Tunneling

A guide to SSH multiplexing and master control sockets for red team work. Covers running concurrent sessions over a single TCP connection, reducing connection churn, and the risks of socket hijacking.

A working overview of SharpSocks, Nettitude’s .NET tool for tunneling a SOCKS proxy through an implant inside the target network. Architecture, deployment, how it pairs with PoshC2 and other frameworks, the pivoting patterns operators actually use it for, and how it compares to modern alternatives (Chisel, ligolo-ng, gost) in 2026.

A working operator’s view of firewall and IDS bypass in 2026. Fragmentation and decoy scanning against weak setups, DNS and ICMP tunneling where the channel is still open, SSH SOCKS proxying for quick pivots, Chisel and Ligolo-ng for serious tunneling work, and the realities of domain fronting now that the major CDNs have killed it. Plus what modern next-gen firewall and IDS technology (TLS inspection, JA3/JA4 fingerprinting, ECH) leaves open for the operator and what it doesn’t.

A practical walkthrough of Chisel for tunneling — reverse SOCKS, port forwarding, TLS hardening with a real cert, source-level evasion tweaks, and how it compares to Ligolo-ng.

How Pass-the-Hash actually works against RDP — what makes it normally fail, why Restricted Admin Mode flips that around, the correct xfreerdp syntax, RDP-over-SOCKS tuning, and the Logon Type 3 anomaly that gives the technique away.

A working guide to network tunneling for offensive ops — iptables NAT, every flavor of SSH forwarding (including reverse SOCKS and ProxyJump), Windows netsh portproxy, socat, and the modern compiled tools that have largely replaced everything else (Chisel and Ligolo-ng).

A comprehensive guide to mastering port scanning on both Linux and Windows, covering standard tools like Nmap, stealthy built-in techniques, and modern PowerShell-based enumeration.