Tunneling & Pivoting

Mon, 16 Mar 2026 00:00:00 +0000

Every method. Copy-paste the command. Move on.

Conventions: 10.10.14.x = attacker, 172.16.0.x = internal target, pivot = compromised dual-homed host.

SSH Tunneling

The foundation. If you have SSH creds to a pivot host, you have everything you need.

Route traffic from your machine through the pivot to an internal target.

1
2


# Access 172.16.0.10:80 via pivot, available at localhost:8080
ssh -L 8080:172.16.0.10:80 user@pivot -N

Now curl http://127.0.0.1:8080 hits the internal web app. The pivot does the routing.