DB.
Courses

Advanced Tunneling
OSCP · Chapter 15

Advanced Tunneling

Advanced tunneling lets you pivot through a compromised host to reach internal networks that are not directly routable from your attacking machine — essential once initial access is limited to a single DMZ box.

Key concepts

  • SSH local/remote/dynamic port forwarding is the simplest form of tunneling and is built into virtually every Unix host.
  • A SOCKS proxy (via `ssh -D`) lets tools like proxychains route arbitrary traffic through the compromised host without per-port forwarding rules.
  • Protocol tunneling (encapsulating traffic inside DNS or HTTPS) is used when only those protocols can egress a restrictive firewall.
  • Document every pivot hop during an engagement — losing track of which host proxies to which is a common and dangerous mistake.

Example

ssh -D 9050 user@pivot-host      # local SOCKS proxy through pivot-host
proxychains nmap -sT -p 445 10.10.20.5   # scan an internal host through the tunnel

Try it yourself

In a lab with two chained VMs, set up an SSH dynamic port forward from your attacker box through the first VM, then use proxychains to reach a service only visible from that first VM's internal network.

ReferenceSearch video walkthroughs

@ Daniel Burlacu