Tunneling and pivoting playbook. Use when establishing network tunnels through compromised hosts including SSH tunneling, Chisel, Ligolo-ng, socat, DNS/ICMP/HTTP tunneling, ProxyChains, and multi-layer pivoting strategies.

SKILL: Tunneling & Pivoting — Expert Attack Playbook AI LOAD INSTRUCTION : Expert tunneling and pivoting techniques. Covers SSH port forwarding (local/remote/dynamic/jump), Chisel reverse SOCKS, Ligolo ng transparent TUN pivoting, socat relays, DNS/ICMP/HTTP tunneling, ProxyChains configuration, Windows pivoting (netsh/plink), and multi layer chaining. Base models miss egress aware tool selection and transparent routing setup. 0. RELATED ROUTING Before going deep, consider loading: [network protocol attacks](../network protocol attacks/SKILL.md) for network level attacks from pivot positions [reverse shell techniques](../reverse shell techniques/SKILL.md) for establishing initial access shells [unauthorized access common services](../unauthorized access common services/SKILL.md) for exploiting services discovered through pivots [linux privilege escalation](../linux privilege escalation/SKILL.md) or [windows privilege escalation](../windows privilege escalation/SKILL.md) after pivoting to new hosts 1. SSH TUNNELING Local Port Forward Forward a local port to a remote service through the pivot. Remote Port Forward Expose a local service to the pivot host's network. Dynamic Port Forward (SOCKS Proxy) Jump Host (ProxyJump) 2. CHISEL Reverse SOCKS Proxy (Most Common) Port Forwarding 3. LIGOLO NG TUN interface based pivoting — transparent routing without SOCKS. Listener (Reverse Shell Catcher Through Pivot) Double Pivot 4. SOCAT 5. PROXYCHAINS / PROXIFIER ProxyChains Configuration 6. WINDOWS PIVOTING Netsh Port Forwarding Plink (PuTTY CLI) 7. DNS TUNNELING 8. ICMP TUNNELING 9. HTTP TUNNELING 10. PIVOTING DECISION MATRIX Egress Allowed Tool Notes TCP outbound (any port) Chisel, Ligolo ng, SSH Fastest setup TCP 80/443 only Chisel (HTTP/S), Neo reGeorg Blend with web traffic DNS only (53/udp) iodine, dnscat2 Slow but stealthy ICMP only ptunnel ng, icmpsh Very restricted environments No outbound Bind shell + port forward in Needs inbound access to pivot Web shell only Neo reGeorg, Tunna When only HTTP file upload works 11. DECISION TREE

tunneling-and-pivoting