# Plink

> Use for tightly scoped SSH-based port forwarding and remote access validation during authorized pentests. Trigger on approved reachability checks, local or remote port-forward review, and proving whether a named pivot path is technically possible.

- Skill: `timsonner/plink` (Agent Skill)
- Install (CLI): `npx skillmds@latest add timsonner/plink`
- Raw SKILL.md: https://api.skillmd.com/api/skills/timsonner/plink/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Coding & Dev Tools
- License: MIT
- Author: timsonner (https://skillmd.com/u/timsonner)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/timsonner/plink

---


# Plink

## Purpose

Use this skill only when the rules of engagement explicitly permit SSH-based forwarding or pivot-path validation across named approved systems.

## Phase Fit

- Primary: Validation and Controlled Impact Demonstration
- Secondary: Retest and Closure

## Use When

- Need to validate local or remote port forwarding through an approved SSH endpoint.
- Need to prove whether a named pivot path is technically reachable.
- Need a repeatable retest after segmentation or SSH hardening.

## Avoid When

- Forwarding or pivot-path testing is not explicitly approved.
- SSH target, path, or port boundaries are unclear.

## Inputs

- Approved SSH target and credentials
- Exact forwarding direction and destination scope
- Stop conditions and monitoring considerations

## Procedure

1. Limit the forward to the minimum ports and hosts needed.
2. Validate only the approved reachability question.
3. Record exact forwarding parameters and host context.
4. Stop once the path is confirmed or disproved.
5. Tear down the forward immediately after validation.

## Command Syntax

Replace sample hosts and ports with approved in-scope values.

```cmd
:: Forward a local port to an internal service
plink.exe -ssh auditor@jump.contoso.com -L 3389:192.168.1.100:3389 -N -batch -pw <password>

:: Reverse port forward (expose local port back to jump host)
plink.exe -ssh auditor@10.10.10.1 -R 4444:127.0.0.1:4444 -N -batch -pw <password>

:: Dynamic SOCKS proxy through jump host
plink.exe -ssh auditor@jump.contoso.com -D 1080 -N -batch -pw <password>

:: Execute a remote command
plink.exe -ssh auditor@10.10.10.100 -batch -pw <password> "whoami"

:: Accept host key silently (first connection)
plink.exe -ssh -hostkey <fingerprint> auditor@jump.contoso.com -batch -pw <password>
```

## Evidence to Capture

- Whether the approved forwarding path succeeded
- Exact source, destination, and port scope used
- Minimal proof needed to support remediation

## Safety Boundaries

- Use only with explicit written approval.
- Keep forwarding short-lived, narrowly scoped, and fully documented.