Preparing your workspace...
Loading latest data

sshuttle is a powerful tool used during network penetration testing to create a transparent proxy over SSH, allowing an attacker to pivot through a compromised host (often referred to as a jump box or pivot box) into internal networks that are not directly accessible. Unlike a full VPN solution or more complex tunneling setups (like socks proxies with proxychains), sshuttle is simple to use and doesn't require any special software on the target — only Python and SSH access are needed. This makes it highly effective for post-exploitation lateral movement in internal environments.
When a penetration tester gains SSH access to a target machine that resides inside a secure network, sshuttle can be used to forward traffic through that machine, effectively routing all outgoing requests from the attacker's system as if they were originating from the target. This is extremely useful for enumerating internal services, performing port scanning, web application testing, and even exfiltrating data when direct access isn’t allowed.
Unlike traditional SSH port forwarding (which only handles specific ports), sshuttle forwards all TCP traffic and even DNS requests for the specified subnets. For example, if the internal network 10.0.0.0/24 is only reachable from a compromised host, a penetration tester can run:
sshuttle -r [email protected] 10.0.0.0/24
This command routes all traffic meant for 10.0.0.0/24 through the SSH tunnel to the 192.168.1.10 host. The attacker's machine can then interact with the internal network as if it were directly connected, enabling enumeration, exploitation, and lateral movement.
The simplicity of this tool makes it ideal for red teamers and penetration testers during pivoting phases of an engagement. However, it's worth noting that sshuttle works best in Linux/macOS environments and may require root privileges locally to configure the routing tables.
Question1.
What command-line tool is used to transparently tunnel TCP traffic over SSH?
Question2.
Which protocol does sshuttle rely on to create the tunnel?
Question3.
What must be installed on the remote/pivot machine for sshuttle to work?
Question4.
Which type of network is typically accessed using sshuttle?
Question5.
What user privilege is needed on the local machine to modify routes?
Question6.
What is the name of the machine used as the tunnel entry point?
Question7.
What type of traffic (TCP/UDP) does sshuttle forward?
Question8.
What common name is given to the technique of using a host to access other networks?
Question9.
Which protocol's requests, besides TCP, can sshuttle also tunnel?
Question10.
What is the Linux command-line switch used to specify the remote SSH user and host in sshuttle?
Question11.
What type of internal enumeration is commonly done after setting up sshuttle?
Question12.
What kind of networks are usually unreachable before tunneling with sshuttle?