This one may seem a little trivial. I still want to introduce the tool and get you familiar with
it. It's not going to take long, which is why I kind of brought it down towards the end of the
skill. This is a very case specific tool because you'd have to be in a very unique situation to
have to use something like this. It's not that it's super secret squirrel type stuff. What I
mean is that this tool is called SoCat. We're here on the Kali box and we're inside of a
network that's being pentested. We're actually with the systems physically inside their building.
We need the ability to be able to go out into the world using different ports and
forwarding different IP addresses. We're going to use our Kali box to do so because let's say
our pentesting unit has multiple NICs on it. Just as an example here for a second.
One NIC is plugged into the network that we're pentesting. The other NIC is plugged
into a hotspot that's allowed to go straight to the rest of the internet out in the wild blue
under. We could use SoCat to just do a quick rudimentary port forwarding for us and also
forward it to a different IP address. In this particular case, I do want to show you this
code below and that we are running SoCat and saying TCP listen on port 33, meaning on local
host we're going to listen to port 33 and then we're going to fork it over to 192.168.0.5122.
Now the reason on this Kali system is that I have it going to 51 over to the Ubuntu box
is to demonstrate the example of a port coming in and going to a completely different system.
Now we can test this out by going into shell and typing in ssh learner at 0.53. Now 53 is
our Kali address but we need to remember that we're going to be forwarding port 33
because I'm invoking port 33 on our ssh command and since we know it's going to the Ubuntu system
the user there is learner. So when I go ahead and press enter on this, it's going to say
connection refused. Let me reset that. I was practicing beforehand. One second. All right,
sorry about that. Now I'm going to go ahead and hit enter and as you can see there, it's asking
me about the password for learner at right. So let me go ahead and type in password which is
all lowercase. You can see here that we've gotten into the Ubuntu box at the 53 address.
Go ahead and type in password there and you can see that we are in the actual system. Oh,
apparently I already typed it in once already. My bad. But we're actually in that Ubuntu system
using that port forwarding. I would challenge you on the side to be able to go into your
Wireshark and be able to verify this kind of thing. But this proves that you can take a port,
have it come to us and be routed out not only to a different port number,
but to a new IP address. Because as we saw here, the SSH was coming in on port 33
and it's going out to another IP address along with a different port number. Now say a tool like
this is kind of case specific because you can also use this as a way to route somebody if they're
using you as a proxy. And port forwarding is not only a tool for us to be able to evade firewalls,
it's also a way for us to be able to wreak havoc. I mean send certain pieces of traffic where we
want them to go to while we're pin testing. So let's say for instance that we have a client
that we're wanting to be able to run Burp Suite against, but we don't want to set the entirety of
the actual proxy on their system. Well we know that both websites that are not SSL or TLS are
going to go to port 80. Those that are are going to go to 443. So if we're doing a man-in-the-middle
attack or let's say we have a piece of the network segment between them and the network, we could
very well put in on one NIC where we want to forward the port of 80 or 443, maybe both, and
send it over to our system without having to set proxy on theirs. So these are all different things
that we may see later on in more detail, but this is definitely something you can do and set up
miniature routing tables for us to be able to capture traffic as well also. So just something
to think about as we go through and start to wrap up the skill.