ADB Port Forwarding

The Android Debug Bridge (adb) can forward arbitrary TCP ports between the development host and an Android device — in both directions. Beyond its debugging purpose, this is a lightweight tunneling primitive: it exposes device-local services to the host (and vice versa) without rooting the device or installing extra tooling.

Commands

# Host port -> device port
# Requests to localhost:$LOCAL_PORT on the host are forwarded to
# $ANDROID_PORT on the device.
adb forward tcp:$LOCAL_PORT tcp:$ANDROID_PORT
 
# Device port -> host port (reverse)
# Requests to $ANDROID_PORT on the device are forwarded to
# $LOCAL_PORT on the host. Useful for exposing an intercepting
# proxy (e.g., Burp Suite) to apps on the device.
adb reverse tcp:$ANDROID_PORT tcp:$LOCAL_PORT
 
# List and remove forwards
adb forward --list
adb forward --remove-all
adb reverse --remove-all

Targets other than tcp: are supported — e.g. local:<unix socket>, jdwp:<pid>, dev:<character device>.

Security relevance

• Pivoting: on a device with ADB over TCP exposed (port 5555 — common on emulators, IoT, and misconfigured devices), adb forward turns the device into a network foothold reachable from an attacker’s host.
• Traffic interception: adb reverse routes an app’s traffic through a host-side proxy for dynamic analysis.
• Detection: ADB listening on 5555 is directly indexed by Shodan (port:5555 product:"Android Debug Bridge"); Android 11+ wireless debugging requires pairing, which limits (but doesn’t eliminate) remote abuse.

For general-purpose tunneling, see chisel and ligolo-ng.

Sources

• Android Developers — Android Debug Bridge (adb)
• Protocol Tunneling — MITRE ATT&CK T1572

Related: chisel, ligolo-ng, ssh, burp-suite-firefox, android-emulator-rooted-burp-setup