Post Exploitation
Chisel is a fast TCP/UDP tunnel utility that encapsulates traffic over an HTTP transport channel, secured via SSH. It is useful for traversing firewall boundaries and pivoting inside network environments.
sudo apt install chisel
chisel [command] [options]
Chisel is a fast TCP/UDP tunnel transported over HTTP, secured via SSH encryption. It is designed for penetration testing scenarios where traditional VPNs or direct connections are blocked by firewalls.
With single-binary deployment on Linux, Windows, and macOS, Chisel provides both forward and reverse proxy capabilities, making it a versatile tool for network pivoting and firewall evasion.
chisel --helpShow top-level help with the server and client subcommandschisel --versionPrint the chisel version (must match between server and client)chisel server --helpShow all server-mode optionschisel client --helpShow all client-mode options and the remote spec formatchisel server -p 8080 --reverseStart a server allowing reverse (R:) tunnels from clientschisel server -p 8080 --socks5Start a server that exposes a built-in SOCKS5 proxy endpointchisel server -p 8080 --reverse --auth <USER>:<PASS>Start a reverse server protected by credentialschisel server -p 8080 --reverse -vStart a reverse server with verbose loggingchisel server -p 8080 --key "mysecret"Start a server with a seeded, reproducible key pairchisel server -p 8443 --tls-key server.key --tls-cert server.crt --reverseStart a TLS-wrapped reverse server using your own certificatechisel server -p 8080 --authfile users.jsonStart a server that reads user:pass and allowed remotes from a filechisel client 10.10.10.10:8080 socksConnect and open a local SOCKS5 proxy on 127.0.0.1:1080chisel client 10.10.10.10:8080 R:socksConnect and expose a SOCKS5 proxy on the server side (pivot)chisel client 10.10.10.10:8080 R:2222:127.0.0.1:22Reverse-forward server port 2222 to the client's local SSHchisel client 10.10.10.10:8080 8000:example.com:80Forward local port 8000 to example.com:80 through the tunnelTunnel traffic through HTTP to bypass firewalls.
Route traffic through remote network via SOCKS.
Expose internal services to external systems.
Forward shells and tool traffic over tunnel.
This tool is designed for authorized security testing, educational purposes, and legitimate network administration only. Unauthorized access to computer systems is illegal.