Quick answer: Pivoting is using a compromised system in a penetration test as a bridge to reach internal network segments that are not directly reachable. Tunneling is the technique that provides this access: carrying traffic through the compromised machine to internal systems with SSH tunnels, port forwarding and a SOCKS proxy. The goal is to test the real attack surface of the internal network that is invisible from outside. On the defensive side, this shows why network segmentation is critical.

Why is pivoting done?

An internal network is usually layered: a DMZ segment exposed to the outside and internal segments behind it that are not directly reachable. An attacker or an authorized tester can only compromise a system in the DMZ from outside. The truly valuable targets (databases, Active Directory, internal applications) are not directly reachable.

Pivoting comes into play exactly here: the compromised DMZ system is used as a bridge and traffic is routed through it to internal segments. This is one of the core techniques of an attacker's lateral movement from one system to another, and it is needed to test the real resilience of the internal network.

Tunneling techniques

Technique Description
Local port forwarding Bringing an internal service to a local port
Remote port forwarding Opening your own port to the target network
Dynamic (SOCKS) proxy Routing all traffic through the compromised machine
SSH tunnel Internal access over an encrypted tunnel
Multi layer pivot Chaining several systems to go deeper

A SOCKS proxy and an SSH tunnel are the most common methods because they allow carrying all tool traffic through the compromised machine into the internal network. So the tester can scan internal systems invisible from outside as if they were inside the network.

Defense: what makes pivoting harder?

The success of pivoting depends on the internal network being flat. If all systems are on the same network, compromising one system is a door to the whole network. The essence of defense is network segmentation: dividing the network into logical zones and tightly controlling traffic between zones. Microsegmentation takes this further. Monitoring internal traffic also catches unusual system to system connections (a web server suddenly connecting not to the database but to another internal system).

The KAOS and DSET approach

In internal network penetration tests DSET tests reaching internal segments through pivoting from a compromised system in an authorized way and ties to evidence how flat or segmented the network is. Our KAOS security engine evaluates lateral movement and pivoting paths. In our field experience the most common problem is the internal network being flat, where compromising a single system allows spreading to the whole network. Our goal is to show whether segmentation actually works.

Related reading: privilege escalation and lateral movement, network segmentation and microsegmentation, Active Directory attack techniques, Kerberos ticket attacks, zero trust architecture, MITRE ATT&CK framework.

Frequently asked questions

Are pivoting and lateral movement the same? They are closely related but not the same. Lateral movement is the attacker advancing through the network by moving from one system to another. Pivoting is a technical method that enables this movement: using a compromised system as a bridge and traffic router to reach internal systems that are not directly reachable. Pivoting is the network level means of lateral movement.

What stops pivoting? The most effective defense is network segmentation. If the network is divided into logical zones and traffic between zones is tightly controlled, even if a system is compromised the attacker cannot easily jump from there to other segments. In a flat network, compromising a single system is a door to the whole network. Microsegmentation and internal traffic monitoring strengthen the defense.

What is a SOCKS proxy used for in pivoting? A dynamic SOCKS proxy lets the tester route all tool traffic through the compromised machine into the internal network. So internal systems unreachable from outside can be scanned and tested as if they were inside the network. This is one of the most flexible and common methods of pivoting.

Sources

To test your internal network's segmentation and lateral movement resilience, you can talk to our team at Ankara Hacettepe Technopark. Contact DSET.