skills.rest
xalgord
xalgordCOMMUNITY
Explore all skills by this author →
WebsiteGitHub

performing-network-tunneling-and-pivoting

Establishes SSH tunnels, SOCKS proxies, and covert channels to pivot into internal networks during authorized penetration tests.

954|172|Updated Mar 13, 2026
Search Tags:#penetration testing#lateral movement#pivoting#SOCKS proxy#ProxyChains#Tunneling#ssh forwarding
One-click install
npx skills add https://github.com/xalgord/xalgorix --skill performing-network-tunneling-and-pivoting
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: performing-network-tunneling-and-pivoting
Source: https://github.com/xalgord/xalgorix/tree/main/internal/tools/skills/data/penetration-testing/performing-network-tunneling-and-pivoting
Command: npx skills add https://github.com/xalgord/xalgorix --skill performing-network-tunneling-and-pivoting

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

During an authorized penetration test, a compromised foothold often sits between the attacker and unreachable internal network segments. This Skill guides the establishment of tunnels, port forwards, and SOCKS proxies so tools on the attack box can reach internal services like RDP, WinRM, SMB, and SQL through the pivot host.

Core Features & Use Cases

  • SSH Forwarding Mastery: Covers local (-L), remote (-R), and dynamic (-D) forwarding, including GatewayPorts pitfalls, VPN-over-SSH, and Terrapin (CVE-2023-48795) considerations.
  • Agent-Based Pivots: Provides workflows for chisel, ligolo-ng, sshuttle, socat, and plink when SSH is unavailable or egress is restricted.
  • C2 and Covert Channels: Details Meterpreter/Cobalt Strike routing, netsh portproxy, and DNS/ICMP/HTTPS tunnels (dnscat2, iodine, cloudflared, ngrok) for filtered egress.
  • Use Case: You have a Linux foothold that can reach an internal 10.10.17.0/24 subnet. The Skill walks you through creating a dynamic SOCKS proxy with ssh -D, routing nmap and evil-winrm through proxychains with -Pn -sT, and documenting the finding in a structured report format.

Quick Start

Ask the agent to set up a SOCKS proxy through the compromised host and scan the internal subnet for open RDP and WinRM ports.

Frequently Asked Questions about performing-network-tunneling-and-pivoting

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I pivot into an internal network through a compromised host?▼

Create a dynamic SSH SOCKS proxy with ssh -f -N -D 1080 user@compromised_host, then route tools through it using proxychains. This lets nmap, evil-winrm, and other tools reach internal subnets the foothold can access.

How to use chisel or ligolo-ng for reverse tunneling when SSH is unavailable?▼

Run a chisel server on the attacker and connect the victim client with R:socks for a reverse SOCKS proxy. Alternatively, ligolo-ng creates a tun interface with routes, letting tools reach internal networks directly without proxychains.

Why does nmap fail or report hosts down through a SOCKS proxy?▼

ICMP and SYN scans cannot traverse a SOCKS proxy, so ping discovery and raw SYN scans silently fail. Always scan with nmap -Pn -sT through proxychains to use full TCP connect scans.

Why does my SSH remote forward only bind to localhost on the victim?▼

ssh -R binds to loopback unless GatewayPorts yes is set in the victim's sshd_config. Without it, reverse shells sent to the victim's internal IP will not reach your forwarded port.

What tunneling options work when only outbound HTTPS or DNS is allowed?▼

Use covert tunnels such as cloudflared or ngrok over outbound 443, or DNS tunnels like dnscat2 and iodine, and ICMP tunnels like ptunnel-ng or hans. These bypass strict egress filtering without inbound firewall changes.

Related Skills

Explore More Software Engineering Skills→
wgpsecwgpsec
1.6k

internal-recon

Map live hosts, open ports, services, and critical assets in internal networks using fscan.

Official
Intermediate
ArianHobson333ArianHobson333
7

lateral-movement

Perform network lateral movement using Pass-the-Hash, WMI, WinRM, and SMB techniques.

Community
Advanced
0x0pointer0x0pointer
13

network-assess

Map internal networks and enumerate hosts, services, and VLANs with network tools.

Official
Advanced
AeonDaveAeonDave
15

cobalt-strike

Deploy Cobalt Strike Beacon implants with customizable C2 profiles.

Community
Advanced