9.7.0 Stage 07: Pivoting and Tunneling
← Main index | Pivoting cheatsheet | Master Notes | Strategy map | Study methods: Reach internal services
Purpose: build an explicit route from the tool to an internal service, including every listener, initiator, bind address, name-resolution point and return path.
| Task | Open |
|---|---|
| Choose a fixed, SOCKS, routed, HTTP/WebSocket or DNS route | Tunneling and port forwarding |
| Use Socat, all SSH directions, sshuttle, Windows clients/Netsh, Chisel or Ligolo-ng | Tunneling and port forwarding |
| Diagnose DNS/SPN, callbacks, transport limits and multihop failures | Tunneling and port forwarding |
Exit condition: a protocol-appropriate client reaches the intended internal endpoint through the documented route, and callback traffic (if needed) has a separate verified return path.