[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fLAaYsbPPGizadrlf3xvd6w66BIRXfY_UGEBcTMrgboQ":3},{"id":4,"question":5,"answer":6,"answerHtml":7,"slug":8,"keywords":9,"article":10,"status":34,"aiModel":39,"aiConfidence":39,"updatedAt":52,"createdAt":52,"_status":51},611,"What tools are commonly used for port forwarding on Linux systems?","Common tools include iptables (native), rinetd (simple TCP forwarder), HTran (cross-platform), and EarthWorm (supports both forwarding and proxying). iptables requires enabling IP forwarding and adding DNAT\u002FSNAT rules, while rinetd uses a configuration file. For more details, refer to the [article](\u002Fnews\u002Fpenetration-basics-port-forwarding-and-proxying).","\u003Cp>Common tools include iptables (native), rinetd (simple TCP forwarder), HTran (cross-platform), and EarthWorm (supports both forwarding and proxying). iptables requires enabling IP forwarding and adding DNAT\u002FSNAT rules, while rinetd uses a configuration file. For more details, refer to the [article](\u002Fnews\u002Fpenetration-basics-port-forwarding-and-proxying).\u003C\u002Fp>\u003Cp>\u003Ca href=\"\u002Fnews\u002Fpenetration-basics-port-forwarding-and-proxying\">Read the related One Day Sec article\u003C\u002Fa>\u003C\u002Fp>","what-tools-are-commonly-used-for-port-forwarding-on-linux-systems-1777482876401","iptables, rinetd, HTran, EarthWorm, Linux, port forwarding",{"id":11,"title":12,"slug":13,"description":14,"content":15,"contentHtml":30,"cover":31,"author":32,"views":19,"readingTime":33,"status":34,"publishedAt":35,"seo":36,"tags":41,"qaPairs":42,"meta":48,"updatedAt":49,"createdAt":50,"_status":51},151,"Penetration Basics - Port Forwarding and Proxying","penetration-basics-port-forwarding-and-proxying","Learn port forwarding and proxying techniques for penetration testing, covering forward\u002Freverse connections, Windows\u002FLinux methods, and practical application scenarios.",{"root":16},{"type":17,"format":18,"indent":19,"version":20,"children":21,"direction":29},"root","",0,1,[22],{"type":23,"format":18,"indent":19,"version":20,"children":24,"direction":29},"paragraph",[25],{"mode":26,"text":27,"type":28,"style":18,"detail":19,"format":19,"version":20},"normal","\u003Chtml>\u003Chead>\u003C\u002Fhead>\u003Cbody>\u003Ch2>0x00 Preface\u003C\u002Fh2>\u003Cp>---\u003C\u002Fp>\u003Cp>In penetration testing, port forwarding and proxying are frequently utilized.\u003C\u002Fp>\u003Cp>Port forwarding refers to the act of forwarding a network port from one network node to another.\u003C\u002Fp>\u003Cp>In practical applications, two scenarios need to be considered:\u003C\u002Fp>\u003Cul>\u003Cli>Client->Transit server->Server: The client can connect directly to the transit server. The transit server simply forwards the traffic.\u003C\u002Fli>\u003Cli>Client<-Transit server->Server: The client cannot connect directly to the transit server, but the transit server can connect back to the client.\u003C\u002Fli>\u003C\u002Ful>\u003Cp>If the client needs to scan multiple ports on a server (or multiple ports on multiple servers), configuring forwarding rules one by one is impractical.\u003C\u002Fp>\u003Cp>To improve efficiency, a proxy can be used here, requiring only a single rule configuration.\u003C\u002Fp>\u003Cp>This article will organize and summarize common methods and tools, categorize them, distinguish between direct and reverse connections, differentiate between forwarding and proxying, analyze their connections and differences, and provide application scenarios for reference.\u003C\u002Fp>\u003Ch2>0x01 Introduction\u003C\u002Fh2>\u003Cp>---\u003C\u002Fp>\u003Cp>This article will cover the following:\u003C\u002Fp>\u003Cul>\u003Cli>Methods for Windows systems and Linux systems (Ubuntu and CentOS)\u003C\u002Fli>\u003Cli>Port Forwarding - Forward Connection Method\u003C\u002Fli>\u003Cli>Port Forwarding - Reverse Connection Method\u003C\u002Fli>\u003Cli>Forward Proxy Method\u003C\u002Fli>\u003Cli>Reverse Proxy Method\u003C\u002Fli>\u003Cli>Application Scenarios of the Above Methods\u003C\u002Fli>\u003C\u002Ful>\u003Cp>\u003Cstrong>Note:\u003C\u002Fstrong>\u003C\u002Fp>\u003Cp>Go language supports cross-platform compilation, so this article focuses more on introducing tools implemented in Go language\u003C\u002Fp>\u003Ch2>0x02 Port Forwarding - Forward Connection\u003C\u002Fh2>\u003Cp>---\u003C\u002Fp>\u003Ch3>0. Application Scenarios\u003C\u002Fh3>\u003Ch4>1. Traffic Forwarding Springboard\u003C\u002Fh4>\u003Cp>Used to hide the real server address\u003C\u002Fp>\u003Cp>Port forwarding in CIA Hive Beacon Infrastructure uses Linux iptables\u003C\u002Fp>\u003Cp>As shown in (2) in the figure below\u003C\u002Fp>\u003Cp>\u003Cimg alt=\"Alt text\" src=\"\u002Fuploads\u002Fdocx_image_1770016718592_0_b2b57a0c6c.jpeg\">\u003C\u002Fp>\u003Cp>\u003Cstrong>Note:\u003C\u002Fstrong>\u003C\u002Fp>\u003Cp>For setting up a transit server, you can refer to the previous articles 'CIA Hive Beacon Infrastructure Replication 1 – Using Apache mod_rewrite for HTTP Traffic Distribution' and 'CIA Hive Beacon Infrastructure Replication 2 – Using Apache mod_rewrite for HTTPS Traffic Distribution'.\u003C\u002Fp>\u003Ch4>2. Establish a tunnel\u003C\u002Fh4>\u003Cp>Connect to the specified port of the internal network server\u003C\u002Fp>\u003Cp>The client can connect directly to the transit server\u003C\u002Fp>\u003Ch3>1. Test environment\u003C\u002Fh3>\u003Cp>Client: 192.168.111.136\u003C\u002Fp>\u003Cp>Server: 192.168.111.103\u003C\u002Fp>\u003Cp>Network connection as shown in the figure below\u003C\u002Fp>\u003Cp>\u003Cimg alt=\"Alt text\" src=\"\u002Fuploads\u002Fdocx_image_1770016725556_1_fc665a4f48.jpeg\">\u003C\u002Fp>\u003Cp>Test network connection using nc\u003C\u002Fp>\u003Cp>Server:\u003C\u002Fp>\u003Ctable>\u003Ctbody>\u003Ctr>\u003Ctd>\u003Cp>nc -lvp 4444\u003C\u002Fp>\u003C\u002Ftd>\u003C\u002Ftr>\u003C\u002Ftbody>\u003C\u002Ftable>\u003Cp>Client:\u003C\u002Fp>\u003Ctable>\u003Ctbody>\u003Ctr>\u003Ctd>\u003Cp>nc -vv 192.168.111.103 4444\u003C\u002Fp>\u003C\u002Ftd>\u003C\u002Ftr>\u003C\u002Ftbody>\u003C\u002Ftable>\u003Cp>Client connection successful, as shown in the figure below\u003C\u002Fp>\u003Cp>\u003Cimg alt=\"Alt text\" src=\"\u002Fuploads\u002Fdocx_image_1770016730554_2_3f13bb698f.jpeg\">\u003C\u002Fp>\u003Ch3>2. Port forwarding method on Windows systems\u003C\u002Fh3>\u003Cp>Transit server: 192.168.111.132\u003C\u002Fp>\u003Cp>Network connection as shown in the figure below\u003C\u002Fp>\u003Cp>\u003Cimg alt=\"Alt text\" src=\"\u002Fuploads\u002Fdocx_image_1770016733975_3_5dd39c23c3.jpeg\">\u003C\u002Fp>\u003Ch4>1. Using netsh for port forwarding (requires administrator privileges)\u003C\u002Fh4>\u003Cp>(1) Add forwarding rule\u003C\u002Fp>\u003Ctable>\u003Ctbody>\u003Ctr>\u003Ctd>\u003Cp>netsh interface portproxy add v4tov4 listenaddress=192.168.111.132 listenport=7777 connectaddress=192.168.111.103 connectport=4444\u003C\u002Fp>\u003C\u002Ftd>\u003C\u002Ftr>\u003C\u002Ftbody>\u003C\u002Ftable>\u003Cp>(2) Add firewall inbound rule\u003C\u002Fp>\u003Ctable>\u003Ctbody>\u003Ctr>\u003Ctd>\u003Cp>netsh advfirewall firewall add rule name=\"transit test\" protocol=TCP dir=in localport=7777 action=allow\u003C\u002Fp>\u003C\u002Ftd>\u003C\u002Ftr>\u003C\u002Ftbody>\u003C\u002Ftable>\u003Cp>\u003Cstrong>Note:\u003C\u002Fstrong>\u003C\u002Fp>\u003Cp>Default configuration allows outbound and blocks inbound communication, so only inbound rules need to be added here\u003C\u002Fp>\u003Cp>Test network connection:\u003C\u002Fp>\u003Cp>Server:\u003C\u002Fp>\u003Ctable>\u003Ctbody>\u003Ctr>\u003Ctd>\u003Cp>nc -lvp 4444\u003C\u002Fp>\u003C\u002Ftd>\u003C\u002Ftr>\u003C\u002Ftbody>\u003C\u002Ftable>\u003Cp>Client:\u003C\u002Fp>\u003Ctable>\u003Ctbody>\u003Ctr>\u003Ctd>\u003Cp>nc -vv 192.168.111.132 7777\u003C\u002Fp>\u003C\u002Ftd>\u003C\u002Ftr>\u003C\u002Ftbody>\u003C\u002Ftable>\u003Cp>Client connection successful\u003C\u002Fp>\u003Cp>(3) View port forwarding rules\u003C\u002Fp>\u003Ctable>\u003Ctbody>\u003Ctr>\u003Ctd>\u003Cp>netsh interface portproxy show all\u003C\u002Fp>\u003C\u002Ftd>\u003C\u002Ftr>\u003C\u002Ftbody>\u003C\u002Ftable>\u003Cp>(4) Clear port forwarding rules\u003C\u002Fp>\u003Ctable>\u003Ctbody>\u003Ctr>\u003Ctd>\u003Cp>netsh interface portproxy delete v4tov4 listenaddress=192.168.111.132 listenport=7777\u003C\u002Fp>\u003C\u002Ftd>\u003C\u002Ftr>\u003C\u002Ftbody>\u003C\u002Ftable>\u003Cp>(5) Clear firewall rules\u003C\u002Fp>\u003Ctable>\u003Ctbody>\u003Ctr>\u003Ctd>\u003Cp>netsh advfirewall firewall delete rule name=\"transit test\"\u003C\u002Fp>\u003C\u002Ftd>\u003C\u002Ftr>\u003C\u002Ftbody>\u003C\u002Ftable>\u003Ch4>2. Using rinetd to implement port forwarding\u003C\u002Fh4>\u003Cp>Download address:\u003C\u002Fp>\u003Cp>https:\u002F\u002Fboutell.com\u002Frinetd\u002Fhttp\u002Frinetd.zip\u003C\u002Fp>\u003Cp>Only the rinetd.exe from the compressed package is needed\u003C\u002Fp>\u003Cp>(1) Add firewall rule for rinetd.exe (administrator privileges)\u003C\u002Fp>\u003Ctable>\u003Ctbody>\u003Ctr>\u003Ctd>\u003Cp>netsh advfirewall firewall add rule name=\"transit test2\" dir=in program=\"c:\\test\\rinetd.exe\" action=allow\u003C\u002Fp>\u003C\u002Ftd>\u003C\u002Ftr>\u003C\u002Ftbody>\u003C\u002Ftable>\u003Cp>(2) Write forwarding rules\u003C\u002Fp>\u003Ctable>\u003Ctbody>\u003Ctr>\u003Ctd>\u003Cp>echo 0.0.0.0 7777 192.168.111.103 4444 > conf.txt\u003C\u002Fp>\u003C\u002Ftd>\u003C\u002Ftr>\u003C\u002Ftbody>\u003C\u002Ftable>\u003Cp>(3) Start\u003C\u002Fp>\u003Ctable>\u003Ctbody>\u003Ctr>\u003Ctd>\u003Cp>rinetd.exe -c c:\\test\\conf.txt\u003C\u002Fp>\u003C\u002Ftd>\u003C\u002Ftr>\u003C\u002Ftbody>\u003C\u002Ftable>\u003Cp>(4) Clear firewall rules (administrator privileges)\u003C\u002Fp>\u003Ctable>\u003Ctbody>\u003Ctr>\u003Ctd>\u003Cp>netsh advfirewall firewall delete rule name=\"transit test2\" dir=in program=\"c:\\test\\rinetd.exe\"\u003C\u002Fp>\u003C\u002Ftd>\u003C\u002Ftr>\u003C\u002Ftbody>\u003C\u002Ftable>\u003Ch4>3、Implement port forwarding using HTran\u003C\u002Fh4>\u003Cp>\u003Cstrong>Note:\u003C\u002Fstrong>\u003C\u002Fp>\u003Cp>lcx has similar functionality\u003C\u002Fp>\u003Cp>Source code originates from the internet, I have made a backup on GitHub, backup address:\u003C\u002Fp>\u003Cp>https:\u002F\u002Fraw.githubusercontent.某开源项目.cpp\u003C\u002Fp>\u003Cp>(1) Add firewall rules for HTran.exe (administrator privileges)\u003C\u002Fp>\u003Ctable>\u003Ctbody>\u003Ctr>\u003Ctd>\u003Cp>netsh advfirewall firewall add rule name=\"transit test3\" dir=in program=\"c:\\test\\HTran.exe\" action=allow\u003C\u002Fp>\u003C\u002Ftd>\u003C\u002Ftr>\u003C\u002Ftbody>\u003C\u002Ftable>\u003Cp>(2) Enable forwarding function\u003C\u002Fp>\u003Ctable>\u003Ctbody>\u003Ctr>\u003Ctd>\u003Cp>HTran.exe -tran 7777 192.168.111.103 4444\u003C\u002Fp>\u003C\u002Ftd>\u003C\u002Ftr>\u003C\u002Ftbody>\u003C\u002Ftable>\u003Cp>(3) Clear firewall rules (administrator privileges)\u003C\u002Fp>\u003Ctable>\u003Ctbody>\u003Ctr>\u003Ctd>\u003Cp>netsh advfirewall firewall delete rule name=\"transit test3\" dir=in program=\"c:\\test\\HTran.exe\"\u003C\u002Fp>\u003C\u002Ftd>\u003C\u002Ftr>\u003C\u002Ftbody>\u003C\u002Ftable>\u003Ch4>4. Using EarthWorm to achieve port forwarding\u003C\u002Fh4>\u003Cp>Download address:\u003C\u002Fp>\u003Cp>https:\u002F\u002Fgithub.com\u002Frootkiter\u002FEarthWorm\u003C\u002Fp>\u003Cp>(1) Add firewall rule for ew_for_win_32.exe (administrator privileges)\u003C\u002Fp>\u003Ctable>\u003Ctbody>\u003Ctr>\u003Ctd>\u003Cp>netsh advfirewall firewall add rule name=\"transit test4\" dir=in program=\"c:\\test\\ew_for_win_32.exe\" action=allow\u003C\u002Fp>\u003C\u002Ftd>\u003C\u002Ftr>\u003C\u002Ftbody>\u003C\u002Ftable>\u003Cp>(2) Enable forwarding function\u003C\u002Fp>\u003Ctable>\u003Ctbody>\u003Ctr>\u003Ctd>\u003Cp>ew_for_win_32.exe -s lcx_tran -l 7777 -f 192.168.111.103 -g 4444\u003C\u002Fp>\u003C\u002Ftd>\u003C\u002Ftr>\u003C\u002Ftbody>\u003C\u002Ftable>\u003Cp>(3) Clear firewall rules (administrator privileges)\u003C\u002Fp>\u003Ctable>\u003Ctbody>\u003Ctr>\u003Ctd>\u003Cp>netsh advfirewall firewall delete rule name=\"transit test4\" dir=in program=\"c:\\test\\ew_for_win_32.exe\"\u003C\u002Fp>\u003C\u002Ftd>\u003C\u002Ftr>\u003C\u002Ftbody>\u003C\u002Ftable>\u003Ch3>3. Common port forwarding methods in Linux (Ubuntu) systems\u003C\u002Fh3>\u003Cp>Transit server: 192.168.111.102\u003C\u002Fp>\u003Cp>Network connection as shown in the figure below\u003C\u002Fp>\u003Cp>\u003Cimg alt=\"Alt text\" src=\"\u002Fuploads\u002Fdocx_image_1770016737742_4_9a947e3de5.jpeg\">\u003C\u002Fp>\u003Ch4>1. Implementing Port Forwarding with iptables\u003C\u002Fh4>\u003Cp>(1) Enable forwarding functionality\u003C\u002Fp>\u003Ctable>\u003Ctbody>\u003Ctr>\u003Ctd>\u003Cp>echo 1 >\u002Fproc\u002Fsys\u002Fnet\u002Fipv4\u002Fip_forward\u003C\u002Fp>\u003C\u002Ftd>\u003C\u002Ftr>\u003C\u002Ftbody>\u003C\u002Ftable>\u003Cp>\u003Cstrong>Note:\u003C\u002Fstrong>\u003C\u002Fp>\u003Cp>This command takes effect immediately but does not persist after reboot\u003C\u002Fp>\u003Cp>(2) Add forwarding rules\u003C\u002Fp>\u003Ctable>\u003Ctbody>\u003Ctr>\u003Ctd>\u003Cp>iptables -t nat -A PREROUTING -p tcp -d 192.168.111.102 --dport 8888 -j DNAT --to-destination 192.168.111.103:4444\u003Cbr>iptables -t nat -A POSTROUTING -p tcp -d 192.168.111.103 --dport 4444 -j SNAT --to-source 192.168.111.102\u003C\u002Fp>\u003C\u002Ftd>\u003C\u002Ftr>\u003C\u002Ftbody>\u003C\u002Ftable>\u003Cp>(3) View forwarding rules\u003C\u002Fp>\u003Ctable>\u003Ctbody>\u003Ctr>\u003Ctd>\u003Cp>iptables -L -t nat --line-number\u003C\u002Fp>\u003C\u002Ftd>\u003C\u002Ftr>\u003C\u002Ftbody>\u003C\u002Ftable>\u003Cp>As shown in the figure below\u003C\u002Fp>\u003Cp>\u003Cimg alt=\"Alt text\" src=\"\u002Fuploads\u002Fdocx_image_1770016740655_5_65a5b83f08.jpeg\">\u003C\u002Fp>\u003Cp>Test network connectivity:\u003C\u002Fp>\u003Cp>Server:\u003C\u002Fp>\u003Ctable>\u003Ctbody>\u003Ctr>\u003Ctd>\u003Cp>nc -lvp 4444\u003C\u002Fp>\u003C\u002Ftd>\u003C\u002Ftr>\u003C\u002Ftbody>\u003C\u002Ftable>\u003Cp>Client:\u003C\u002Fp>\u003Ctable>\u003Ctbody>\u003Ctr>\u003Ctd>\u003Cp>nc -vv 192.168.111.102 8888\u003C\u002Fp>\u003C\u002Ftd>\u003C\u002Ftr>\u003C\u002Ftbody>\u003C\u002Ftable>\u003Cp>Client connection successful\u003C\u002Fp>\u003Cp>(4) Clear rules\u003C\u002Fp>\u003Ctable>\u003Ctbody>\u003Ctr>\u003Ctd>\u003Cp>iptables -F -t nat\u003C\u002Fp>\u003C\u002Ftd>\u003C\u002Ftr>\u003C\u002Ftbody>\u003C\u002Ftable>\u003Cp>(5) Save rules\u003C\u002Fp>\u003Ctable>\u003Ctbody>\u003Ctr>\u003Ctd>\u003Cp>iptables-save > \u002Fetc\u002Fiptables.up.rules\u003C\u002Fp>\u003C\u002Ftd>\u003C\u002Ftr>\u003C\u002Ftbody>\u003C\u002Ftable>\u003Cp>(6) Restore rules\u003C\u002Fp>\u003Ctable>\u003Ctbody>\u003Ctr>\u003Ctd>\u003Cp>iptables-restore < \u002Fetc\u002Fiptables.up.rules\u003C\u002Fp>\u003C\u002Ftd>\u003C\u002Ftr>\u003C\u002Ftbody>\u003C\u002Ftable>\u003Ch4>2. Using rinetd for port forwarding\u003C\u002Fh4>\u003Cp>(1) Compile and install\u003C\u002Fp>\u003Ctable>\u003Ctbody>\u003Ctr>\u003Ctd>\u003Cp>wget http:\u002F\u002Fwww.boutell.com\u002Frinetd\u002Fhttp\u002Frinetd.tar.gz\u003Cbr>tar zxvf rinetd.tar.gz\u003Cbr>cd rinetd\u003Cbr>make\u003C\u002Fp>\u003C\u002Ftd>\u003C\u002Ftr>\u003C\u002Ftbody>\u003C\u002Ftable>\u003Cp>(2) Write forwarding rules\u003C\u002Fp>\u003Ctable>\u003Ctbody>\u003Ctr>\u003Ctd>\u003Cp>echo 0.0.0.0 8888 192.168.111.103 4444 > \u002Fetc\u002Frinetd.conf\u003C\u002Fp>\u003C\u002Ftd>\u003C\u002Ftr>\u003C\u002Ftbody>\u003C\u002Ftable>\u003Cp>(3) Start\u003C\u002Fp>\u003Ctable>\u003Ctbody>\u003Ctr>\u003Ctd>\u003Cp>.\u002Frinetd.exe\u003C\u002Fp>\u003C\u002Ftd>\u003C\u002Ftr>\u003C\u002Ftbody>\u003C\u002Ftable>\u003Cp>(4) Terminate process\u003C\u002Fp>\u003Ctable>\u003Ctbody>\u003Ctr>\u003Ctd>\u003Cp>pkill -9 rinetd\u003C\u002Fp>\u003C\u002Ftd>\u003C\u002Ftr>\u003C\u002Ftbody>\u003C\u002Ftable>\u003Ch4>3、Using HTran for port forwarding\u003C\u002Fh4>\u003Cp>Source code reference for Linux version HTran(lcx):\u003C\u002Fp>\u003Cp>https:\u002F\u002Fgithub.com\u002Fwindworst\u002FLCX\u003C\u002Fp>\u003Cp>Requires recompilation with gcc\u003C\u002Fp>\u003Cp>(1) Enable forwarding function\u003C\u002Fp>\u003Ctable>\u003Ctbody>\u003Ctr>\u003Ctd>\u003Cp>.\u002Flcx -tran 8888 192.168.111.103 4444\u003C\u002Fp>\u003C\u002Ftd>\u003C\u002Ftr>\u003C\u002Ftbody>\u003C\u002Ftable>\u003Cp>\u003Cstrong>Note:\u003C\u002Fstrong>\u003C\u002Fp>\u003Cp>HTran(lcx) written in Go language, advantage is cross-platform, supporting Windows and Linux\u003C\u002Fp>\u003Cp>Download address:\u003C\u002Fp>\u003Cp>https:\u002F\u002Fgithub.com\u002Fcw1997\u002FNATBypass\u003C\u002Fp>\u003Ch4>4. Using EarthWorm to achieve port forwarding\u003C\u002Fh4>\u003Cp>Download address:\u003C\u002Fp>\u003Cp>https:\u002F\u002Fgithub.com\u002Frootkiter\u002FEarthWorm\u003C\u002Fp>\u003Cp>Not open source\u003C\u002Fp>\u003Cp>(1) Enable forwarding function\u003C\u002Fp>\u003Ctable>\u003Ctbody>\u003Ctr>\u003Ctd>\u003Cp>.\u002Few_for_linux -s lcx_tran -l 8888 -f 192.168.111.103 -g 4444\u003C\u002Fp>\u003C\u002Ftd>\u003C\u002Ftr>\u003C\u002Ftbody>\u003C\u002Ftable>\u003Ch3>4. Common port forwarding methods under Linux system (CentOS)\u003C\u002Fh3>\u003Cp>Transit server: 192.168.111.105\u003C\u002Fp>\u003Cp>Network connection as shown in the figure\u003C\u002Fp>\u003Cp>\u003Cimg alt=\"Alt text\" src=\"\u002Fuploads\u002Fdocx_image_1770016744517_6_11a70c41f5.jpeg\">\u003C\u002Fp>\u003Ch4>1. Using iptables to achieve port forwarding\u003C\u002Fh4>\u003Cp>(1) Enable forwarding function\u003C\u002Fp>\u003Ctable>\u003Ctbody>\u003Ctr>\u003Ctd>\u003Cp>echo 1 >\u002Fproc\u002Fsys\u002Fnet\u002Fipv4\u002Fip_forward\u003C\u002Fp>\u003C\u002Ftd>\u003C\u002Ftr>\u003C\u002Ftbody>\u003C\u002Ftable>\u003Cp>\u003Cstrong>Note:\u003C\u002Fstrong>\u003C\u002Fp>\u003Cp>This command takes effect immediately and will be lost after system reboot\u003C\u002Fp>\u003Cp>(2) Install iptables\u003C\u002Fp>\u003Ctable>\u003Ctbody>\u003Ctr>\u003Ctd>\u003Cp>systemctl stop firewalld  \u003Cbr>systemctl mask firewalld  \u003Cbr>yum install iptables-services\u003Cbr>systemctl enable iptables\u003C\u002Fp>\u003C\u002Ftd>\u003C\u002Ftr>\u003C\u002Ftbody>\u003C\u002Ftable>\u003Cp>(3) Add forwarding rules\u003C\u002Fp>\u003Ctable>\u003Ctbody>\u003Ctr>\u003Ctd>\u003Cp>iptables -t nat -A PREROUTING -p tcp -d 192.168.111.105 --dport 8888 -j DNAT --to-destination 192.168.111.103:4444\u003Cbr>iptables -t nat -A POSTROUTING -p tcp -d 192.168.111.103 --dport 4444 -j SNAT --to-source 192.168.111.105\u003Cbr>service iptables save\u003Cbr>service iptables restart\u003Cbr>service iptables status\u003C\u002Fp>\u003C\u002Ftd>\u003C\u002Ftr>\u003C\u002Ftbody>\u003C\u002Ftable>\u003Cp>(4) View forwarding rules\u003C\u002Fp>\u003Ctable>\u003Ctbody>\u003Ctr>\u003Ctd>\u003Cp>iptables -L -t nat --line-number\u003C\u002Fp>\u003C\u002Ftd>\u003C\u002Ftr>\u003C\u002Ftbody>\u003C\u002Ftable>\u003Cp>As shown in the figure below\u003C\u002Fp>\u003Cp>\u003Cimg alt=\"Alt text\" src=\"\u002Fuploads\u002Fdocx_image_1770016747038_7_837db878fa.jpeg\">\u003C\u002Fp>\u003Cp>Test network connection:\u003C\u002Fp>\u003Cp>Server:\u003C\u002Fp>\u003Ctable>\u003Ctbody>\u003Ctr>\u003Ctd>\u003Cp>nc -lvp 4444\u003C\u002Fp>\u003C\u002Ftd>\u003C\u002Ftr>\u003C\u002Ftbody>\u003C\u002Ftable>\u003Cp>Client:\u003C\u002Fp>\u003Ctable>\u003Ctbody>\u003Ctr>\u003Ctd>\u003Cp>nc -vv 192.168.111.105 8888\u003C\u002Fp>\u003C\u002Ftd>\u003C\u002Ftr>\u003C\u002Ftbody>\u003C\u002Ftable>\u003Cp>Client connection successful\u003C\u002Fp>\u003Cp>(4) Clear rules\u003C\u002Fp>\u003Ctable>\u003Ctbody>\u003Ctr>\u003Ctd>\u003Cp>iptables -F -t nat\u003C\u002Fp>\u003C\u002Ftd>\u003C\u002Ftr>\u003C\u002Ftbody>\u003C\u002Ftable>\u003Ch4>2. Use rinetd to implement port forwarding\u003C\u002Fh4>\u003Cp>Same as Ubuntu, omitted here\u003C\u002Fp>\u003Ch4>3. Use HTran to implement port forwarding\u003C\u002Fh4>\u003Cp>Same as Ubuntu, omitted here\u003C\u002Fp>\u003Ch4>4. Use EarthWorm to implement port forwarding\u003C\u002Fh4>\u003Cp>Same as Ubuntu, omitted here\u003C\u002Fp>\u003Ch2>0x03 Port Forwarding - Reverse Connection\u003C\u002Fh2>\u003Cp>---\u003C\u002Fp>\u003Ch3>0. Application Scenario\u003C\u002Fh3>\u003Ch4>1. Establish a Tunnel\u003C\u002Fh4>\u003Cp>Connect to the specified port of the internal network server\u003C\u002Fp>\u003Cp>Test environment as shown below\u003C\u002Fp>\u003Cp>\u003Cimg alt=\"Alt text\" src=\"\u002Fuploads\u002Fdocx_image_1770016748860_8_a28829b37f.jpeg\">\u003C\u002Fp>\u003Cp>Already have Transit server permissions, want to access Server's port 3389\u003C\u002Fp>\u003Cp>Client cannot connect to Transit server directly, but Transit server can connect to Client in reverse\u003C\u002Fp>\u003Cp>iptables and rinetd are no longer applicable\u003C\u002Fp>\u003Ch4>1. Using HTran\u003C\u002Fh4>\u003Cp>Supports Windows and Linux\u003C\u002Fp>\u003Cp>Client:\u003C\u002Fp>\u003Ctable>\u003Ctbody>\u003Ctr>\u003Ctd>\u003Cp>HTran -listen 1111 2222\u003C\u002Fp>\u003C\u002Ftd>\u003C\u002Ftr>\u003C\u002Ftbody>\u003C\u002Ftable>\u003Cp>Transit server:\u003C\u002Fp>\u003Ctable>\u003Ctbody>\u003Ctr>\u003Ctd>\u003Cp>HTran -slave 1.1.1.1 1111 10.0.0.2 3389\u003C\u002Fp>\u003C\u002Ftd>\u003C\u002Ftr>\u003C\u002Ftbody>\u003C\u002Ftable>\u003Cp>Client:\u003C\u002Fp>\u003Ctable>\u003Ctbody>\u003Ctr>\u003Ctd>\u003Cp>nc -vv 127.0.0.1 2222\u003C\u002Fp>\u003C\u002Ftd>\u003C\u002Ftr>\u003C\u002Ftbody>\u003C\u002Ftable>\u003Ch4>2、Using EarthWorm\u003C\u002Fh4>\u003Cp>Supports Windows and Linux\u003C\u002Fp>\u003Cp>Client:\u003C\u002Fp>\u003Ctable>\u003Ctbody>\u003Ctr>\u003Ctd>\u003Cp>ew -s lcx_listen -l 2222 -e 1111\u003C\u002Fp>\u003C\u002Ftd>\u003C\u002Ftr>\u003C\u002Ftbody>\u003C\u002Ftable>\u003Cp>Transit server:\u003C\u002Fp>\u003Ctable>\u003Ctbody>\u003Ctr>\u003Ctd>\u003Cp>ew -s lcx_slave -d 1.1.1.1 -e 1111 -f 10.0.0.2 -g 3389\u003C\u002Fp>\u003C\u002Ftd>\u003C\u002Ftr>\u003C\u002Ftbody>\u003C\u002Ftable>\u003Cp>Client:\u003C\u002Fp>\u003Ctable>\u003Ctbody>\u003Ctr>\u003Ctd>\u003Cp>nc -vv 127.0.0.1 2222\u003C\u002Fp>\u003C\u002Ftd>\u003C\u002Ftr>\u003C\u002Ftbody>\u003C\u002Ftable>\u003Ch2>0x04 Forward Proxy\u003C\u002Fh2>\u003Cp>---\u003C\u002Fp>\u003Ch3>0、Application Scenario\u003C\u002Fh3>\u003Ch4>1. Internal network scanning\u003C\u002Fh4>\u003Cp>Scanning multiple ports on the internal network\u003C\u002Fp>\u003Cp>Client can forward connect to Transit server\u003C\u002Fp>\u003Cp>The test environment is shown in the figure below\u003C\u002Fp>\u003Cp>\u003Cimg alt=\"Alt text\" src=\"\u002Fuploads\u002Fdocx_image_1770016750147_9_b3fe0e64e0.jpeg\">\u003C\u002Fp>\u003Cp>Scan the ports of Server1, Server2, and Server3\u003C\u002Fp>\u003Cp>Socks4 proxy only supports TCP protocol, while Socks5 proxy supports both TCP and UDP protocols, making it more comprehensive. Therefore, this article only introduces the method of implementing Socks5 proxy.\u003C\u002Fp>\u003Ch4>1. Using HTran\u003C\u002Fh4>\u003Cp>It is rumored online that HTran2.4 supports Socks5 proxy, but I have not found the open-source code. This is noted here.\u003C\u002Fp>\u003Ch4>2. Using EarthWorm\u003C\u002Fh4>\u003Cp>Transit server:\u003C\u002Fp>\u003Ctable>\u003Ctbody>\u003Ctr>\u003Ctd>\u003Cp>ew –s ssocksd –l 8888\u003C\u002Fp>\u003C\u002Ftd>\u003C\u002Ftr>\u003C\u002Ftbody>\u003C\u002Ftable>\u003Cp>Client uses a proxy tool to connect to port 8888 of the Transit server\u003C\u002Fp>\u003Ch4>3. Using goproxy\u003C\u002Fh4>\u003Cp>A high-performance HTTP, HTTPS, WebSocket, TCP, UDP, Socks5, and SS proxy server implemented in Go, supporting forward proxy, reverse proxy, transparent proxy, intranet penetration, TCP\u002FUDP port mapping, and SSH relay.\u003C\u002Fp>\u003Cp>Download address:\u003C\u002Fp>\u003Cp>https:\u002F\u002Fgithub.com\u002Fsnail007\u002Fgoproxy\u002F\u003C\u002Fp>\u003Cp>Transit server:\u003C\u002Fp>\u003Ctable>\u003Ctbody>\u003Ctr>\u003Ctd>\u003Cp>proxy socks -t tcp -p \"0.0.0.0:8888\"\u003C\u002Fp>\u003C\u002Ftd>\u003C\u002Ftr>\u003C\u002Ftbody>\u003C\u002Ftable>\u003Cp>Client connects to Transit server port 8888 using proxy tool\u003C\u002Fp>\u003Ch3>4. Implement using Go yourself\u003C\u002Fh3>\u003Cp>Install Go on Windows system:\u003C\u002Fp>\u003Cp>https:\u002F\u002Fgolang.org\u002Fdl\u002F\u003C\u002Fp>\u003Cp>Install git:\u003C\u002Fp>\u003Cp>http:\u002F\u002Fgit-scm.com\u002Fdownloads\u003C\u002Fp>\u003Cp>Install go-socks5:\u003C\u002Fp>\u003Ctable>\u003Ctbody>\u003Ctr>\u003Ctd>\u003Cp>go get github.com\u002Farmon\u002Fgo-socks5\u003Cbr>go build\u003C\u002Fp>\u003C\u002Ftd>\u003C\u002Ftr>\u003C\u002Ftbody>\u003C\u002Ftable>\u003Cp>test.go:\u003C\u002Fp>\u003Ctable>\u003Ctbody>\u003Ctr>\u003Ctd>\u003Cp>package main\u003Cbr>import socks5 \"github.com\u002Farmon\u002Fgo-socks5\"\u003Cbr>func main() {\u003Cbr>        conf := &socks5.Config{}\u003Cbr>        server, err := socks5.New(conf)\u003Cbr>        if err != nil {\u003Cbr>          panic(err)\u003Cbr>        }\u003Cbr>        if err := server.ListenAndServe(\"tcp\", \"0.0.0.0:8888\"); err != nil {\u003Cbr>          panic(err)\u003Cbr>        }\u003Cbr>}\u003C\u002Fp>\u003C\u002Ftd>\u003C\u002Ftr>\u003C\u002Ftbody>\u003C\u002Ftable>\u003Cp>Compile\u003C\u002Fp>\u003Ctable>\u003Ctbody>\u003Ctr>\u003Ctd>\u003Cp>go build test.go\u003C\u002Fp>\u003C\u002Ftd>\u003C\u002Ftr>\u003C\u002Ftbody>\u003C\u002Ftable>\u003Cp>Client connects to Transit server's port 8888 using a proxy tool\u003C\u002Fp>\u003Ch4>5. Use reGeorg\u003C\u002Fh4>\u003Cp>Download address:\u003C\u002Fp>\u003Cp>https:\u002F\u002Fgithub.com\u002FNoneNotNull\u002FreGeorg\u003C\u002Fp>\u003Cp>For web servers, supports (aspx|ashx|jsp|php)\u003C\u002Fp>\u003Cp>\u003Cstrong>Note:\u003C\u002Fstrong>\u003C\u002Fp>\u003Cp>On Windows, tools like sockscap64 can be used to connect to SOCKS proxies\u003C\u002Fp>\u003Cp>On Linux, tools like proxychains can be used to connect to SOCKS proxies\u003C\u002Fp>\u003Ch2>0x05 Reverse Proxy\u003C\u002Fh2>\u003Cp>---\u003C\u002Fp>\u003Ch3>0. Application Scenarios\u003C\u002Fh3>\u003Ch4>1. Internal Network Scanning\u003C\u002Fh4>\u003Cp>Scan multiple ports within the internal network\u003C\u002Fp>\u003Cp>Test environment as shown below\u003C\u002Fp>\u003Cp>\u003Cimg alt=\"Alt text\" src=\"\u002Fuploads\u002Fdocx_image_1770016751501_10_3eac51e620.jpeg\">\u003C\u002Fp>\u003Cp>Client cannot connect directly to Transit server, but Transit server can connect reversely to Client\u003C\u002Fp>\u003Cp>Scan ports on Server1, Server2, and Server3\u003C\u002Fp>\u003Ch4>1. Using EarthWorm\u003C\u002Fh4>\u003Cp>Client:\u003C\u002Fp>\u003Ctable>\u003Ctbody>\u003Ctr>\u003Ctd>\u003Cp>ew -s rcsocks -l 2222 -e 1111\u003C\u002Fp>\u003C\u002Ftd>\u003C\u002Ftr>\u003C\u002Ftbody>\u003C\u002Ftable>\u003Cp>Transit server:\u003C\u002Fp>\u003Ctable>\u003Ctbody>\u003Ctr>\u003Ctd>\u003Cp>ew -s rssocks -d 1.1.1.1 -e 1111\u003C\u002Fp>\u003C\u002Ftd>\u003C\u002Ftr>\u003C\u002Ftbody>\u003C\u002Ftable>\u003Cp>Connect to Client's port 2222 using proxy tools\u003C\u002Fp>\u003Ch4>2. Using rsocks\u003C\u002Fh4>\u003Cp>Download address:\u003C\u002Fp>\u003Cp>https:\u002F\u002Fgithub.com\u002Fbrimstone\u002Frsocks\u003C\u002Fp>\u003Cp>Written in Go, supports Windows and Linux\u003C\u002Fp>\u003Cp>Client:\u003C\u002Fp>\u003Ctable>\u003Ctbody>\u003Ctr>\u003Ctd>\u003Cp>rsocks -listen :1111 -socks 127.0.0.1:2222\u003C\u002Fp>\u003C\u002Ftd>\u003C\u002Ftr>\u003C\u002Ftbody>\u003C\u002Ftable>\u003Cp>Transit server:\u003C\u002Fp>\u003Ctable>\u003Ctbody>\u003Ctr>\u003Ctd>\u003Cp>rsocks -connect 1.1.1.1:1111\u003C\u002Fp>\u003C\u002Ftd>\u003C\u002Ftr>\u003C\u002Ftbody>\u003C\u002Ftable>\u003Cp>Connect to Client's port 2222 using proxy tools\u003C\u002Fp>\u003Ch2>0x06 Summary\u003C\u002Fh2>\u003Cp>---\u003C\u002Fp>\u003Cp>This article organizes and summarizes common tools and methods for port forwarding and proxying, dividing them into two categories: forward and reverse connections. It introduces application scenarios and common tools for each category, serving as a reference for practical applications.\u003C\u002Fp>\u003C\u002Fbody>\u003C\u002Fhtml>","text","ltr","\u003Chtml>\u003Chead>\u003C\u002Fhead>\u003Cbody>\u003Ch2>0x00 Preface\u003C\u002Fh2>\u003Cp>---\u003C\u002Fp>\u003Cp>In penetration testing, port forwarding and proxying are frequently utilized.\u003C\u002Fp>\u003Cp>Port forwarding refers to the act of forwarding a network port from one network node to another.\u003C\u002Fp>\u003Cp>In practical applications, two scenarios need to be considered:\u003C\u002Fp>\u003Cul>\u003Cli>Client->Transit server->Server: The client can connect directly to the transit server. The transit server simply forwards the traffic.\u003C\u002Fli>\u003Cli>Client<-Transit server->Server: The client cannot connect directly to the transit server, but the transit server can connect back to the client.\u003C\u002Fli>\u003C\u002Ful>\u003Cp>If the client needs to scan multiple ports on a server (or multiple ports on multiple servers), configuring forwarding rules one by one is impractical.\u003C\u002Fp>\u003Cp>To improve efficiency, a proxy can be used here, requiring only a single rule configuration.\u003C\u002Fp>\u003Cp>This article will organize and summarize common methods and tools, categorize them, distinguish between direct and reverse connections, differentiate between forwarding and proxying, analyze their connections and differences, and provide application scenarios for reference.\u003C\u002Fp>\u003Ch2>0x01 Introduction\u003C\u002Fh2>\u003Cp>---\u003C\u002Fp>\u003Cp>This article will cover the following:\u003C\u002Fp>\u003Cul>\u003Cli>Methods for Windows systems and Linux systems (Ubuntu and CentOS)\u003C\u002Fli>\u003Cli>Port Forwarding - Forward Connection Method\u003C\u002Fli>\u003Cli>Port Forwarding - Reverse Connection Method\u003C\u002Fli>\u003Cli>Forward Proxy Method\u003C\u002Fli>\u003Cli>Reverse Proxy Method\u003C\u002Fli>\u003Cli>Application Scenarios of the Above Methods\u003C\u002Fli>\u003C\u002Ful>\u003Cp>\u003Cstrong>Note:\u003C\u002Fstrong>\u003C\u002Fp>\u003Cp>Go language supports cross-platform compilation, so this article focuses more on introducing tools implemented in Go language\u003C\u002Fp>\u003Ch2>0x02 Port Forwarding - Forward Connection\u003C\u002Fh2>\u003Cp>---\u003C\u002Fp>\u003Ch3>0. Application Scenarios\u003C\u002Fh3>\u003Ch4>1. Traffic Forwarding Springboard\u003C\u002Fh4>\u003Cp>Used to hide the real server address\u003C\u002Fp>\u003Cp>Port forwarding in CIA Hive Beacon Infrastructure uses Linux iptables\u003C\u002Fp>\u003Cp>As shown in (2) in the figure below\u003C\u002Fp>\u003Cp>\u003Cimg alt=\"Alt text\" src=\"\u002Fapi\u002Fmedia\u002Ffile\u002Fdocx_image_1770016718592_0_b2b57a0c6c-1.jpeg\">\u003C\u002Fp>\u003Cp>\u003Cstrong>Note:\u003C\u002Fstrong>\u003C\u002Fp>\u003Cp>For setting up a transit server, you can refer to the previous articles 'CIA Hive Beacon Infrastructure Replication 1 – Using Apache mod_rewrite for HTTP Traffic Distribution' and 'CIA Hive Beacon Infrastructure Replication 2 – Using Apache mod_rewrite for HTTPS Traffic Distribution'.\u003C\u002Fp>\u003Ch4>2. Establish a tunnel\u003C\u002Fh4>\u003Cp>Connect to the specified port of the internal network server\u003C\u002Fp>\u003Cp>The client can connect directly to the transit server\u003C\u002Fp>\u003Ch3>1. Test environment\u003C\u002Fh3>\u003Cp>Client: 192.168.111.136\u003C\u002Fp>\u003Cp>Server: 192.168.111.103\u003C\u002Fp>\u003Cp>Network connection as shown in the figure below\u003C\u002Fp>\u003Cp>\u003Cimg alt=\"Alt text\" src=\"\u002Fapi\u002Fmedia\u002Ffile\u002Fdocx_image_1770016725556_1_fc665a4f48-1.jpeg\">\u003C\u002Fp>\u003Cp>Test network connection using nc\u003C\u002Fp>\u003Cp>Server:\u003C\u002Fp>\u003Ctable>\u003Ctbody>\u003Ctr>\u003Ctd>\u003Cp>nc -lvp 4444\u003C\u002Fp>\u003C\u002Ftd>\u003C\u002Ftr>\u003C\u002Ftbody>\u003C\u002Ftable>\u003Cp>Client:\u003C\u002Fp>\u003Ctable>\u003Ctbody>\u003Ctr>\u003Ctd>\u003Cp>nc -vv 192.168.111.103 4444\u003C\u002Fp>\u003C\u002Ftd>\u003C\u002Ftr>\u003C\u002Ftbody>\u003C\u002Ftable>\u003Cp>Client connection successful, as shown in the figure below\u003C\u002Fp>\u003Cp>\u003Cimg alt=\"Alt text\" src=\"\u002Fapi\u002Fmedia\u002Ffile\u002Fdocx_image_1770016730554_2_3f13bb698f-1.jpeg\">\u003C\u002Fp>\u003Ch3>2. Port forwarding method on Windows systems\u003C\u002Fh3>\u003Cp>Transit server: 192.168.111.132\u003C\u002Fp>\u003Cp>Network connection as shown in the figure below\u003C\u002Fp>\u003Cp>\u003Cimg alt=\"Alt text\" src=\"\u002Fapi\u002Fmedia\u002Ffile\u002Fdocx_image_1770016733975_3_5dd39c23c3-1.jpeg\">\u003C\u002Fp>\u003Ch4>1. Using netsh for port forwarding (requires administrator privileges)\u003C\u002Fh4>\u003Cp>(1) Add forwarding rule\u003C\u002Fp>\u003Ctable>\u003Ctbody>\u003Ctr>\u003Ctd>\u003Cp>netsh interface portproxy add v4tov4 listenaddress=192.168.111.132 listenport=7777 connectaddress=192.168.111.103 connectport=4444\u003C\u002Fp>\u003C\u002Ftd>\u003C\u002Ftr>\u003C\u002Ftbody>\u003C\u002Ftable>\u003Cp>(2) Add firewall inbound rule\u003C\u002Fp>\u003Ctable>\u003Ctbody>\u003Ctr>\u003Ctd>\u003Cp>netsh advfirewall firewall add rule name=\"transit test\" protocol=TCP dir=in localport=7777 action=allow\u003C\u002Fp>\u003C\u002Ftd>\u003C\u002Ftr>\u003C\u002Ftbody>\u003C\u002Ftable>\u003Cp>\u003Cstrong>Note:\u003C\u002Fstrong>\u003C\u002Fp>\u003Cp>Default configuration allows outbound and blocks inbound communication, so only inbound rules need to be added here\u003C\u002Fp>\u003Cp>Test network connection:\u003C\u002Fp>\u003Cp>Server:\u003C\u002Fp>\u003Ctable>\u003Ctbody>\u003Ctr>\u003Ctd>\u003Cp>nc -lvp 4444\u003C\u002Fp>\u003C\u002Ftd>\u003C\u002Ftr>\u003C\u002Ftbody>\u003C\u002Ftable>\u003Cp>Client:\u003C\u002Fp>\u003Ctable>\u003Ctbody>\u003Ctr>\u003Ctd>\u003Cp>nc -vv 192.168.111.132 7777\u003C\u002Fp>\u003C\u002Ftd>\u003C\u002Ftr>\u003C\u002Ftbody>\u003C\u002Ftable>\u003Cp>Client connection successful\u003C\u002Fp>\u003Cp>(3) View port forwarding rules\u003C\u002Fp>\u003Ctable>\u003Ctbody>\u003Ctr>\u003Ctd>\u003Cp>netsh interface portproxy show all\u003C\u002Fp>\u003C\u002Ftd>\u003C\u002Ftr>\u003C\u002Ftbody>\u003C\u002Ftable>\u003Cp>(4) Clear port forwarding rules\u003C\u002Fp>\u003Ctable>\u003Ctbody>\u003Ctr>\u003Ctd>\u003Cp>netsh interface portproxy delete v4tov4 listenaddress=192.168.111.132 listenport=7777\u003C\u002Fp>\u003C\u002Ftd>\u003C\u002Ftr>\u003C\u002Ftbody>\u003C\u002Ftable>\u003Cp>(5) Clear firewall rules\u003C\u002Fp>\u003Ctable>\u003Ctbody>\u003Ctr>\u003Ctd>\u003Cp>netsh advfirewall firewall delete rule name=\"transit test\"\u003C\u002Fp>\u003C\u002Ftd>\u003C\u002Ftr>\u003C\u002Ftbody>\u003C\u002Ftable>\u003Ch4>2. Using rinetd to implement port forwarding\u003C\u002Fh4>\u003Cp>Download address:\u003C\u002Fp>\u003Cp>https:\u002F\u002Fboutell.com\u002Frinetd\u002Fhttp\u002Frinetd.zip\u003C\u002Fp>\u003Cp>Only the rinetd.exe from the compressed package is needed\u003C\u002Fp>\u003Cp>(1) Add firewall rule for rinetd.exe (administrator privileges)\u003C\u002Fp>\u003Ctable>\u003Ctbody>\u003Ctr>\u003Ctd>\u003Cp>netsh advfirewall firewall add rule name=\"transit test2\" dir=in program=\"c:\\test\\rinetd.exe\" action=allow\u003C\u002Fp>\u003C\u002Ftd>\u003C\u002Ftr>\u003C\u002Ftbody>\u003C\u002Ftable>\u003Cp>(2) Write forwarding rules\u003C\u002Fp>\u003Ctable>\u003Ctbody>\u003Ctr>\u003Ctd>\u003Cp>echo 0.0.0.0 7777 192.168.111.103 4444 > conf.txt\u003C\u002Fp>\u003C\u002Ftd>\u003C\u002Ftr>\u003C\u002Ftbody>\u003C\u002Ftable>\u003Cp>(3) Start\u003C\u002Fp>\u003Ctable>\u003Ctbody>\u003Ctr>\u003Ctd>\u003Cp>rinetd.exe -c c:\\test\\conf.txt\u003C\u002Fp>\u003C\u002Ftd>\u003C\u002Ftr>\u003C\u002Ftbody>\u003C\u002Ftable>\u003Cp>(4) Clear firewall rules (administrator privileges)\u003C\u002Fp>\u003Ctable>\u003Ctbody>\u003Ctr>\u003Ctd>\u003Cp>netsh advfirewall firewall delete rule name=\"transit test2\" dir=in program=\"c:\\test\\rinetd.exe\"\u003C\u002Fp>\u003C\u002Ftd>\u003C\u002Ftr>\u003C\u002Ftbody>\u003C\u002Ftable>\u003Ch4>3、Implement port forwarding using HTran\u003C\u002Fh4>\u003Cp>\u003Cstrong>Note:\u003C\u002Fstrong>\u003C\u002Fp>\u003Cp>lcx has similar functionality\u003C\u002Fp>\u003Cp>Source code originates from the internet, I have made a backup on GitHub, backup address:\u003C\u002Fp>\u003Cp>https:\u002F\u002Fraw.githubusercontent.某开源项目.cpp\u003C\u002Fp>\u003Cp>(1) Add firewall rules for HTran.exe (administrator privileges)\u003C\u002Fp>\u003Ctable>\u003Ctbody>\u003Ctr>\u003Ctd>\u003Cp>netsh advfirewall firewall add rule name=\"transit test3\" dir=in program=\"c:\\test\\HTran.exe\" action=allow\u003C\u002Fp>\u003C\u002Ftd>\u003C\u002Ftr>\u003C\u002Ftbody>\u003C\u002Ftable>\u003Cp>(2) Enable forwarding function\u003C\u002Fp>\u003Ctable>\u003Ctbody>\u003Ctr>\u003Ctd>\u003Cp>HTran.exe -tran 7777 192.168.111.103 4444\u003C\u002Fp>\u003C\u002Ftd>\u003C\u002Ftr>\u003C\u002Ftbody>\u003C\u002Ftable>\u003Cp>(3) Clear firewall rules (administrator privileges)\u003C\u002Fp>\u003Ctable>\u003Ctbody>\u003Ctr>\u003Ctd>\u003Cp>netsh advfirewall firewall delete rule name=\"transit test3\" dir=in program=\"c:\\test\\HTran.exe\"\u003C\u002Fp>\u003C\u002Ftd>\u003C\u002Ftr>\u003C\u002Ftbody>\u003C\u002Ftable>\u003Ch4>4. Using EarthWorm to achieve port forwarding\u003C\u002Fh4>\u003Cp>Download address:\u003C\u002Fp>\u003Cp>https:\u002F\u002Fgithub.com\u002Frootkiter\u002FEarthWorm\u003C\u002Fp>\u003Cp>(1) Add firewall rule for ew_for_win_32.exe (administrator privileges)\u003C\u002Fp>\u003Ctable>\u003Ctbody>\u003Ctr>\u003Ctd>\u003Cp>netsh advfirewall firewall add rule name=\"transit test4\" dir=in program=\"c:\\test\\ew_for_win_32.exe\" action=allow\u003C\u002Fp>\u003C\u002Ftd>\u003C\u002Ftr>\u003C\u002Ftbody>\u003C\u002Ftable>\u003Cp>(2) Enable forwarding function\u003C\u002Fp>\u003Ctable>\u003Ctbody>\u003Ctr>\u003Ctd>\u003Cp>ew_for_win_32.exe -s lcx_tran -l 7777 -f 192.168.111.103 -g 4444\u003C\u002Fp>\u003C\u002Ftd>\u003C\u002Ftr>\u003C\u002Ftbody>\u003C\u002Ftable>\u003Cp>(3) Clear firewall rules (administrator privileges)\u003C\u002Fp>\u003Ctable>\u003Ctbody>\u003Ctr>\u003Ctd>\u003Cp>netsh advfirewall firewall delete rule name=\"transit test4\" dir=in program=\"c:\\test\\ew_for_win_32.exe\"\u003C\u002Fp>\u003C\u002Ftd>\u003C\u002Ftr>\u003C\u002Ftbody>\u003C\u002Ftable>\u003Ch3>3. Common port forwarding methods in Linux (Ubuntu) systems\u003C\u002Fh3>\u003Cp>Transit server: 192.168.111.102\u003C\u002Fp>\u003Cp>Network connection as shown in the figure below\u003C\u002Fp>\u003Cp>\u003Cimg alt=\"Alt text\" src=\"\u002Fapi\u002Fmedia\u002Ffile\u002Fdocx_image_1770016737742_4_9a947e3de5-1.jpeg\">\u003C\u002Fp>\u003Ch4>1. Implementing Port Forwarding with iptables\u003C\u002Fh4>\u003Cp>(1) Enable forwarding functionality\u003C\u002Fp>\u003Ctable>\u003Ctbody>\u003Ctr>\u003Ctd>\u003Cp>echo 1 >\u002Fproc\u002Fsys\u002Fnet\u002Fipv4\u002Fip_forward\u003C\u002Fp>\u003C\u002Ftd>\u003C\u002Ftr>\u003C\u002Ftbody>\u003C\u002Ftable>\u003Cp>\u003Cstrong>Note:\u003C\u002Fstrong>\u003C\u002Fp>\u003Cp>This command takes effect immediately but does not persist after reboot\u003C\u002Fp>\u003Cp>(2) Add forwarding rules\u003C\u002Fp>\u003Ctable>\u003Ctbody>\u003Ctr>\u003Ctd>\u003Cp>iptables -t nat -A PREROUTING -p tcp -d 192.168.111.102 --dport 8888 -j DNAT --to-destination 192.168.111.103:4444\u003Cbr>iptables -t nat -A POSTROUTING -p tcp -d 192.168.111.103 --dport 4444 -j SNAT --to-source 192.168.111.102\u003C\u002Fp>\u003C\u002Ftd>\u003C\u002Ftr>\u003C\u002Ftbody>\u003C\u002Ftable>\u003Cp>(3) View forwarding rules\u003C\u002Fp>\u003Ctable>\u003Ctbody>\u003Ctr>\u003Ctd>\u003Cp>iptables -L -t nat --line-number\u003C\u002Fp>\u003C\u002Ftd>\u003C\u002Ftr>\u003C\u002Ftbody>\u003C\u002Ftable>\u003Cp>As shown in the figure below\u003C\u002Fp>\u003Cp>\u003Cimg alt=\"Alt text\" src=\"\u002Fapi\u002Fmedia\u002Ffile\u002Fdocx_image_1770016740655_5_65a5b83f08-1.jpeg\">\u003C\u002Fp>\u003Cp>Test network connectivity:\u003C\u002Fp>\u003Cp>Server:\u003C\u002Fp>\u003Ctable>\u003Ctbody>\u003Ctr>\u003Ctd>\u003Cp>nc -lvp 4444\u003C\u002Fp>\u003C\u002Ftd>\u003C\u002Ftr>\u003C\u002Ftbody>\u003C\u002Ftable>\u003Cp>Client:\u003C\u002Fp>\u003Ctable>\u003Ctbody>\u003Ctr>\u003Ctd>\u003Cp>nc -vv 192.168.111.102 8888\u003C\u002Fp>\u003C\u002Ftd>\u003C\u002Ftr>\u003C\u002Ftbody>\u003C\u002Ftable>\u003Cp>Client connection successful\u003C\u002Fp>\u003Cp>(4) Clear rules\u003C\u002Fp>\u003Ctable>\u003Ctbody>\u003Ctr>\u003Ctd>\u003Cp>iptables -F -t nat\u003C\u002Fp>\u003C\u002Ftd>\u003C\u002Ftr>\u003C\u002Ftbody>\u003C\u002Ftable>\u003Cp>(5) Save rules\u003C\u002Fp>\u003Ctable>\u003Ctbody>\u003Ctr>\u003Ctd>\u003Cp>iptables-save > \u002Fetc\u002Fiptables.up.rules\u003C\u002Fp>\u003C\u002Ftd>\u003C\u002Ftr>\u003C\u002Ftbody>\u003C\u002Ftable>\u003Cp>(6) Restore rules\u003C\u002Fp>\u003Ctable>\u003Ctbody>\u003Ctr>\u003Ctd>\u003Cp>iptables-restore < \u002Fetc\u002Fiptables.up.rules\u003C\u002Fp>\u003C\u002Ftd>\u003C\u002Ftr>\u003C\u002Ftbody>\u003C\u002Ftable>\u003Ch4>2. Using rinetd for port forwarding\u003C\u002Fh4>\u003Cp>(1) Compile and install\u003C\u002Fp>\u003Ctable>\u003Ctbody>\u003Ctr>\u003Ctd>\u003Cp>wget http:\u002F\u002Fwww.boutell.com\u002Frinetd\u002Fhttp\u002Frinetd.tar.gz\u003Cbr>tar zxvf rinetd.tar.gz\u003Cbr>cd rinetd\u003Cbr>make\u003C\u002Fp>\u003C\u002Ftd>\u003C\u002Ftr>\u003C\u002Ftbody>\u003C\u002Ftable>\u003Cp>(2) Write forwarding rules\u003C\u002Fp>\u003Ctable>\u003Ctbody>\u003Ctr>\u003Ctd>\u003Cp>echo 0.0.0.0 8888 192.168.111.103 4444 > \u002Fetc\u002Frinetd.conf\u003C\u002Fp>\u003C\u002Ftd>\u003C\u002Ftr>\u003C\u002Ftbody>\u003C\u002Ftable>\u003Cp>(3) Start\u003C\u002Fp>\u003Ctable>\u003Ctbody>\u003Ctr>\u003Ctd>\u003Cp>.\u002Frinetd.exe\u003C\u002Fp>\u003C\u002Ftd>\u003C\u002Ftr>\u003C\u002Ftbody>\u003C\u002Ftable>\u003Cp>(4) Terminate process\u003C\u002Fp>\u003Ctable>\u003Ctbody>\u003Ctr>\u003Ctd>\u003Cp>pkill -9 rinetd\u003C\u002Fp>\u003C\u002Ftd>\u003C\u002Ftr>\u003C\u002Ftbody>\u003C\u002Ftable>\u003Ch4>3、Using HTran for port forwarding\u003C\u002Fh4>\u003Cp>Source code reference for Linux version HTran(lcx):\u003C\u002Fp>\u003Cp>https:\u002F\u002Fgithub.com\u002Fwindworst\u002FLCX\u003C\u002Fp>\u003Cp>Requires recompilation with gcc\u003C\u002Fp>\u003Cp>(1) Enable forwarding function\u003C\u002Fp>\u003Ctable>\u003Ctbody>\u003Ctr>\u003Ctd>\u003Cp>.\u002Flcx -tran 8888 192.168.111.103 4444\u003C\u002Fp>\u003C\u002Ftd>\u003C\u002Ftr>\u003C\u002Ftbody>\u003C\u002Ftable>\u003Cp>\u003Cstrong>Note:\u003C\u002Fstrong>\u003C\u002Fp>\u003Cp>HTran(lcx) written in Go language, advantage is cross-platform, supporting Windows and Linux\u003C\u002Fp>\u003Cp>Download address:\u003C\u002Fp>\u003Cp>https:\u002F\u002Fgithub.com\u002Fcw1997\u002FNATBypass\u003C\u002Fp>\u003Ch4>4. Using EarthWorm to achieve port forwarding\u003C\u002Fh4>\u003Cp>Download address:\u003C\u002Fp>\u003Cp>https:\u002F\u002Fgithub.com\u002Frootkiter\u002FEarthWorm\u003C\u002Fp>\u003Cp>Not open source\u003C\u002Fp>\u003Cp>(1) Enable forwarding function\u003C\u002Fp>\u003Ctable>\u003Ctbody>\u003Ctr>\u003Ctd>\u003Cp>.\u002Few_for_linux -s lcx_tran -l 8888 -f 192.168.111.103 -g 4444\u003C\u002Fp>\u003C\u002Ftd>\u003C\u002Ftr>\u003C\u002Ftbody>\u003C\u002Ftable>\u003Ch3>4. Common port forwarding methods under Linux system (CentOS)\u003C\u002Fh3>\u003Cp>Transit server: 192.168.111.105\u003C\u002Fp>\u003Cp>Network connection as shown in the figure\u003C\u002Fp>\u003Cp>\u003Cimg alt=\"Alt text\" src=\"\u002Fapi\u002Fmedia\u002Ffile\u002Fdocx_image_1770016744517_6_11a70c41f5-1.jpeg\">\u003C\u002Fp>\u003Ch4>1. Using iptables to achieve port forwarding\u003C\u002Fh4>\u003Cp>(1) Enable forwarding function\u003C\u002Fp>\u003Ctable>\u003Ctbody>\u003Ctr>\u003Ctd>\u003Cp>echo 1 >\u002Fproc\u002Fsys\u002Fnet\u002Fipv4\u002Fip_forward\u003C\u002Fp>\u003C\u002Ftd>\u003C\u002Ftr>\u003C\u002Ftbody>\u003C\u002Ftable>\u003Cp>\u003Cstrong>Note:\u003C\u002Fstrong>\u003C\u002Fp>\u003Cp>This command takes effect immediately and will be lost after system reboot\u003C\u002Fp>\u003Cp>(2) Install iptables\u003C\u002Fp>\u003Ctable>\u003Ctbody>\u003Ctr>\u003Ctd>\u003Cp>systemctl stop firewalld  \u003Cbr>systemctl mask firewalld  \u003Cbr>yum install iptables-services\u003Cbr>systemctl enable iptables\u003C\u002Fp>\u003C\u002Ftd>\u003C\u002Ftr>\u003C\u002Ftbody>\u003C\u002Ftable>\u003Cp>(3) Add forwarding rules\u003C\u002Fp>\u003Ctable>\u003Ctbody>\u003Ctr>\u003Ctd>\u003Cp>iptables -t nat -A PREROUTING -p tcp -d 192.168.111.105 --dport 8888 -j DNAT --to-destination 192.168.111.103:4444\u003Cbr>iptables -t nat -A POSTROUTING -p tcp -d 192.168.111.103 --dport 4444 -j SNAT --to-source 192.168.111.105\u003Cbr>service iptables save\u003Cbr>service iptables restart\u003Cbr>service iptables status\u003C\u002Fp>\u003C\u002Ftd>\u003C\u002Ftr>\u003C\u002Ftbody>\u003C\u002Ftable>\u003Cp>(4) View forwarding rules\u003C\u002Fp>\u003Ctable>\u003Ctbody>\u003Ctr>\u003Ctd>\u003Cp>iptables -L -t nat --line-number\u003C\u002Fp>\u003C\u002Ftd>\u003C\u002Ftr>\u003C\u002Ftbody>\u003C\u002Ftable>\u003Cp>As shown in the figure below\u003C\u002Fp>\u003Cp>\u003Cimg alt=\"Alt text\" src=\"\u002Fapi\u002Fmedia\u002Ffile\u002Fdocx_image_1770016747038_7_837db878fa-1.jpeg\">\u003C\u002Fp>\u003Cp>Test network connection:\u003C\u002Fp>\u003Cp>Server:\u003C\u002Fp>\u003Ctable>\u003Ctbody>\u003Ctr>\u003Ctd>\u003Cp>nc -lvp 4444\u003C\u002Fp>\u003C\u002Ftd>\u003C\u002Ftr>\u003C\u002Ftbody>\u003C\u002Ftable>\u003Cp>Client:\u003C\u002Fp>\u003Ctable>\u003Ctbody>\u003Ctr>\u003Ctd>\u003Cp>nc -vv 192.168.111.105 8888\u003C\u002Fp>\u003C\u002Ftd>\u003C\u002Ftr>\u003C\u002Ftbody>\u003C\u002Ftable>\u003Cp>Client connection successful\u003C\u002Fp>\u003Cp>(4) Clear rules\u003C\u002Fp>\u003Ctable>\u003Ctbody>\u003Ctr>\u003Ctd>\u003Cp>iptables -F -t nat\u003C\u002Fp>\u003C\u002Ftd>\u003C\u002Ftr>\u003C\u002Ftbody>\u003C\u002Ftable>\u003Ch4>2. Use rinetd to implement port forwarding\u003C\u002Fh4>\u003Cp>Same as Ubuntu, omitted here\u003C\u002Fp>\u003Ch4>3. Use HTran to implement port forwarding\u003C\u002Fh4>\u003Cp>Same as Ubuntu, omitted here\u003C\u002Fp>\u003Ch4>4. Use EarthWorm to implement port forwarding\u003C\u002Fh4>\u003Cp>Same as Ubuntu, omitted here\u003C\u002Fp>\u003Ch2>0x03 Port Forwarding - Reverse Connection\u003C\u002Fh2>\u003Cp>---\u003C\u002Fp>\u003Ch3>0. Application Scenario\u003C\u002Fh3>\u003Ch4>1. Establish a Tunnel\u003C\u002Fh4>\u003Cp>Connect to the specified port of the internal network server\u003C\u002Fp>\u003Cp>Test environment as shown below\u003C\u002Fp>\u003Cp>\u003Cimg alt=\"Alt text\" src=\"\u002Fapi\u002Fmedia\u002Ffile\u002Fdocx_image_1770016748860_8_a28829b37f-1.jpeg\">\u003C\u002Fp>\u003Cp>Already have Transit server permissions, want to access Server's port 3389\u003C\u002Fp>\u003Cp>Client cannot connect to Transit server directly, but Transit server can connect to Client in reverse\u003C\u002Fp>\u003Cp>iptables and rinetd are no longer applicable\u003C\u002Fp>\u003Ch4>1. Using HTran\u003C\u002Fh4>\u003Cp>Supports Windows and Linux\u003C\u002Fp>\u003Cp>Client:\u003C\u002Fp>\u003Ctable>\u003Ctbody>\u003Ctr>\u003Ctd>\u003Cp>HTran -listen 1111 2222\u003C\u002Fp>\u003C\u002Ftd>\u003C\u002Ftr>\u003C\u002Ftbody>\u003C\u002Ftable>\u003Cp>Transit server:\u003C\u002Fp>\u003Ctable>\u003Ctbody>\u003Ctr>\u003Ctd>\u003Cp>HTran -slave 1.1.1.1 1111 10.0.0.2 3389\u003C\u002Fp>\u003C\u002Ftd>\u003C\u002Ftr>\u003C\u002Ftbody>\u003C\u002Ftable>\u003Cp>Client:\u003C\u002Fp>\u003Ctable>\u003Ctbody>\u003Ctr>\u003Ctd>\u003Cp>nc -vv 127.0.0.1 2222\u003C\u002Fp>\u003C\u002Ftd>\u003C\u002Ftr>\u003C\u002Ftbody>\u003C\u002Ftable>\u003Ch4>2、Using EarthWorm\u003C\u002Fh4>\u003Cp>Supports Windows and Linux\u003C\u002Fp>\u003Cp>Client:\u003C\u002Fp>\u003Ctable>\u003Ctbody>\u003Ctr>\u003Ctd>\u003Cp>ew -s lcx_listen -l 2222 -e 1111\u003C\u002Fp>\u003C\u002Ftd>\u003C\u002Ftr>\u003C\u002Ftbody>\u003C\u002Ftable>\u003Cp>Transit server:\u003C\u002Fp>\u003Ctable>\u003Ctbody>\u003Ctr>\u003Ctd>\u003Cp>ew -s lcx_slave -d 1.1.1.1 -e 1111 -f 10.0.0.2 -g 3389\u003C\u002Fp>\u003C\u002Ftd>\u003C\u002Ftr>\u003C\u002Ftbody>\u003C\u002Ftable>\u003Cp>Client:\u003C\u002Fp>\u003Ctable>\u003Ctbody>\u003Ctr>\u003Ctd>\u003Cp>nc -vv 127.0.0.1 2222\u003C\u002Fp>\u003C\u002Ftd>\u003C\u002Ftr>\u003C\u002Ftbody>\u003C\u002Ftable>\u003Ch2>0x04 Forward Proxy\u003C\u002Fh2>\u003Cp>---\u003C\u002Fp>\u003Ch3>0、Application Scenario\u003C\u002Fh3>\u003Ch4>1. Internal network scanning\u003C\u002Fh4>\u003Cp>Scanning multiple ports on the internal network\u003C\u002Fp>\u003Cp>Client can forward connect to Transit server\u003C\u002Fp>\u003Cp>The test environment is shown in the figure below\u003C\u002Fp>\u003Cp>\u003Cimg alt=\"Alt text\" src=\"\u002Fapi\u002Fmedia\u002Ffile\u002Fdocx_image_1770016750147_9_b3fe0e64e0-1.jpeg\">\u003C\u002Fp>\u003Cp>Scan the ports of Server1, Server2, and Server3\u003C\u002Fp>\u003Cp>Socks4 proxy only supports TCP protocol, while Socks5 proxy supports both TCP and UDP protocols, making it more comprehensive. Therefore, this article only introduces the method of implementing Socks5 proxy.\u003C\u002Fp>\u003Ch4>1. Using HTran\u003C\u002Fh4>\u003Cp>It is rumored online that HTran2.4 supports Socks5 proxy, but I have not found the open-source code. This is noted here.\u003C\u002Fp>\u003Ch4>2. Using EarthWorm\u003C\u002Fh4>\u003Cp>Transit server:\u003C\u002Fp>\u003Ctable>\u003Ctbody>\u003Ctr>\u003Ctd>\u003Cp>ew –s ssocksd –l 8888\u003C\u002Fp>\u003C\u002Ftd>\u003C\u002Ftr>\u003C\u002Ftbody>\u003C\u002Ftable>\u003Cp>Client uses a proxy tool to connect to port 8888 of the Transit server\u003C\u002Fp>\u003Ch4>3. Using goproxy\u003C\u002Fh4>\u003Cp>A high-performance HTTP, HTTPS, WebSocket, TCP, UDP, Socks5, and SS proxy server implemented in Go, supporting forward proxy, reverse proxy, transparent proxy, intranet penetration, TCP\u002FUDP port mapping, and SSH relay.\u003C\u002Fp>\u003Cp>Download address:\u003C\u002Fp>\u003Cp>https:\u002F\u002Fgithub.com\u002Fsnail007\u002Fgoproxy\u002F\u003C\u002Fp>\u003Cp>Transit server:\u003C\u002Fp>\u003Ctable>\u003Ctbody>\u003Ctr>\u003Ctd>\u003Cp>proxy socks -t tcp -p \"0.0.0.0:8888\"\u003C\u002Fp>\u003C\u002Ftd>\u003C\u002Ftr>\u003C\u002Ftbody>\u003C\u002Ftable>\u003Cp>Client connects to Transit server port 8888 using proxy tool\u003C\u002Fp>\u003Ch3>4. Implement using Go yourself\u003C\u002Fh3>\u003Cp>Install Go on Windows system:\u003C\u002Fp>\u003Cp>https:\u002F\u002Fgolang.org\u002Fdl\u002F\u003C\u002Fp>\u003Cp>Install git:\u003C\u002Fp>\u003Cp>http:\u002F\u002Fgit-scm.com\u002Fdownloads\u003C\u002Fp>\u003Cp>Install go-socks5:\u003C\u002Fp>\u003Ctable>\u003Ctbody>\u003Ctr>\u003Ctd>\u003Cp>go get github.com\u002Farmon\u002Fgo-socks5\u003Cbr>go build\u003C\u002Fp>\u003C\u002Ftd>\u003C\u002Ftr>\u003C\u002Ftbody>\u003C\u002Ftable>\u003Cp>test.go:\u003C\u002Fp>\u003Ctable>\u003Ctbody>\u003Ctr>\u003Ctd>\u003Cp>package main\u003Cbr>import socks5 \"github.com\u002Farmon\u002Fgo-socks5\"\u003Cbr>func main() {\u003Cbr>        conf := &socks5.Config{}\u003Cbr>        server, err := socks5.New(conf)\u003Cbr>        if err != nil {\u003Cbr>          panic(err)\u003Cbr>        }\u003Cbr>        if err := server.ListenAndServe(\"tcp\", \"0.0.0.0:8888\"); err != nil {\u003Cbr>          panic(err)\u003Cbr>        }\u003Cbr>}\u003C\u002Fp>\u003C\u002Ftd>\u003C\u002Ftr>\u003C\u002Ftbody>\u003C\u002Ftable>\u003Cp>Compile\u003C\u002Fp>\u003Ctable>\u003Ctbody>\u003Ctr>\u003Ctd>\u003Cp>go build test.go\u003C\u002Fp>\u003C\u002Ftd>\u003C\u002Ftr>\u003C\u002Ftbody>\u003C\u002Ftable>\u003Cp>Client connects to Transit server's port 8888 using a proxy tool\u003C\u002Fp>\u003Ch4>5. Use reGeorg\u003C\u002Fh4>\u003Cp>Download address:\u003C\u002Fp>\u003Cp>https:\u002F\u002Fgithub.com\u002FNoneNotNull\u002FreGeorg\u003C\u002Fp>\u003Cp>For web servers, supports (aspx|ashx|jsp|php)\u003C\u002Fp>\u003Cp>\u003Cstrong>Note:\u003C\u002Fstrong>\u003C\u002Fp>\u003Cp>On Windows, tools like sockscap64 can be used to connect to SOCKS proxies\u003C\u002Fp>\u003Cp>On Linux, tools like proxychains can be used to connect to SOCKS proxies\u003C\u002Fp>\u003Ch2>0x05 Reverse Proxy\u003C\u002Fh2>\u003Cp>---\u003C\u002Fp>\u003Ch3>0. Application Scenarios\u003C\u002Fh3>\u003Ch4>1. Internal Network Scanning\u003C\u002Fh4>\u003Cp>Scan multiple ports within the internal network\u003C\u002Fp>\u003Cp>Test environment as shown below\u003C\u002Fp>\u003Cp>\u003Cimg alt=\"Alt text\" src=\"\u002Fapi\u002Fmedia\u002Ffile\u002Fdocx_image_1770016751501_10_3eac51e620-1.jpeg\">\u003C\u002Fp>\u003Cp>Client cannot connect directly to Transit server, but Transit server can connect reversely to Client\u003C\u002Fp>\u003Cp>Scan ports on Server1, Server2, and Server3\u003C\u002Fp>\u003Ch4>1. Using EarthWorm\u003C\u002Fh4>\u003Cp>Client:\u003C\u002Fp>\u003Ctable>\u003Ctbody>\u003Ctr>\u003Ctd>\u003Cp>ew -s rcsocks -l 2222 -e 1111\u003C\u002Fp>\u003C\u002Ftd>\u003C\u002Ftr>\u003C\u002Ftbody>\u003C\u002Ftable>\u003Cp>Transit server:\u003C\u002Fp>\u003Ctable>\u003Ctbody>\u003Ctr>\u003Ctd>\u003Cp>ew -s rssocks -d 1.1.1.1 -e 1111\u003C\u002Fp>\u003C\u002Ftd>\u003C\u002Ftr>\u003C\u002Ftbody>\u003C\u002Ftable>\u003Cp>Connect to Client's port 2222 using proxy tools\u003C\u002Fp>\u003Ch4>2. Using rsocks\u003C\u002Fh4>\u003Cp>Download address:\u003C\u002Fp>\u003Cp>https:\u002F\u002Fgithub.com\u002Fbrimstone\u002Frsocks\u003C\u002Fp>\u003Cp>Written in Go, supports Windows and Linux\u003C\u002Fp>\u003Cp>Client:\u003C\u002Fp>\u003Ctable>\u003Ctbody>\u003Ctr>\u003Ctd>\u003Cp>rsocks -listen :1111 -socks 127.0.0.1:2222\u003C\u002Fp>\u003C\u002Ftd>\u003C\u002Ftr>\u003C\u002Ftbody>\u003C\u002Ftable>\u003Cp>Transit server:\u003C\u002Fp>\u003Ctable>\u003Ctbody>\u003Ctr>\u003Ctd>\u003Cp>rsocks -connect 1.1.1.1:1111\u003C\u002Fp>\u003C\u002Ftd>\u003C\u002Ftr>\u003C\u002Ftbody>\u003C\u002Ftable>\u003Cp>Connect to Client's port 2222 using proxy tools\u003C\u002Fp>\u003Ch2>0x06 Summary\u003C\u002Fh2>\u003Cp>---\u003C\u002Fp>\u003Cp>This article organizes and summarizes common tools and methods for port forwarding and proxying, dividing them into two categories: forward and reverse connections. It introduces application scenarios and common tools for each category, serving as a reference for practical applications.\u003C\u002Fp>\u003C\u002Fbody>\u003C\u002Fhtml>",912,"Onedaysec",7,"published","2026-02-02T07:38:21.455Z",{"title":37,"description":14,"keywords":38,"ogImage":39,"canonicalUrl":39,"noIndex":40},"Port Forwarding & Proxying Basics for Penetration Testing","port forwarding, proxying, penetration testing, network security, traffic forwarding, reverse connection, forward proxy, reverse proxy, Go language tools, Windows Linux methods",null,false,[],{"docs":43,"hasNextPage":40},[44,45,4,46,47],613,612,610,609,{"title":39,"description":39,"image":39},"2026-07-24T15:37:12.384Z","2026-07-23T16:01:50.285Z","draft","2026-07-23T16:13:45.773Z"]