One of the first tools that we're going to utilize in order for us to be able to tunnel is something simple and already inside of Kali and Ubuntu. It's SSH.
And we're going to be utilizing this one because one, it's probably the easiest one to be able to learn first.
And since it's already default, we're going to be selecting our Ubuntu box as our target to pivot on. So let's hop on over.
Now, I know there's a lot of stuff going on up here, and you may have also noticed that I've installed Wireshark on the BWAP system itself.
And that's because we need to have a visual representation of what's actually going on here.
Now, inside the Kali terminal, what we have, I'm going to zoom in for us, is the command of SSH-F-N-L.
Now, that's a lot, but this is going to basically tell SSH to make a connection, run in the background, and listen on port 8080 to our target.
So what we're doing is saying that the request is going to be brought to us locally on port 8080.
BWAP.test being our target website on port 80, being HTTP.
And then we're going to pivot through learner at 192.168.0.51, the Ubuntu box.
So, all traffic going to and from the BWAP.test site over port 80 is going to pivot through 0.51, our Ubuntu box.
So this is why we've already talked about getting targets infiltrated with reverse shells and starting to go in and understand passwords and user accounts and all the great stuff like that.
Because we can use that information from one system to be able to spread out and start filling out the rest of the network through our pivot attacks.
So when we run this, and now I'm going to start up Wireshark on the Kali system and then go to my Ubuntu system.
And then start up Wireshark on there.
I'm going to go ahead and run this, and you can see that our Ubuntu on the right side, the one right up there, has populated with a bunch of SSH traffic.
And I haven't even typed in the password yet.
I'm going to do that now, and you can see that we're still populating.
And I'm going to show you here that we have traffic going back and forth from the Kali box, which is 53, going to the Ubuntu box 51.
And it's over SSH.
Now this connection is going to be a normal connection, meaning that it's going to be using port 22.
And you can identify this by expanding one of the packets and seeing that we have a source port of port 22.
And the source being point 51, the Ubuntu box, meaning that the connection is coming in to the Ubuntu at SSH port 21.
I just want to make sure we're on the same page and understanding of this, so that way we can keep track of what's going along for those playing at home.
And it's returning back to port 53 over port 41.598, which is kind of irrelevant for us to really worry ourselves with, because the port 8080 is now going to be what we're actually looking at.
Now you may be wondering, where does this come into play at?
Well, again, this is opening up a port 8080 on our Kali box.
So when we go into here on the BWAP site, or excuse me, inside of our Firefox, we can type in 127.0.0.1 port 8080.
Now I'm also going to type a slash BWAP in there, because that's the actual directory for it.
No, that may not work.
But you see that the Ubuntu box above is also populating with a lot of traffic.
Now real quick, I do want to point out that I had to change the BWAP site, BWAP.txt FQDN to the actual IP address 192.168.0.13.
And when I did that, you could see behind the scenes on our actual web browser here, we have the BWAP site pulled up, and it's listed under the actual web address 127.0.0.1.
So we're looking at ourselves for this website on port 8080, is that correct?
Not entirely, because again, we're using the port forwarding and pivoting through the Ubuntu box to represent this website back to us.
So if we go back and look at our traffic here, we can see that an IP exchange or data exchange over port 80 was done between Ubuntu and the actual BWAP.txt site of 0.13.
That is right here. So the Ubuntu box actually made the request itself over to the 0.13 site.
Which means, theoretically, we should be able to go on the actual BWAP.txt system that I already have Wireshark running on, and do a filter to make sure that we did not get 192.168.0.53, which is the Kali box.
So let's hop on over, and I have it right here.
Now I'm going to do a stop real quick, and I'm going to do a filter based on IP.Source="192.168.0.53".
And I don't have anything come up, but I do have 51, and that's the Ubuntu system making the request for BWAP going back and forth between 13 and 51.
Alright, well, do I have a destination of 53?
IP.DST="192.168.0.53". I don't have anything on there either, but I do have destination of 51, which is, again, the Ubuntu system.
So as far as the 0.13 or BWAP.txt site is concerned, guess what? It never saw the Kali box make a connection, and we've successfully pivoted from Kali to Ubuntu to the BWAP.txt site using the SSH tunneling method.
Now this is a one-for-one mapping, and I bring this up because as good as this tunneling method is, we can only do this one port at a time.
Now that doesn't necessarily mean that we are closing ourselves off to multiple tunneling sessions at the same time.
It just means that port 8080 is now tied up with the BWAP tunneling method through Ubuntu that we've already set.