chisel
TCP tunnels to reach internal services (pivoting).
Builds TCP-over-HTTP tunnels to reach internal services when pivoting through a compromised host. A single binary acts as server (on the attacker) and client (on the victim); with R:socks it sets up a reverse SOCKS proxy you combine with proxychains.
Family Pivoting & tunnelling
Flags server --reverse / client R:socks
Concepts Local port forwarding (SSH tunnel), Dynamic Port Forwarding (SOCKS)
Cheatsheet Chisel
Installation
# chisel: a single binary is both server and client. Upload the build for the target OS
sudo apt install -y chisel # on Kali; or download the binary from releases
# Windows: upload chisel.exe (pick the correct architecture)Useful commands
Appears in
Some machines where its use is documented; not an exhaustive list.
- BuffHackTheBox
- FishProving Grounds Practice
- MonitorsThreeHackTheBox
- NagoyaProving Grounds Practice
- OpenSourceHackTheBox
- PCProving Grounds Practice
- Symfonos 1 & 2VulnHub
- ZabProving Grounds Practice