Pivoting & Tunneling 2026 — Chisel, Ligolo-ng, SSH Tunnels & SOCKS5 Through Victims | Hacking Course Day36

This article is Day 36 of a 100-day ethical hacking course focusing on network pivoting and tunneling techniques used to traverse segmented enterprise networks after initial compromise. It addresses the fundamental problem that network segmentation, while a valid security control against external attackers, becomes a navigational map once an attacker gains internal access to a trusted bridge host. The material demonstrates that pivoting through legitimately-connected hosts like DMZ servers or jump boxes can completely bypass firewall controls, making it essential knowledge for red team operations and penetration testing.

• Why Segmentation Fails After Initial CompromiseEnterprise networks segment systems into separate trust zones (DMZ, production, corporate, management) controlled by firewall rules. However, some hosts legitimately bridge multiple segments—such as web servers querying internal databases or jump boxes for administrator access. Once an attacker compromises these trusted pivot points, they inherit the network access those hosts already possess, rendering perimeter firewalls ineffective. The article illustrates this with a real engagement where a Chisel tunnel established on a two-interface DMZ web server bypassed correctly-configured firewall s
• SSH Port Forwarding: Three Distinct Forwarding TypesSSH offers three forwarding mechanisms for different pivoting scenarios. Local port forwarding (-L) maps a single local port to one internal service for accessing individual targets like RDP or web applications. Remote port forwarding (-R) runs on the pivot host to establish reverse connections, useful for C2 callbacks through firewalled environments. Dynamic port forwarding (-D) creates a SOCKS5 proxy on the attacker's machine, enabling full subnet enumeration through proxychains without requiring additional binary uploads.
• Chisel: HTTP Tunneling When SSH UnavailableChisel, a Go-based binary, creates encrypted TCP tunnels over HTTP/HTTPS, solving the problem when SSH is blocked or unavailable on pivot hosts. The reverse tunnel model is critical: the compromised host initiates outbound HTTP connections to the attacker's server on port 80 or 443—ports rarely blocked in egress filters—establishing a reverse SOCKS5 tunnel. Chisel traffic appears as normal web activity to firewalls and can run over HTTPS to blend encrypted traffic, making it difficult to detect without deep packet inspection.
• Ligolo-ng: Native Routing Without Proxychains LimitationsLigolo-ng creates a TUN network interface on the attacker's machine and adds routes for internal subnets through that interface, enabling kernel-level native routing rather than SOCKS5 proxying. This solves critical proxychains limitations: it supports all Nmap scan types including SYN scans (-sS), forwards UDP traffic, works with tools that don't support SOCKS5, and eliminates performance overhead. The article describes Ligolo-ng as the professional choice for sustained internal assessments because tools execute natively without any wrapper—web browsers, Evil-WinRM, and crackmapexec work dire
• Proxychains TCP-Only Limitation and WorkaroundSOCKS5 proxies, including those created by SSH dynamic forwarding and Chisel, can only relay full TCP connections—they cannot forward raw IP packets. This means proxychains Nmap requires the -sT flag for TCP connect scans but fails with -sS SYN scans because SYN scanning sends crafted raw IP packets that SOCKS5 cannot encapsulate. The -Pn flag is also required because ICMP ping is not supported through SOCKS5. Understanding this distinction directly explains why Ligolo-ng's native interface approach is superior for comprehensive internal scanning.
• Double Pivot: Chaining Compromised Hosts Across SegmentsDouble pivoting chains two compromised hosts to reach isolated segments neither the attacker's machine nor the first pivot can access directly. The architecture flows as Kali → Pivot Host 1 (bridging to Segment B) → Pivot Host 2 (in Segment B, bridging to Segment C) → target in Segment C. The article provides a nested Chisel implementation where a second Chisel server runs on Pivot Host 1, Pivot Host 2 connects back to it, and proxychains configured with dynamic_chain and two sequential SOCKS5 entries routes traffic through both hops automatically.
• Network Reconnaissance Before Tool DeploymentThe article emphasizes mapping network interfaces and routing tables before deploying any tunneling tools. Running 'ip addr' reveals multiple interfaces indicating segment connections, while 'ip route' shows what each interface can reach. A bash ping sweep quickly identifies active internal hosts. This reconnaissance determines which pivot points exist, which segments bridge together, and which tunneling technique fits each scenario—professional pivoting happens before touching any binary or proxy configuration.
• Practical Tool Selection: When to Use Each TechniqueThe article provides clear selection criteria: use SSH forwarding when you already have SSH access and need quick single-service access; use Chisel for rapid deployment when you only have web shell access or SSH is blocked; use Ligolo-ng for sustained internal assessments requiring SYN scans, UDP support, or multiple tools. The author's personal experience rebuilding a double pivot chain in eight minutes using Ligolo-ng instead of twenty minutes with proxychains demonstrates that tool selection efficiency directly impacts engagement success and time management.

Bottom line: Network pivoting through compromised bridge hosts allows attackers to completely bypass enterprise firewall segmentation once they gain internal access, making Ligolo-ng the professional choice for sustained internal assessments due to its native kernel-level routing that supports all scan types and tool compatibility, while SSH and Chisel remain essential for rapid initial access when additional tools cannot be deployed. Proper network reconnaissance before tool deployment and understanding the