I85PREP
⌘ K
CSPT study materials
CSPT study resources

CSPT: Network Exploitation and Pivoting

CSPT · Work through your exam, one topic at a time.

All guide sections

Network Exploitation and Pivoting

From access to position

Network exploitation starts with an exposed service or valid credential set. Credential attacks must respect lockout policy - password spraying with a small candidate list across many accounts, not brute force against one account. Relay attacks depend on missing SMB signing or LDAP signing/channel binding. After initial access, establish situational awareness before acting: identity, host name, network interfaces and routes, running services, and the local security posture.

Pivoting mechanics

A pivot turns a compromised host into a route into otherwise unreachable segments. Core techniques:

  • SSH local forwarding (-L) exposes a remote service on your local port.
  • SSH remote forwarding (-R) exposes your service on the remote host.
  • SSH dynamic forwarding (-D) creates a SOCKS proxy.
  • chisel / ligolo-ng / socat for environments without SSH.
  • Proxychains to force tool traffic through a SOCKS proxy - note it handles TCP only, and UDP or ICMP will leak around it.

Plan pivot chains (double pivots) before you build them, and record every hop, as pivots are the most common cause of lost access and lost evidence.

Traps in exam questions

  • Reversing -L and -R under time pressure.
  • Running a scan without the proxy wrapper, sending traffic from your own address into a segmented network.
  • Triggering account lockout by ignoring the observed threshold.
  • Assuming a SOCKS proxy carries DNS; often it does not.

Rule of thumb

-L is Local to you and forwards out; -R is Remote and forwards back to you. Verify a pivot with curl ifconfig style checks against an internal host before scanning.

Worked example: a foothold in the DMZ reaches an internal /24 over TCP 8080 only. You build a SOCKS proxy through that port, tune proxychains, and confirm reachability with a single targeted request before running any enumeration.