Pivoting and File Transfers
Pivoting and file transfers
This domain tests movement across network segments and reliable transfer of tools and evidence. Expect SSH tunneling, SOCKS proxies, port forwarding, route addition, and file-transfer methods under egress filtering.
Core rules
- Map reachability first: local routes, ARP, DNS, and allowed egress. Do not scan an entire internal range to “see what is there.”
- Pivot with the least noisy channel that meets the objective: SSH local/remote forwarding, SOCKS over SSH, or an approved tunnel. Proxychains only works for TCP and depends on correct configuration.
- Transfer files with integrity checks: HTTP server plus
curl/wget, SCP/SFTP, SMB, or base64 for small text. Compare SHA-256 hashes. - Keep transfer logs, filenames, hashes, source/destination, and cleanup evidence.
Worked example
A compromised DMZ host can reach 10.20.30.0/24, but your workstation cannot. You establish a SOCKS proxy over an authorized SSH account, configure the tool to use it, and request a single internal web page. Reasoning: the proxy proves reachability without broad scanning; a full range scan would be noisy and outside the approved objective. For a tool transfer, you serve the file over HTTP from a controlled host, download it with curl, and compare sha256sum on both sides. If egress is blocked, try an approved alternative, not covert exfiltration.
Traps
- Pivoting before confirming authorization for the second network.
- Using
proxychainsfor UDP or ICMP and concluding the host is down. - Transferring unverified binaries that are corrupted or altered.
- Leaving tools, scripts, and archives on target hosts.
- Using cleartext channels for credentials or sensitive evidence.
- Forgetting that internal scanning can trigger IDS and incident response.