skills.rest
xalgord
xalgordCOMMUNITY
Explore all skills by this author →
WebsiteGitHub

performing-network-pivoting-and-tunneling

Establishes SSH, SOCKS, and routed tunnels to pivot into segmented internal networks during authorized engagements.

954|172|Updated Mar 13, 2026
Search Tags:#penetration testing#pivoting#ssh port forwarding#Chisel#SOCKS proxy#Ligolo-ng#Tunneling
One-click install
npx skills add https://github.com/xalgord/xalgorix --skill performing-network-pivoting-and-tunneling
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: performing-network-pivoting-and-tunneling
Source: https://github.com/xalgord/xalgorix/tree/main/internal/tools/skills/data/linux-hardening/performing-network-pivoting-and-tunneling
Command: npx skills add https://github.com/xalgord/xalgorix --skill performing-network-pivoting-and-tunneling

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

During authorized penetration tests, compromised foothold hosts often sit on network segments that the tester's machine cannot reach directly, and naive tunneling attempts fail due to wrong forward directions, SOCKS-incompatible scans, or restrictive egress rules.

Core Features & Use Cases

  • SSH Forwarding Primitives: Covers local (-L), remote (-R), and dynamic (-D) forwarding with proxychains for SOCKS-based access to entire subnets.
  • Routed Tunneling: Uses ligolo-ng, chisel, sshuttle, and socat to create routed tun interfaces or reverse SOCKS proxies when plain SSH is unavailable or too slow.
  • Egress-Restricted Tunnels: Provides DNS (iodine), ICMP (ptunnel-ng), and outbound-443 options (cloudflared, ngrok, frp) for locked-down networks.
  • Use Case: After compromising a web server that can reach a 10.0.5.0/24 management VLAN, set up a dynamic SSH SOCKS proxy and run proxychains nmap -sT -Pn to enumerate RDP, WinRM, and MSSQL hosts unreachable from the attack box.

Quick Start

Ask the assistant to set up a SOCKS pivot through a compromised foothold host so you can scan the internal subnet it can reach.

Frequently Asked Questions about performing-network-pivoting-and-tunneling

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I scan an internal network through a SOCKS proxy?▼

Create a dynamic SSH forward with ssh -f -N -D 1080 user@foothold, add socks4 127.0.0.1 1080 to proxychains.conf, then run proxychains nmap -n -Pn -sT against internal hosts. SOCKS proxies only carry TCP, so SYN and ICMP scans will not work.

What is the difference between SSH local, remote, and dynamic port forwarding?▼

Local (-L) binds a port on your machine that tunnels to a remote host through the foothold. Remote (-R) opens a port on the foothold that forwards back to your side, needing GatewayPorts yes for non-loopback binds. Dynamic (-D) creates a SOCKS proxy reaching any host the foothold can see.

chisel vs ligolo-ng for network pivoting?▼

chisel provides fast TCP and SOCKS tunnels over HTTP with a reverse mode for NAT'd victims, but traffic still goes through proxychains. ligolo-ng creates a routed tun interface so tools like crackmapexec and evil-winrm talk to the subnet natively without proxychains.

Why does my nmap scan through proxychains return nothing?▼

SOCKS proxies cannot carry ICMP or raw SYN packets, so scans must use TCP connect mode with -sT and skip host discovery with -Pn. Running a default nmap scan through proxychains will hang or return no results.

How do I tunnel out of a network that only allows outbound HTTPS?▼

Use outbound-only tools like cloudflared tunnel --url, ngrok tcp, or frp, which ride egress port 443 and need no inbound firewall rules. If only DNS or ICMP leak, use iodine or ptunnel-ng instead.

Why does my chisel or ligolo-ng tunnel fail to connect?▼

Client and server (agent and proxy) must run identical versions, since mismatches break the tunnel silently. Verify with --version on both ends and confirm the tunnel establishes and traffic flows through the listener or proxychains.

Related Skills

Explore More Software Engineering Skills→
wgpsecwgpsec
1.6k

internal-recon

Map live hosts, open ports, services, and critical assets in internal networks using fscan.

Official
Intermediate
Prohao42Prohao42
120

windows-lateral-movement

Execute lateral movement techniques on Windows systems for penetration testing.

Community
Advanced
blacklanternsecurityblacklanternsecurity
253

network-recon

Discover live hosts, scan open ports, and fingerprint operating systems.

Official
Advanced
AeonDaveAeonDave
15

cobalt-strike

Deploy Cobalt Strike Beacon implants with customizable C2 profiles.

Community
Advanced