Agent skill · security · yaklang
tunneling-and-pivoting
Tunneling and pivoting playbook. Use when establishing network tunnels through compromised hosts including SSH tunneling, Chisel, Ligolo-ng, socat, DNS/ICMP/HTTP tunneling, ProxyChains, and multi-layer pivoting strategies.
Why this skill is useful
Adds detailed executable scripts for various tunneling techniques and tools that enhance the AI's capabilities in network penetration testing.
What it needs
Requires chisel, ligolo-ng, proxychains, socat installed locally. About 5k tokens when loaded. Last updated 2026-06-16. 1,563 stars on the source repository.
What this skill does
SKILL: Tunneling & Pivoting — Expert Attack Playbook AI LOAD INSTRUCTION: Expert tunneling and pivoting techniques. Covers SSH port forwarding (local/remote/dynamic/jump), Chisel reverse SOCKS, Ligolo-ng transparent TUN pivoting, socat relays, DNS/ICMP/HTTP tunneling, ProxyChains configuration, Windows pivoting (netsh/plink), and multi-layer chaining. Base models miss egress-aware tool selection and transparent routing setup. 0. RELATED ROUTING Before going deep, consider loading: network-protocol-attacks for network-level attacks from pivot positions reverse-shell-techniques for establishing initial access shells unauthorized-access-common-services for exploiting services discovered through pivots linux-privilege-escalation or windows-privilege-escalation after pivoting to new hosts --- 1. SSH TUNNELING Local Port Forward Forward a local port to a remote service through the pivot. Remote Port Forward Expose a local service to the pivot host's network. Dynamic Port Forward (SOCKS Proxy) Jump Host (ProxyJump) --- 2. CHISEL Reverse SOCKS Proxy (Most Common) Port Forwarding --- 3. LIGOLO-NG TUN interface-based pivoting — transparent routing without SOCKS. Listener (Reverse Shell Catcher Through Pivot) Double Pivot --- 4. SOCAT --- 5. PROXYCHAINS / PROXIFIER ProxyChains Configuration --- 6. WINDOWS PIVOTING Netsh Port Forwarding Plink (PuTTY CLI) --- 7. DNS TUNNELING --- 8. ICMP TUNNELING --- 9. HTTP TUNNELING --- 10. PIVOTING DECISION MATRIX Egress Allowed Tool Notes --- --- --- TCP outbound (any port) Chisel, Ligolo-ng, SSH Fastest setup TCP 80/443 only Chisel (HTTP/S), Neo-reGeorg Blend with web traffic DNS only (53/udp) iodine, dnscat2 Slow but stealthy ICMP only ptunnel-ng, icmpsh Very restricted environments No outbound Bind shell + port forward in Needs inbound access to pivot Web shell only Neo-reGeorg, Tunna When only HTTP file upload works --- 11. DECISION TREE
How to use it
Reference it in AdaL, Claude Code, Cursor or any coding agent — nothing to install:
@skills yaklang/tunneling-and-pivoting