pivoting-tunneling

Network pivoting via SSH tunneling involves creating local, dynamic, or remote port forwards through a compromised host to access restricted internal networks. You can establish an SSH dynamic SOCKS proxy to route traffic and reach internal services like databases or web servers across network boundaries.

Chisel creates SOCKS proxies via HTTP tunneling, while Ligolo-ng establishes a transparent VPN-like connection for pivoting. Both tools facilitate network pivoting to access internal networks, but Ligolo-ng provides transparent routing rather than relying on proxy-aware client configurations.

Yes, DNS and ICMP tunneling are supported techniques to bypass network segmentation restrictions. These protocols are used to encapsulate traffic when standard ports are blocked, allowing you to maintain access to internal networks and services across restrictive boundaries.

Use an SSH jump host for targeted access to specific internal servers, whereas a dynamic SOCKS proxy is better for broad lateral movement across an internal network. Jump hosts provide direct connections to known targets, while SOCKS proxies offer flexible routing for varied reconnaissance.

Yes, socat supports port forwarding to relay traffic to internal Active Directory services. By configuring socat on a compromised host, you can forward specific local ports to remote internal network addresses, enabling access to otherwise restricted internal resources.

SSH remote port forwarding limitations include requiring an active SSH daemon on the compromised host and potential instability if the connection drops. Additionally, complex routing to multiple internal network segments often requires manual configuration of multiple forwarding rules.