SSH Tunneling / Port Forwarding

SSH tunneling lets you reach hosts and services that aren’t directly routable from your machine, by relaying traffic through a host you already have access to.

Local port forwarding

Forwards a port on your machine to a port on a remote network, via a gateway host.

1
ssh gateway -p 53 -L 8080:10.11.1.50:80

This creates a tunnel to gateway on port 53, which relays traffic to 10.11.1.50:80. Connecting to 127.0.0.1:8080 on your machine reaches that remote service.

Remote port forwarding

Exposes a port on your attacking machine, from the compromised host’s perspective — useful for exposing an internal service back out to you.

1
ssh gateway -p 53 -R 3390:127.0.0.1:3389

Run from the compromised internal machine, this tunnels its local port 3389 (RDP) back to port 3390 on your attacking machine (gateway).

Dynamic port forwarding

Turns your local machine into a SOCKS proxy for reaching an entire target network through a single pivot host.

1
ssh -D 8080 -p 2222 pivot_host

Traffic sent to local port 8080 (via a SOCKS-aware client or proxychains) is tunneled through pivot_host on port 2222 into its network.

Checking what’s listening before you tunnel

1
netstat -tulpn

1
-t   # TCP sockets
2
-u   # UDP sockets
3
-l   # Listening sockets only
4
-p   # Process using the socket
5
-n   # Don't resolve service names