Netsh is a built-in Windows tool that enables TCP port forwarding through interface portproxy, allowing a compromised host to relay traffic between networks without extra binaries. With administrator access, it provides a stealthy, persistent, zero-footprint pivoting method for lateral movement.

Rpivot is a Python 2 reverse SOCKS4 proxy for pivoting when only outbound HTTP is allowed. The target connects back to the attacker, enabling dynamic network access via proxychains. Its key strength is bypassing NTLM-authenticated proxies.

This article explains how Socat enables network pivoting through TCP/UDP forwarding and interactive TTY reverse shells. It highlights its simplicity, quick deployment without installation, and common presence on Linux systems. Despite lacking advanced tunneling features, Socat remains effective for port forwarding, shell upgrades, and multi-hop relays in targeted penetration testing scenarios.

Chisel is a lightweight tunneling tool that wraps TCP/UDP traffic in HTTP, enabling stealthy communication over ports 80/443. It uses a simple client/server model with no SSH required. Ideal for restricted environments, it supports reverse tunnels and SOCKS5 proxies for pivoting and accessing internal networks.

SSH pivoting allows an attacker to move laterally, access segmented networks, and expose internal services using nothing more than native SSH features. By understanding traffic flow and the differences between local (-L), remote (-R), and dynamic (-D) port forwarding, SSH becomes a precise and reliable pivoting mechanism without deploying additional tools or agents.