Bore

bore

Tiny Rust TCP tunneling tool by Eric Zhang (ekzhang/bore, ~10k LOC). The client opens a control connection to a relay server, registers a remote port, and proxies every accepted TCP connection back to a local service. Default public relay is bore.pub; self-hosting on an owned VPS is a one-line command.

Pure TCP only — no HTTP parsing, no TLS termination, no header rewriting, no auth on visitors. Strengths are simplicity, speed, deterministic ports, and a single static binary.

Scope Guard

• Confirm the exposed service, audience, time window, and authorization before mapping any local port to a public relay.
• Treat bore.pub as untrusted infrastructure: anyone can connect to the assigned remote port. Always layer app-level auth, short runtime, and IP allowlists at the OS firewall.
• Do not expose admin interfaces, databases, MCP/AI tools, shells, or unauthenticated dev services to the internet without owner approval.
• For sensitive engagements, self-host the server on owned infrastructure and enable --secret HMAC auth so only the operator's clients can register tunnels.
• bore does not encrypt application traffic. If confidentiality matters, terminate TLS at the local service or wrap with stunnel/socat openssl/SSH.

When to Pick bore

Install

# From crates.io (recommended for operators)
cargo install bore-cli

# Prebuilt binary (Linux x86_64 example; pick the asset for your platform)
curl -fsSL -o /tmp/bore.tgz \
  https://github.com/ekzhang/bore/releases/latest/download/bore-v0.5.2-x86_64-unknown-linux-musl.tar.gz
tar -xzf /tmp/bore.tgz -C /usr/local/bin bore

# Docker (client or server)
docker run --rm -it --init --net=host ekzhang/bore local 8080 --to bore.pub
docker run -d --restart unless-stopped --name bore-server \
  -p 7835:7835 -p 1024-65535:1024-65535 ekzhang/bore server --secret 'CHANGEME'

Verify: bore --version (should print bore-cli x.y.z).

Quick Starts (Client)

# Expose local 8080 on a random public port at bore.pub
bore local 8080 --to bore.pub
# -> listening at bore.pub:<RANDOM_PORT>

# Request a specific remote port (server must allow it)
bore local 4444 --to bore.pub --port 4444

# Forward a service bound to a non-loopback local address
bore local 80 --to bore.pub --local-host 192.168.1.50 --port 8080

# Use an authenticated self-hosted server
bore local 9001 --to relay.example.com --secret "$BORE_SECRET" --port 9001

# Background runner with auto-restart (systemd-friendly one-liner)
nohup bore local 4444 --to relay.example.com --secret "$BORE_SECRET" --port 4444 >/tmp/bore.log 2>&1 &

The client prints listening at <host>:<port> once the remote port is reserved. Any TCP connection to that endpoint is proxied to local-host:local-port.

Quick Starts (Self-Hosted Server)

# Minimum: open control port 7835 (default), allow tunnel ports 1024-65535
bore server

# Authenticated, narrowed port range, bound only to a private IP
bore server \
  --secret "$(openssl rand -hex 32)" \
  --min-port 20000 --max-port 20100 \
  --bind-addr 10.10.0.5 \
  --bind-tunnels 10.10.0.5

# Behind a firewall: only open 7835/tcp + your chosen tunnel range
ufw allow 7835/tcp
ufw allow 20000:20100/tcp

Bind the control port (7835) only where operators connect from. Bind the tunnel ports (--bind-tunnels) to the interface that should receive visitor traffic — often a public IP, but for internal-only labs use a private one.

CLI Reference

bore local

Environment: BORE_SECRET=... is consumed automatically when -s is omitted — prefer the env var over CLI flags so the secret is not visible in ps.

bore server

Always set --secret on a public server, even for short engagements. Without it the relay is an open redirector that any third party can register tunnels on.

Operator Patterns

Reverse shell callback on a deterministic port

# Operator (own VPS already running `bore server --secret $S`)
bore local 4444 --to relay.example.com --port 4444 --secret "$S" &
nc -lvnp 4444     # or msfconsole multi/handler, sliver, etc.

# Victim payload connects to relay.example.com:4444 and lands on the local listener.

Payload / loader hosting

python3 -m http.server 8000 --bind 127.0.0.1 &
bore local 8000 --to relay.example.com --port 8000 --secret "$S"
# Deliver: http://relay.example.com:8000/loader.exe

Pair with a one-shot file server (python -m RangeHTTPServer, miniserve --auth) and stop bore immediately after the callback.

OAST collector for SSRF / XXE / blind RCE

bore exposes a raw TCP port — perfect for a local interactsh-server, tcpdump, or custom Python listener that needs to record arbitrary inbound bytes:

sudo tcpdump -i lo -A -s0 port 5555 -w /tmp/oast.pcap &
bore local 5555 --to relay.example.com --port 5555 --secret "$S"
# Trigger: payload calls back to relay.example.com:5555

For HTTP-shaped callbacks with a real UI prefer webhook-site or interactsh; use bore when you need raw TCP, custom protocols, or full packet capture.

Inbound reach into a NAT'd lab from a jump host

Run bore server on a reachable jump host; on each isolated lab VM run a long-running bore local to publish RDP/SSH/HTTP for the operator. This avoids opening firewall rules per VM but exposes those ports to anyone who knows the relay + port; gate with --secret and OS-level firewall rules.

Authenticated multi-operator relay

A self-hosted server with a strong --secret plus a narrow --min-port/--max-port range lets a team share one VPS without the bore.pub trust assumptions. Distribute the secret out-of-band and rotate after each engagement.

Hardening Checklist

• Self-host on owned infrastructure for anything sensitive; treat bore.pub as a public test relay only.
• Set --secret on every public server (openssl rand -hex 32). Pass via BORE_SECRET env var, not CLI.
• Restrict tunnel port range with --min-port/--max-port so the server cannot be reused as a generic open proxy.
• Bind control to a private interface or restrict 7835/tcp with iptables/ufw to operator source IPs.
• Add OS-level firewall allowlists for the tunnel port range, scoped to the expected client IPs of the engagement.
• Run the server as an unprivileged user inside a hardened systemd unit; cap port range above 1024 to avoid CAP_NET_BIND_SERVICE.
• Stop tunnels as soon as the test window ends. bore has no built-in idle timeout.
• bore has no built-in transport encryption between client and server — the wire is plaintext TCP. Place the server behind a WireGuard/SSH overlay if you need confidentiality on the control channel itself.

Troubleshooting

Resources