Lion Cipher Lab
Pivot Through a Jump Host with SSH Tunneling and proxychains
- Penetration Testing / Red Team
- Intermediate
- ~60 min
- Free · no account required
Why it matters
Real networks are not flat. You rarely land your foothold on the machine that holds the prize — you land on some reachable box, and the interesting systems sit one hop deeper, invisible from the outside. Pivoting is how you turn one compromised host into a path to the rest of the network, and SSH tunneling is the most universally available way to do it because sshd is already everywhere. Learning to pivot cleanly (and to recognize the outbound-SSH pattern that gives it away) is a core pentest and red-team skill, and the same knowledge tells a defender exactly what to watch for.
What you'll learn
- Network pivoting
- SSH local/remote/dynamic port forwarding
- SOCKS proxying with proxychains
- ProxyJump
- Reasoning about egress paths and detection
Steps in this lab
- The one rule before anything else
- Build the range: a network only the jump host can see into
- Start the internal target — deliberately unreachable
- Prove you cannot reach the target directly
- Start the jump host — the one door you can open
- Confirm you can log into the jump host
- Pivot #1 — local port forwarding (-L): reach one service
- Pivot #2 — remote port forwarding (-R) and when you'd need it
- Pivot #3 — dynamic forwarding (-D): one tunnel, the whole subnet
- Point proxychains at the SOCKS proxy
- Tunnel arbitrary tools: curl and nmap through proxychains
- Pivot #4 — ProxyJump (-J): the modern one-liner
- When SSH pivoting is NOT the answer
- The defender's view — how this gets caught
- Tear down the range