6 ms·
If you're looking at going even deeper into SSH tunneling and port redirection, I recently made The Cyber Plumber's Handbook free: https://github.com/opsdisk/th
by opsdisk 5y ago
If you're looking at going even deeper into SSH tunneling and port redirection, I recently made The Cyber Plumber's Handbook free: https://github.com/opsdisk/the_cyber_plumbers_handbook https://github.com/opsdisk/the_cyber_plumbers_handbook
I made it free to the HN community a few years back [1]. There is a paid interactive lab portion (details in the repo) if you are looking for hands-on experience.
Book Overview
This book is packed with practical and real world examples of SSH tunneling and port redirection in multiple realistic scenarios. It walks you through the basics of SSH tunneling (both local and remote port forwards), SOCKS proxies, port redirection, and how to utilize them with other tools like proxychains, nmap, Metasploit, and web browsers.
Advanced topics included SSHing through 4 jump boxes, throwing exploits through SSH tunnels, scanning assets using proxychains and Metasploit's Meterpreter, browsing the Internet through a SOCKS proxy, utilizing proxychains and nmap to scan targets, and leveraging Metasploit's Meterpreter portfwd command.
[1] https://news.ycombinator.com/item?id=19946941 https://news.ycombinator.com/item?id=19946941
- suifbwish 5y agoOne thing I’ve always tried to find is a method of forwarding a local port on server A to a public facing port on server B. Googling this is very difficult. Is that possible with ssh?
- nemosaltat 5y agoI’ve also had this issue for quite sometime and I’ve used a few approaches over the years. My most recent approach has been to connect server A to server B, via WireGuard. Then on Server B I use nginx to reverse proxy the WireGuard IP address of Server A. This works nicely when: 1) you have access to install software server A, but it’s stuck behind a bunch of firewalls. 2) You’re trying to expose HTTP services- it’s possible to “stream” non-HTTP with nginx, but I don’t know enough to recommend that. You might also want to look at Apache Guacamole or Boring Proxy. I’d love other recommendations!
- dzamo_norton 5y agosocat
- thatsecurityguy 5y agoSolid book, thanks for sharing.