# Lateral Movement

> SSH pivoting via keys, agents, credential reuse, and tunneling

- **URL:** https://hackindex.io/services/ssh/lateral-movement
- **Service:** [SSH](https://hackindex.io/services/ssh.md)
- **Tags:** pivoting, movement, network
- **Published:** 2026-01-03
- **Updated:** 2026-03-29

SSH is the primary lateral movement protocol in Linux and Unix environments. Key-based pivoting works when private keys found on a compromised host are accepted by other systems. Check ~/.ssh/ directories for id_rsa, id_ed25519, and any non-standard key files, then test them against hosts listed in known_hosts and SSH configs.

Agent forwarding abuse lets you use a connected user's keys without ever reading them from disk. If someone connects to your compromised host with ssh -A, their agent socket is available to root. ProxyJump (-J) and ProxyCommand chaining create multi-hop paths through environments where direct connectivity between segments does not exist.

Credential reuse is the simplest vector: passwords or keys that work on one host frequently work on others, especially in environments with shared service accounts or configuration management that distributes the same authorized_keys file. Each new host you reach expands both your credential collection and your network visibility for the next hop.

## Guides

- [SSH Agent Hijacking for Lateral Movement](https://hackindex.io/services/ssh/lateral-movement/ssh-agent-hijacking.md)
- [SSH Credential Reuse Validation](https://hackindex.io/services/ssh/lateral-movement/ssh-credential-reuse-validation.md): Validates reused SSH credentials across internal hosts to identify lateral movement paths via password/key reuse in networked environments.
- [SSH Lateral Movement with Harvested Keys](https://hackindex.io/services/ssh/lateral-movement/ssh-lateral-movement-harvested-keys.md): Techniques for moving laterally through networks using harvested SSH private keys, covering key discovery, agent hijacking, and hop chaining.
- [SSH Port Forwarding and Tunneling](https://hackindex.io/services/ssh/lateral-movement/ssh-port-forwarding-tunneling.md)