Chisel Fast TCP TunnelStep-by-step reference: pivot through lab networks with Chisel encrypted tunnels. Lab only.FAQ

What is Chisel?

Chisel is a free, open-source tunneling tool in Go by JPillora. Static binaries on each side build encrypted TCP/UDP tunnels over HTTP, with reverse forwarding and SOCKS modes for pivoting.

Is using Chisel legal?

Chisel itself is legitimate open-source software. Tunneling on networks without explicit written permission is illegal, and pivoting outside a signed scope can void an authorization. Use it only in isolated labs or explicitly scoped engagements.

How do I install Chisel?

Download matching static release binaries for both ends from the GitHub releases page and chmod +x. No dependencies or installation needed.

How do I pivot through a lab host?

Run chisel server with --reverse on the attacker VM, then chisel client with R:socks from the in-scope lab host. Route tools through the SOCKS port, scoped to signed ranges.

What is the difference between Chisel and SSH forwarding?

SSH needs credentials and a server on the target. Chisel needs one static binary, speaks HTTP-friendly egress, multiplexes many ports over one connection, and adds SOCKS plus auth out of the box.

How do I forward one service only?

Use R:localport:127.0.0.1:remoteport from the lab host instead of full SOCKS. Narrow forwards honor least-access scoping.

Why is tunneled scanning slow?

One multiplexed connection carries everything. Reduce concurrency, prefer single forwards, and save bulk scans for direct access.

How do I clean up afterward?

Kill chisel on both ends, verify listening ports closed, and confirm no forwards remain. Document every tunnel's lifetime in the report.

All tools · Sitemap · Games