Pivoting

Binaries

You can download some useful binaries such as chisel, socat, nmap, etc: https://github.com/jpillora/chisel https://github.com/3ndG4me/socat https://github.com/andrew-d/static-binaries

Host discovery

Bash

for ip in <network_prefix>.{1..254}; do ((ping -c1 -W1 $ip &>/dev/null && echo $ip)&) done; wait

PowerShell

Nmap

ARP

Port discovery

Bash

for port in {1..65535}; do ((bash -c "echo > /dev/tcp/<target_ip>/$port" 2>/dev/null && echo $port)&); (( port % 200 == 0 )) && wait; done; wait

With progress:

for port in {1..65535}; do ((bash -c "echo > /dev/tcp/<target_ip>/$port" 2>/dev/null && echo -e "$port\033[K")&); (( port % 200 == 0 )) && wait && echo -ne "$port/65535\r"; done; wait

PowerShell

Nmap

Proxychains

Port forwarding

Chisel

First, run the chisel server in reverse mode in your host:

chisel server -p <listener_port> --reverse

Then, connect to the server:

chisel client <listener_ip>:<listener_port> R:<local_port>:<remote_host>:<remote_port>

chisel client <listener_ip>:<listener_port> R:socks

Socat

SSH

Subnet forwarding

sshuttle -r <user>:<password>@<target_ip> <subnet>