I'm currently looking into pivoting when performing network penetration tests, but I'm having issues with reconnaissance.

Given the scenario I have full control over a server, which is publicly available and connected to an internal, non-routable, network. I want to extend my test to the internal network.

I start an SSH server on the server between the networks and connect to it from my attacking machine, creating a local socks proxy. Then I use proxychains to tunnel the traffic of my tools, like nmap.

Usually I start off with doing an nmap ping scan, to get a rough idea of the network, but from what I've learned ICMP packets are not supported by proxychains.

In the illustration below, the green circle represents the publicly accessible network and the the blue cloud represents the internal network.

I can ping any public machine, to get a rough idea of the network (green arrows), but I can't ping the internal network through the proxychains/ssh tunnel (pink arrow).

A first idea, was to use the arp table on the server connected to both networks, but that doesn't hold much information.

How do I gather information about the internal network?

Mockup of the situation

  • It sounds like you are running nmap on your machine and tunnelling the requests - why aren't you running it on that machine you can connect to, and just sending the output back to yourself? – Rory Alsop Nov 24 '16 at 12:59
  • That's an fair point and a somewhat viable solution. For this I have to install nmap on the server, which isn't an optimal solution. I figured there has to be a method to identify hosts on the target network, solely by using the server as a proxy. – SaAtomic Nov 24 '16 at 13:07
  • Okay. You don't need to use icmp then... :-) – Rory Alsop Nov 24 '16 at 13:10
  • From what I can tell proxychains doesn't support ICMP, nor UDP. What other proxying solution could I use? I could - theoretically speaking - install a VPN server on the target and use the VPN, but that's as an even less attractive solution than performing the scans on the server. – SaAtomic Nov 24 '16 at 13:19

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.