← Back to Academy

Academy Node

SSH Local Port Forward

SSH local port forwarding maps a local Kali port to a remote/internal service through an SSH-accessible host.

Intermediate100 XPPivoting

Why it matters

PEN-200 covers SSH local port forwarding as a core port redirection technique for reaching otherwise inaccessible services.

How to identify it

  • You can SSH to a pivot host
  • Internal target is reachable from pivot

Linux commands

ssh -N -L 127.0.0.1:LOCAL_PORT:INTERNAL_IP:INTERNAL_PORT USER@TARGET
curl http://127.0.0.1:LOCAL_PORT
nmap -sT -Pn -p LOCAL_PORT 127.0.0.1

Expected output

  • Local port connects to internal service

Success looks like

  • You can browse or scan internal service from Kali

Failure looks like

  • Connection refused
  • Channel open failed

Troubleshooting

  • Test from pivot first
  • Check firewall
  • Use -v for SSH debug

Common mistakes

  • Confusing local and remote forward
  • Using wrong internal IP

Alternative attacks

  • SSH dynamic SOCKS
  • Chisel
  • sshuttle

What to try next

  • Enumerate forwarded service
  • Try web/SMB/MSSQL through tunnel

Recommended next lessons

ASREP Roast

ASREP roasting abuses AD users with Kerberos pre-authentication disabled. You can request encrypted ASREP material and attempt to crack it offline.

Kerberoast

Kerberoasting targets domain users with SPNs. You request service tickets and crack them offline.

GenericWrite

GenericWrite means you can modify certain attributes on the target AD object.

GenericAll

GenericAll is effectively full control over the target AD object.