Pivoting and tunneling: moving through internal networks

The first compromised host is rarely the goal: it is a foothold into internal networks you cannot reach directly. Pivoting routes your traffic through it.

The techniques

SSH port forwarding: -L (local), -R (remote), -D (dynamic SOCKS) routes ports through an SSH session. SOCKS proxy + proxychains sends any tool (nmap, browser) through the internal network. chisel/ligolo create tunnels over HTTP/TLS when SSH is absent.

ssh -D 1080 user@pivot          # SOCKS into the internal network
proxychains nmap -sT 10.10.10.0/24   # scan via the pivot

Defence

Network segmentation and microsegmentation: a compromised host must not reach everything. Egress filtering, monitoring anomalous tunnels (long-lived connections, unusual volumes), and detection of pivoting tools. Zero trust between internal segments.