Offensive methodology
Pivoting and tunnelling
Once a first host is compromised, reaching the internal networks it can see but you cannot. The concepts of pivoting, port forwarding and tunnelling. Authorised lab only.
The vocabulary
| Term | Meaning |
|---|---|
| Pivot host | The compromised machine used as a relay to another network. |
| Local port forwarding | A port on your machine is redirected to a service reachable from the pivot. |
| Remote port forwarding | A port on the pivot is redirected to a service on your machine. |
| Dynamic proxy (SOCKS) | A proxy that routes all your traffic through the pivot. |
| Tunnel | Encapsulate one protocol inside another (often SSH) to cross a filter. |
Approach
- SpotThe pivot has a second interface or sees a network you cannot reach.
- Set up the relayPort forward for a single service, SOCKS for a whole network.
- Route the toolsproxychains sends nmap and friends through the proxy.
- Enumerate againFrom the new vantage point, start reconnaissance over.
With SSH
| Command | Effect |
|---|---|
| ssh -L 8080:interne:80 user@pivot | Local forward: internal:80 becomes reachable locally on 8080. |
| ssh -R 9001:localhost:9001 user@pivot | Remote forward: the pivot exposes a port towards your machine. |
| ssh -D 1080 user@pivot | SOCKS proxy on 1080: all traffic goes through the pivot. |
| proxychains nmap -sT … | Send a tool through the SOCKS proxy. |
Other toolsWhen SSH is not available: chisel, ligolo-ng or socat create equivalent tunnels. The principle stays the same: a relay, then route your tools through it.
Defensive side
- Segment the network: a compromised host should not be able to talk to everything else.
- Monitor unusual internal connections and outbound tunnels (volumes, ports, regularity).
- Network detection: see Network Traffic Analysis and the Zeek logs sheet.