Pivoting in Penetration Testing Explained for Beginners

In a real network, the machine you break into first is rarely the one you want. Pivoting means using a machine you already control as a stepping stone to reach networks you cannot reach directly. It is a core skill in network penetration testing, and the idea is simpler than the name suggests. Practice only on lab systems you own or have written permission to test.

Why Pivoting Exists

Companies split their networks into segments: office computers in one, servers in another, databases in a third. Firewalls control what crosses between them. A tester who compromises one machine, such as a web server, may find it can talk to hosts the tester's own computer never can. Using that machine as a relay is pivoting. It also shows a client something real: how far an attacker could get from one weak point.

A Simple Picture

• You (attacker) can reach the jump box only.
• The jump box has two network cards: one facing you, one facing the internal network.
• The internal target can be reached only from the jump box.

To test the internal target, your traffic must travel through the jump box. That is a single pivot. If a second machine sits behind the first, reaching it means a double pivot: two hops.

Local Port Forwarding

The simplest tool is SSH, which administrators use every day. With access to the jump box, this command makes port 8080 on your own machine lead to port 80 on the internal target:

• ssh -L 8080:10.10.10.5:80 user@jump-box

Now a browser pointed at localhost:8080 reaches the internal web server through the jump box. It forwards one specific port to one specific destination.

Dynamic Forwarding and SOCKS

When you want to reach many hosts and ports, forward everything instead:

• ssh -D 1080 user@jump-box

This opens a SOCKS proxy on your machine at port 1080. Tools that support a SOCKS proxy, or a wrapper such as proxychains, can then send their traffic through the jump box to anything it can reach. Scans through a proxy are slower and less reliable than direct ones, so use them for targeted checks.

Other Ways, and Why the Idea Matters More than the Tool

Frameworks such as Metasploit can route traffic through a compromised session, and dedicated tunneling tools exist for cases where SSH is not available. Tools change; the concept does not. If you understand which machine can reach which, and where your traffic enters and leaves, you can work out any of them. Our Metasploit guide shows the framework side.

Build a Safe Three-Machine Lab

• Create two host-only networks in VirtualBox or VMware, for example one for you and the jump box, one for the jump box and the internal target.
• Give the jump box two network adapters, one on each network. Give the attacker and the target one each.
• Check that the attacker cannot ping the target directly, then make it work through the jump box.
• Add a fourth machine on a third network to practice a double pivot.

Our home lab guide covers VM basics and our Nmap guide covers the scanning you will do from each position.

How Defenders Detect and Stop Pivoting

• Segmentation: a database server that cannot be reached from the web server gives a pivot nowhere to go.
• Egress filtering: limiting which outbound connections servers can make.
• Logging and alerts: unexpected SSH sessions from a web server, or a server suddenly talking to hosts it never contacted before, are classic signals; see our threat hunting guide.
• Least privilege: accounts that cannot log in to other machines limit lateral movement. MITRE calls this tactic lateral movement; see what is MITRE ATT&CK.

Where This Fits

Pivoting is a major part of advanced network testing and of EC-Council's CPENT AI exam. Our Network and Active Directory course builds it into supervised lab work, alongside Active Directory attacks.