tunnel

To pivot through segmented networks during an AD pentest, you establish tunneling using tools like Ligolo-ng, Chisel, or SSH forwarding to bypass reachability barriers and route traffic to internal subnets across multiple hops.

Setting up a reverse tunnel when DNS egress is restricted involves deploying SOCKS relays or HTTP-based tunneling to maintain a stable route and bypass network segmentation rules blocking direct access.

Yes, you can use Chisel and Ligolo-ng for multi-hop pivoting; the Skill provides deterministic command builders to deploy resilient tunnels across hops, allowing you to chain tools to reach deeply contained subnets.

You verify network reachability after establishing a tunnel by following guided workflows that validate listener deployment and route integrity end-to-end, ensuring your SOCKS proxy or forwarded port successfully reaches the target hosts.

You should use SSH forwarding instead of frp for network tunneling when you already have SSH access to a pivot host and need a quick, dependency-free relay, whereas frp is better suited for persistent, full network access across restricted segments.

To document routes and reachable targets when setting up proxychains, apply the provided selection rules and output discipline to record listener configurations, deployed routes, and validated endpoints during your pivoting workflow.