O/ OSCP exploitation reference
Workspace controls Memory only · 0 steps
Visualize path ↗
Command values 0 filled

Temporary connection values clear on reload. Passwords, hashes and tickets remain placeholders. Check address-family syntax in the selected command.

← All pivoting & tunnels tasks

Use ProxyChains, native SOCKS clients and SSH jump paths appropriately

Needs: Client/proxy transport compatibility, correct proxy configuration and controlled name resolution

Direct SSH through an SSH pivot

# Direct SSH through an SSH pivot
ssh -J PIVOT_USER@PIVOT TARGET_USER@INTERNAL_HOST

# SSH through an existing SOCKS5 endpoint with Ncat
ssh -o ProxyCommand='ncat --proxy-type socks5 --proxy 127.0.0.1:1080 %h %p' \
  TARGET_USER@INTERNAL_HOST

Use an SSH configuration for repeated access

# Use an SSH configuration for repeated access
Host pivot
  HostName PIVOT
  User PIVOT_USER

Host internal
  HostName INTERNAL_HOST
  User TARGET_USER
  ProxyJump pivot

Use an SSH configuration for repeated access

# Use an SSH configuration for repeated access
ssh internal
scp FILE internal:DESTINATION_PATH

Use a task-specific configuration rather than repeatedly editing a shared global file

# Use a task-specific configuration rather than repeatedly editing a shared global file
strict_chain
proxy_dns
tcp_read_time_out 15000
tcp_connect_time_out 8000

[ProxyList]
socks5 127.0.0.1 1080

Use an SSH configuration for repeated access

# Use an SSH configuration for repeated access
proxychains4 -q -f ./proxychains-pivot.conf curl http://INTERNAL_HOST:PORT/
proxychains4 -q -f ./proxychains-pivot.conf nmap -sT -Pn -n -p PORTS INTERNAL_HOST
proxychains4 -q -f ./proxychains-pivot.conf impacket-smbclient \
  'DOMAIN/USER:PASSWORD@INTERNAL_HOST'

Native examples

  • ProxyChains hooks socket calls in dynamically linked programs; some static binaries, scripts, child processes or dynamically loaded modules bypass or break the hook.
  • ProxyChains supports TCP only. It does not proxy UDP, ICMP, SYN scans or pcap-based discovery.
  • For Nmap use -sT -Pn -n with a focused port list. Proxy scanning is slow and is not a replacement for discovery from the pivot.
  • proxy_dns moves supported hostname resolution through the proxy, but application behavior varies. -n prevents Nmap's local reverse lookups.
  • Prefer an application's native proxy option when available.
# Native examples
curl --socks5-hostname 127.0.0.1:1080 http://INTERNAL_HOST:PORT/
ncat --proxy-type socks5 --proxy 127.0.0.1:1080 INTERNAL_HOST INTERNAL_PORT

Verify → Verify destination application and resolver behavior through the intended path.

If it fails → Proxy interception is not universal. Use native proxy support, an SSH jump for SSH, or routed tunneling when the protocol requires it. More detail ↓

If → then

No useful finding → another task in this topic. Failed check → resolve the failure before ruling out the path.

Explanation & examples

Use ProxyChains, native SOCKS clients and SSH jump paths appropriately

USE WHEN
A SOCKS listener or an SSH jump host is already available
STARTING ACCESS
A pivot identity/process or reachable SSH service and a drawn source-to-destination path
RESULT
A verified application connection through the chosen proxy/jump

Recognize the clue

Inspect the established proxy/jump topology and each intended client's actual SOCKS or SSH-jump support before a protocol test.

curl --socks5-hostname 127.0.0.1:SOCKS_PORT http://TARGET:PORT/
SYNTHETIC EXAMPLE OUTPUT
Proxy-aware HTTP request: application response
Raw discovery request: no useful result

Means: One supported TCP application works; the proxy does not automatically carry raw packets or arbitrary DNS/UDP.

Confirm: Check native versus intercepted support, connect-only scanner modes, name resolution and every required protocol leg.

After validation
The actual client's application handshake works through the chosen proxy/jump: use it.
Ruled out in this context
A static/raw/UDP-only client is incompatible with this proxy wrapper: choose another transport.
Still inconclusive
A reachable SOCKS port without an end-to-end service test leaves the exit path unknown.

Troubleshooting: Proxy interception is not universal. Use native proxy support, an SSH jump for SSH, or routed tunneling when the protocol requires it.

Direct SSH through an SSH pivot:

SSH through an existing SOCKS5 endpoint with Ncat:

%h and %p are replaced with the destination host and port. Prefer this native proxy route when ProxyChains interposition is unreliable.

Use an SSH configuration for repeated access

Use a task-specific configuration rather than repeatedly editing a shared global file:

Constraints:

  • ProxyChains hooks socket calls in dynamically linked programs; some static binaries, scripts, child processes or dynamically loaded modules bypass or break the hook.
  • ProxyChains supports TCP only. It does not proxy UDP, ICMP, SYN scans or pcap-based discovery.
  • For Nmap use -sT -Pn -n with a focused port list. Proxy scanning is slow and is not a replacement for discovery from the pivot.
  • proxy_dns moves supported hostname resolution through the proxy, but application behavior varies. -n prevents Nmap's local reverse lookups.
  • Prefer an application's native proxy option when available.

Native examples:

Why it works

Native proxy support and library interception work differently. A TCP connect path can work while raw probes, statically linked tools or local DNS leak outside the intended path.

Worked example · hypothetical

Observation: curl works through SOCKS while a scanner fails. Test: use its documented connect-only mode and skip unsupported discovery. Illustrative output: selected TCP connections work. Interpretation: respect the client's transport limits rather than treating the proxy as broken.

New identity, privilege, host or route? Re-enumerate → All topic tasks →

Study guide ↗Full procedure ↗Cheatsheet ↗