Network Pivoting Strategy

You have obtained shell access to a machine on an internal network segment that has access to additional subnets not reachable from your attack box.

Plan a systematic pivoting strategy:

**Situational Awareness**
- How do you map the network interfaces and routing table of your pivot host?
- How do you discover live hosts on adjacent network segments from your pivot?
- What information do ARP tables and /etc/hosts reveal?

**Pivot Technique Selection**
- What is SOCKS proxying and when is it better than port forwarding?
- How does SSH dynamic port forwarding work (`-D`) and what tool chains with it for proxychains?
- What is a reverse tunnel and when do you need one vs a bind tunnel?
- How do tools like Ligolo-ng, Chisel, and Metasploit's route differ in capability?

**Multi-Hop Pivoting**
- You are on Host A, which can reach Host B, which can reach Host C. How do you establish a path from your attack box to Host C?
- How do you maintain stable tunnels while working through multiple hops?
- What happens to your pivot if the intermediate host is rebooted or the connection drops?

**Traffic Routing**
- How do you configure proxychains to use your pivot?
- Which tools work well through SOCKS proxies and which do not?
- How do you handle UDP-based tools when tunneling through TCP-only proxies?

**Detection Avoidance**
- What network artifacts does a SOCKS tunnel generate?
- How does traffic routing through a pivot differ from native traffic in terms of detectability?

Output:
- Tool selection guide per scenario
- SSH pivot setup commands
- Ligolo-ng tunnel setup walkthrough
- Proxychains configuration example