Network Pivoting & Tunneling

One foothold is never the goal. The box you popped matters for what it can reach — the flat internal subnet, the database VLAN, the domain controller you have no route to from outside. Pivoting borrows that compromised host's network position and projects your tools through it. The toolkit you actually use on engagements: SSH's three forwards and proxychains, chisel reverse tunnels through egress-only firewalls, and ligolo-ng's tun interface that makes a whole subnet feel local.