HTTP/HTTPS:
Lateral Movement
Pivot from web servers to internal nets via proxies and tunneling
Pivoting from Web Server to Internal Network
Exploit a compromised web server as a pivot point to enumerate and attack internal network segments using tunneling, proxychains, and port forwarding techniques.
Web lateral movement focuses on pivoting from a compromised web application into the internal network. A web shell or SSRF vulnerability is often your first foothold, and these pages cover how to turn that limited access into broader reach across the environment.
SSRF is one of the most powerful pivot tools in web engagements, letting you hit internal services like cloud metadata APIs, databases, and admin interfaces that are firewalled from the outside. Reverse tunnels with chisel or ligolo-ng, SOCKS proxies through compromised servers, and abusing trust relationships between microservices all expand your access from a single web entry point.
You will also find techniques for leveraging database connections from web apps to reach backend servers, exploiting internal API endpoints discovered through config files, and chaining web vulnerabilities across multiple applications in the same environment.