srl
Pivoting, Tunneling, Port Forwarding
Pivoting is moving to other networks through a compromised host (the pivot) to reach targets on different segments. Its primary use is defeating segmentation — physical or virtual — to access an isolated network.
Tunneling is a subset of pivoting. It encapsulates network traffic in another protocol and routes it through that protocol.
Port forwarding redirects a communication request from one port to another.
1. Initial Enumeration — Finding More Targets Finding networks Command Description ifconfig / ip a Linux network configuration ipconfig /all Windows network configuration netstat -r / route Routing table for IPv4 netstat -antp Active connections with PIDs — identifies internal services to enumerate through the pivot netstat -antb | findstr 1080 Windows: TCP connections listening on port 1080 Internal host discovery Command Description for i in {1..254} ;do (ping -c 1 172.16.5.$i | grep "bytes from" &) ;done Linux ping sweep for /L %i in (1 1 254) do ping 172.16.5.%i -n 1 -w 100 | find "Reply" Windows CMD ping sweep 1..254 | % {"172.16.5.$($_): $(Test-Connection -count 1 -comp 172.16.5.$($_) -quiet)"} PowerShell ping sweep Through a SOCKS proxy: ICMP and SYN scans cannot be tunnelled. Always use nmap -Pn -sT (TCP connect, no ping discovery) when scanning through proxychains or any SOCKS-based pivot.