Tagged: Pivoting
9 posts · browse all tags
-
Metasploit Deep Dive Part 8: Pivoting Into the Blind Spot
Parts 6 and 7 exhausted stock Metasploit against a Defender-protected Windows host with no session to show for it. Part 8 moves to Linux, gets a clean foothold, and pivots into a segment the SIEM can't see at all.
-
Old Kit, New Kit Part 9: Pivoting — Chisel vs ssh -D / socat
Two classic pivoting options cost wildly different amounts to actually deploy on Windows, chisel gets caught and quarantined by name the moment it touches disk — and the SIEM watching the pivot host misses all of it, including the one thing that actually got caught.
-
BitBang CLI Part 2: What a WebRTC Reverse Shell Looks Like From the Wire
bitbang-cli needs no listener, no attacker-run infrastructure, and no SSH client on the target to get an outbound shell and LAN proxy. What that means next to Chisel and ligolo-ng, and what actually shows up in logs and on the wire when it runs.
-
Pivoting and Tunneling Part 1: Why Pivoting Is Just Routing With Extra Steps
Extending the Impacket lab with a segmented finance VLAN you can't reach directly, then working through SSH -L/-R/-D and SOCKS/proxychains as the baseline pivoting toolkit — and exactly where that baseline runs out of road.
-
Pivoting and Tunneling Part 2: Chisel and the HTTP Tunnel That Looks Like Nothing
Chisel's server/client model verified against the real v1.11.8 --help output — reverse SOCKS over plain HTTP, fingerprint-pinned key exchange, and why a tool that requires no SSH on the target still gets past egress policy that SSH itself can't.
-
Pivoting and Tunneling Part 3: ligolo-ng and Tunneling Without Proxychains
ligolo-ng's TUN-interface architecture verified against the real v0.9 binary — how a gVisor userland network stack turns a reverse connection into something your OS routing table treats as a real interface, no SOCKS or LD_PRELOAD required.
-
Pivoting and Tunneling Part 4: What Tunneling Does to Your Packets — MTU, Fragmentation, and PMTUD Inside a Tunnel
Every tunnel in this series stacks a new MTU on top of the path's real one. Why that makes Path MTU Discovery quietly fail inside pivots, why big transfers over a pivot "just hang," and how to diagnose it with the same tooling behind pmtud-sweeper.
-
Pivoting and Tunneling Part 5: Double Pivots, Multi-Hop Chains, and Catching Them From the Wire
Chaining a tunnel inside a tunnel to reach FIN-DB01 through two hops, why each additional hop compounds the MTU problem from Part 4, and the flow-level signals that actually catch multi-hop pivoting on a monitored fabric.
-
Pivoting and Tunneling Part 6: Defense in Depth — Segmentation, Egress Filtering, and Catching a Pivot on a Fortinet Fabric
The full chain from Impacket foothold to FIN-DB01 told end to end, followed by a concrete hardening checklist — internal segmentation firewalling, default-deny egress, TLS inspection, and the flow-based indicators from this series mapped onto real Fortinet configuration.