Compose multiple pivots and validate every connection leg

Needs: A working first route, explicit second carrier/listener directions and correct per-hop DNS/return paths

For every additional hop, write another complete segment

# For every additional hop, write another complete segment
Kali -> tunnel A -> PIVOT_A -> tunnel B -> PIVOT_B -> INTERNAL_HOST:PORT

validate one hop before adding the next;

avoid overlapping local/VPN/internal routes;

use unique listener and SOCKS ports;

record which session owns each route;

ensure the deeper agent/client can reach the upstream listener;

re-evaluate DNS and callback direction at every hop;

prefer a routed method for several deep services instead of stacking many opaque wrappers.

Verify → Validate each hop with an application-aware test before chaining the final client.

If it fails → Avoid rebuilding every tunnel after one failure. Isolate the first broken leg and preserve working state. More detail ↓

If → then

A foothold exposes an interface/subnet or a loopback-only service → Discover pivot interfaces, routes and internal service context
Needs: A usable pivot process/identity and explicit scope; both forward and return directions must be understood
A pivoted exploit reaches its target but its shell/download cannot return → Build the callback and delivery routes separately from the attack route
Needs: Target-to-listener/download-server path, correct advertised address and compatible reverse listener/forward
A credential appears valid but the destination's usable access is unknown → Match route, destination service and effective authorization
Needs: Real source-to-service route, correct identity context and protocol-specific execution/logon rights

No useful finding → another task in this topic. Failed check → resolve the failure before ruling out the path.

Explanation & examples

Compose multiple pivots and validate every connection leg

USE WHEN: A second internal network is reachable only from a later foothold
STARTING ACCESS: A pivot identity/process or reachable SSH service and a drawn source-to-destination path
RESULT: A verified selected route across multiple source positions

Recognize the clue

Start from the last verified first-hop state, inspect the next foothold's routes and assign each new listener/carrier a source and destination.

hostname
ip route
ss -lnt

SYNTHETIC EXAMPLE OUTPUT

Hop 1 service test: works
Hop 2 carrier: connected
Final application: times out

Means: The break lies beyond a known working leg; a connected second carrier is not a complete final route.

Confirm: Test each listener-to-destination leg, names and return traffic independently from the correct source.

After validation: Every required application leg is verified: use the composed route.
Ruled out in this context: One required hop cannot reach the destination under the selected topology: reject that composition.
Still inconclusive: A final timeout without per-leg tests cannot identify which hop failed.

Troubleshooting: Avoid rebuilding every tunnel after one failure. Isolate the first broken leg and preserve working state.

Additional prerequisite checks

ip route
ss -lnt

For every additional hop, write another complete segment:

Rules:

validate one hop before adding the next;
avoid overlapping local/VPN/internal routes;
use unique listener and SOCKS ports;
record which session owns each route;
ensure the deeper agent/client can reach the upstream listener;
re-evaluate DNS and callback direction at every hop;
prefer a routed method for several deep services instead of stacking many opaque wrappers.

An upstream tunnel failure invalidates every deeper observation. Do not troubleshoot target credentials until the complete path is restored.

Why it works

Each additional hop introduces another initiator/listener/destination path. A connected second agent does not prove that the final application or callback crosses every leg.

Worked example · hypothetical

Observation: the first pivot reaches the second host but not its internal subnet. Test: verify the second host's route, then the selected service on each leg. Illustrative output: one forward points to the wrong loopback. Interpretation: fix that leg and retain the working first hop.

New identity, privilege, host or route? Re-enumerate → All topic tasks →

Study guide ↗Full procedure ↗Cheatsheet ↗