I'm currently looking into pivoting when performing network penetration tests, but I'm having issues with reconnaissance.
Given the scenario I have full control over a server, which is publicly available and connected to an internal, non-routable, network. I want to extend my test to the internal network.
I start an SSH server on the server between the networks and connect to it from my attacking machine, creating a local socks proxy. Then I use
proxychains to tunnel the traffic of my tools, like
Usually I start off with doing an
nmap ping scan, to get a rough idea of the network, but from what I've learned ICMP packets are not supported by
In the illustration below, the green circle represents the publicly accessible network and the the blue cloud represents the internal network.
I can ping any public machine, to get a rough idea of the network (green arrows), but I can't ping the internal network through the proxychains/ssh tunnel (pink arrow).
A first idea, was to use the
arp table on the server connected to both networks, but that doesn't hold much information.
How do I gather information about the internal network?