skills.rest
hanc00l
hanc00lCOMMUNITY
Explore all skills by this author →
GitHub

internal-penetration

Discover and exploit assets in private IP ranges using Python, proxychains, frp, chisel, ligolo, and impacket.

Updated Aug 23, 2026
Search Tags:#lateral movement#tunneling#proxychains#impacket#frp#internal penetration
One-click install
npx skills add https://github.com/hanc00l/nemo-agent --skill internal-penetration
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: internal-penetration
Source: https://github.com/hanc00l/nemo-agent/tree/main/claude-code/.claude/skills/pentest/internal
Command: npx skills add https://github.com/hanc00l/nemo-agent --skill internal-penetration

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve?

Many penetration testers need a structured guide to conduct internal network infiltration, establish tunnels, and maintain persistence across diverse environments, which is often scattered across documentation.

Core Features & Use Cases

  • Tunnel Creation: Guides the setup of frp, chisel, and ligolo tunnels for reliable internal connectivity.
  • Lateral Movement: Details usage of proxychains, impacket, and nmap for scanning and moving laterally.
  • Persistence: Provides Linux persistence techniques and notes on maintaining footholds.
  • Use Case: In a corporate network, use this skill to pivot from an initial webshell to enumerate services, create a SOCKS5 tunnel via frp, and deploy a persistent Linux backdoor.

Quick Start

Invoke the internal-penetration skill to establish a tunnel and enumerate the internal network for a given target IP.

Frequently Asked Questions about internal-penetration

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I pivot from an initial foothold to enumerate internal network services?▼

To pivot and enumerate internal network services, this skill guides you through using proxychains and nmap via an established tunnel. It details lateral movement techniques to discover and exploit assets within private IP ranges.

What is the best way to create a SOCKS5 tunnel for internal network infiltration using frp?▼

Creating a SOCKS5 tunnel for internal network infiltration is achieved by setting up frp, chisel, or ligolo. This skill provides structured guidance on configuring these tools to ensure reliable internal connectivity across Linux and Windows systems.

Can I use impacket for lateral movement without relying on external APIs?▼

Yes, you can use impacket for lateral movement completely without external APIs. This skill utilizes local Python scripts alongside impacket to execute techniques for scanning and moving laterally within corporate environments.

How do I maintain persistence on a Linux system after gaining internal network access?▼

Maintaining persistence on a Linux system after internal access involves deploying specific backdoor techniques. This skill provides structured guidance on Linux persistence mechanisms to maintain your foothold across the target environment.

Does this skill support tunneling across both Linux and Windows corporate environments?▼

Yes, this skill supports tunneling and lateral movement across both Linux and Windows corporate environments. It details the application of chisel, ligolo, and frp to establish reliable cross-platform internal connectivity.

Related Skills

Explore More Education & Research Skills→
uphiagouphiago
1.1k

vhost-enumeration

Fuzz Host headers and parse SSL certificate SANs to discover hidden virtual hosts.

Community
Intermediate
AcczdyAcczdy
2

conducting-internal-network-penetration-test

Simulate internal network penetration tests to reveal lateral movement and privilege escalation paths.

Community
Advanced
AeonDaveAeonDave
15

ligolo-ng

Establish a reverse tunnel via TUN interface for pivoting into internal networks.

Community
Advanced
Prohao42Prohao42
120

tunneling-and-pivoting

Establish network tunnels and pivot paths from compromised hosts.

Community
Advanced