> For the complete documentation index, see [llms.txt](https://abcsup.gitbook.io/oscp-study-notes/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://abcsup.gitbook.io/oscp-study-notes/port-redirection-and-tunneling.md).

# Port Redirection and Tunneling

## SSH Tunneling

### Local Port Forwarding

```
ssh -L <local-port-to-listen>:<remote-host>:<remote-port> remote-host
```

### Remote Port Forwarding

```
ssh -R <remote-port-to-listen>:<local-host>:<local-port> remote-host
```

### Dynamic Port Forwarding

```
ssh -D <local-port-to-listen> <remote-host>
```

This command creates a SOCKS proxy listening at \<local-port>. It is required to configure the browser to point to the SOCKS proxy at \<local-port> to redirect all traffics to \<remote-host>.

## Proxychains

Change proxy value to desired proxy server.

{% code title="/etc/proxychains.conf" %}

```
# add proxy here ...
# meanwile
# defaults set to "tor"
socks4 	127.0.0.1 9050
```

{% endcode %}

#### Usage

```bash
proxychains nmap -Pn -sT -sV -p 445,446 $TARGET_IP
```

#### Metasploit Usage

1. Add route to a destined subnet through a session
2. Run socks4a server to listen traffics from proxychains

```bash
msf > route add 172.16.85.0 255.255.255.0 2
msf > use auxiliary/server/socks4a
```

## References

* <https://chamibuddhika.wordpress.com/2012/03/21/ssh-tunnelling-explained/>