Prerequisites
- SSH access from the pivot/target back to your attack host.
- Your attack host must be reachable on the chosen port.
Core Command
ssh -R <InternalIPofPivotHost>:8080:0.0.0.0:80 user@<ipAddressofTarget> -vN
- Forwards traffic from port
8080on the attack host to port80on the target. -vN– verbose, do not execute remote commands (just create tunnel).
Useful when the target can reach you, but you cannot directly reach internal services behind it.