining. Base models miss egress-aware tool selection and transparent routing setup.
0. RELATED ROUTING
Before going deep, consider loading:
- network-protocol-attacks for network-level attacks from pivot positions
- reverse-shell-techniques for establishing initial access shells
-
unauthorized-access-common-services for exploiting services discovered through pivots
(truncated - see the full file via the links below)
Read as markdown · JSON record · Browse the source repository
File tree — 1 file
skills/tunneling-and-pivoting/SKILL.md