A Detailed Guide on Local Port Forwarding

This guide demonstrates multiple port forwarding and pivoting techniques used by penetration testers to reach a localhost‑bound Apache2 service (127.0.0.1:8080) on a compromised host. It explains SSH local forwarding, Ligolo‑ng/Ligolo‑MP, Chisel, Metasploit Meterpreter portfwd, and socat, and outlines mitigations to detect and prevent these post‑exploitation methods. #Apache2 #LigoloNg #Chisel #Metasploit #socat #LigoloMP

Keypoints

An Apache2 server is bound to 127.0.0.1:8080 to simulate an internally isolated service.
SSH local port forwarding forwards a remote localhost service to the attacker’s local port over an encrypted SSH session.
Ligolo‑ng and Ligolo‑MP create virtual TUN interfaces for Layer‑3 routing and advanced network pivoting through compromised hosts.
Chisel uses HTTP/WebSocket for reverse port forwarding and socat creates native TCP relays to expose internal services.
Metasploit’s portfwd leverages existing Meterpreter channels without extra binaries, and mitigations include disabling TCP forwarding, monitoring TUN interfaces, and alerting on unexpected listeners.