6.1.2 Validate routes, naming and pivot connectivity
AD cheatsheet | §6 — AD Notes | §6.5.3 — Read output
A known source host/vantage point and scoped destination. If pivoting is needed, first establish the pivot's real interfaces/routes and connectivity.
Where to look: Draw source -> tunnel/forward -> destination service, plus DNS and any callback/delivery paths. Test the connection from the actual initiating host. Use a fixed forward for one service, SOCKS for supported TCP clients or a routed tunnel when its capabilities are needed.
Expected behavior / secure boundary: A host can reach a subnet that Kali cannot. SOCKS does not automatically carry raw SYN, ICMP, UDP or every DNS request. An IP route working does not establish Kerberos FQDN/SPN correctness.
These commands are study references for a later scoped exercise. Replace placeholders for the selected environment; the output below is synthetic, not a recorded target result. Commands that collect secrets, request tickets, create sessions or change directory state require their stated prerequisites.
6.1.2.1 Baseline network position on Linux
Run: Controlled Linux host. Requires: Current shell; some process/socket ownership fields require more privilege. Effect: Reads interfaces, routes, neighbors, listeners and resolver configuration.
id
ip -brief address
ip route
ip neigh
ss -lntup
cat /etc/resolv.conf
6.1.2.2 Baseline network position on Windows
Run: Controlled Windows host. Requires: Current shell; some fields can be restricted. Effect: Reads token and network position.
whoami /all
ipconfig /all
route print
arp -a
netstat -ano
What this checks: These are network-position discovery commands, not an instruction to install a tunnel. Use the owning pivot procedure to select OpenSSH, Chisel or Ligolo-ng after understanding direction, privileges and transport.
6.1.2.3 Interpret the output
Normalized observations: the following is a synthetic interpretation example, not literal output from one command. Placeholder ciphers and secrets are deliberately unusable.
Kali -> APP01 TCP/443: reachable
APP01 -> DC01 TCP/389: reachable
Kali -> DC01 TCP/389: timeout
SOCKS client TCP connection works; raw scan fails
| Interpreted result | What it establishes | Required next check | Continue at |
|---|---|---|---|
| APP01 can reach DC01 | The pivot has a potential service path. | Choose a compatible forward/proxy/route from Kali via APP01. | §6.1.2.1 — Validate routes, naming and pivot connectivity |
| Kali timeout | Direct Kali reachability was not established. | Do not interpret it as a rejected domain password. | §6.1.1.1 — Establish the current identity and domain |
| Raw scan fails through SOCKS | The tool may be using an unsupported transport. | Select TCP-connect/native-proxy behavior or the appropriate routed solution. | §6.1.2.1 — Validate routes, naming and pivot connectivity |
Stop when: The required service, DNS and any callback path are tested from the correct source.
Revisit only when: A host, interface, subnet, tunnel or connection direction changes.
6.1.2.4 Decide and continue
| Result | Decision | Next numbered section |
|---|---|---|
| Enabled after validation | The required transport and DNS path work: retry the one relevant service check. | §6.4.1.1 — Select a compatible remote-access mechanism |
| Ruled out in this context | The pivot itself cannot reach the service: a tunnel cannot invent upstream reachability. | §6.1.2.1 — Validate routes, naming and pivot connectivity |
| Inconclusive / failed check | Callback or DNS is untested: retain the separate gap rather than declaring the whole route working. | §6.5.1.1 — Diagnose the failed boundary |
6.1.2.5 Tooling and complete procedure
Built-in route/interface commands first. OpenSSH/Chisel/Ligolo-ng are later alternatives selected by connection direction and protocol; no installation or tunnel execution is performed for concept notes. The commands above are extracts from the owning procedure; Windows-host and Kali/target tool availability must be checked in that environment. No installation or target execution is implied by this page.
Open the owning procedure, prerequisites and complete variants. Study mechanisms and alternatives. Shared concepts. §6.6.2 — Choose an approach.