Tunneling and Port Forwarding

SSH over HTTP (Squid)

GitHub - adon90/pentest_compilation: Compilation of commands, tips and scripts that helped me throughout Vulnhub, Hackthebox, OSCP and real scenarios
PWK Notes: Tunneling and Pivoting [Updated]
0xdf hacks stuff
socat TCP-L:9999,fork,reuseaddr PROXY:ip:,proxyport=3128
ssh [email protected] -p 9999
proxytunnel -p ip:3128 -d -a 5555
ssh [email protected] -p 5555
http ip 3128
proxychains ssh [email protected]
ssh [email protected] -t /bin/sh


For this technique, it is necessary to be able to upload a file to a webserver.
1. reGeorgFile upload to the server correct
Tunnel creationpython reGeorgSocksProxy.py -p 5555 -u "http://<ip>/admin/uploads/reGeorg.jsp"
Proxychains config
proxychains nmap -F -sT
proxychains mysql -u root -p -h
proxychains ssh localhost
2. ABBTTS Upload File
Config proxychains and create the tunnelpython abpttsclient.py -c tomcat_walkthrough/config.txt -u http://ip/abptts.jsp -f -p 22222 [email protected]

HTTP Redirectors

1. socatsocat TCP4-LISTEN:80,fork TCP4:REMOTE-HOST-IP-ADDRESS:80
2. iptablesiptables -I INPUT -p tcp -m tcp --dport 80 -j ACCEPTiptables -t nat -A PREROUTING -p tcp --dport 80 -j DNAT --to-destination REMOTEADDR:80iptables -t nat -A POSTROUTING -j MASQUERADEiptables -I FORWARD -j ACCEPTiptables -P FORWARD ACCEPTsysctl net.ipv4.ip_forward=1

Windows Socks Proxy

In this case this is going to be used to access Burp listening on a Windows NATed VM from other PCs in the same network as the Windows Host.
From the Windows Host machine (IP:
Import-Module .\Invoke-SocksProxy.psm1
Invoke-SocksProxy -bindPort 1234
From other PC on the Windows Host machine network (IP:
Configure proxychains.conf:
socks4 ip 1234
proxychains socat TCP-LISTEN:8081,fork,reuseaddr TCP:ip:8080
This command ahead makes Burp (which is listening on the NATed machine) accessible from ip on port 8081
Now, configure the Proxy in the browser:
All the traffic is logged on the NATed machine Burp.

Man's Poor VPN

Traffic forward over SSH without needing to ssh -D <port>
sshuttle -vr [email protected] 1X0.1X.0.0/16
Copy link
On this page