Pivot
How It Works
⚠️ Authorized Testing Only
This tool interacts with live systems and must only be used for testing that has been explicitly authorized by the asset owner. Unauthorized use of this tool to probe, scan, exploit, or otherwise interact with systems you do not have written permission to test is illegal under computer fraud and abuse laws (CFAA, CMA, and international equivalents). pr0t31n does not condone or recommend any unauthorized use. Always obtain a signed Rules of Engagement (RoE) or Statement of Work (SoW) before beginning any assessment.
Pivot is an asyncio-based network pivoting agent that enables remote scanning servers to reach target networks through a deployed device. It runs as a daemon on a host with access to one or more target network segments and establishes a TLS-encrypted relay channel back to the operator's scanning infrastructure.
The agent is built around three core components: a NetworkManager that manipulates iptables rules and sysctl settings to enable IP forwarding and traffic routing between network interfaces, a SessionManager that tracks active relay sessions and their associated network profiles, and a RelayServer that accepts inbound TLS connections from authorized scanning servers and routes traffic to the appropriate target network. Each network profile defines a target subnet, interface, and routing rules.
On startup, the agent loads its YAML configuration, registers iptables rules for each configured network profile, enables IP forwarding via sysctl, and begins listening for relay connections on its configured port. Graceful shutdown is handled via SIGINT/SIGTERM signal handlers that clean up iptables rules (also registered as an atexit handler for crash safety) and close active sessions before exiting. The agent requires root privileges or Linux capabilities CAP_NET_ADMIN + CAP_NET_RAW to modify routing tables and firewall rules.
Security
Requires root or CAP_NET_ADMIN + CAP_NET_RAW for iptables modification and sysctl configuration. Agent configuration specifies routing rules and access controls. Clean shutdown reverts all system changes.
Features
Configuration
Networking
Operations
Use Cases
Validating Firewall Egress Controls
Pivot enables the tester to route scanning traffic through a device positioned inside the target network. If the pivot agent can relay traffic outbound to the operator's scanning server, it proves that firewall egress controls do not block the communication channel. This test is essential because many organizations assume their firewalls block all unauthorized outbound traffic, but gaps often exist for specific ports, protocols, or VLANs.
Testing Data Exfiltration Controls
By relaying arbitrary traffic through the encrypted TLS channel, Pivot demonstrates whether an attacker could exfiltrate data from the internal network. The relay operates at the network layer, meaning any protocol or data format can be tunneled. This tests the effectiveness of DLP solutions, SSL inspection proxies, and network monitoring tools against encrypted relay channels.
Verifying Network Segmentation
Pivot's multi-profile architecture allows the agent to be configured with routes to multiple network segments simultaneously. By attempting to relay traffic to each segment, the tester can map which segments are reachable from the agent's position and identify where segmentation controls fail to prevent cross-segment communication.
Demonstrating Lateral Movement Capability
Once Pivot is deployed on a compromised host, it transforms that host into a transparent gateway for the operator's scanning tools. The scanning server can reach any host visible from the pivot device, demonstrating the full lateral movement impact of an initial compromise. This is the practical realization of the attacker's 'beachhead' strategy.
Testing Incident Detection and Response
Pivot's relay traffic generates detectable artifacts: new iptables rules, sysctl changes, TLS connections to external servers, and anomalous traffic patterns through the pivot host. Whether the organization's endpoint detection, network monitoring, or SOC operations identify these indicators is a direct measure of their detection and response capabilities.
Remote Internal Penetration Testing
Pivot is the core mechanism for conducting internal penetration tests remotely. A device running the Pivot agent is deployed on the target network (physically or through initial compromise), and the tester's scanning tools connect through it as if they were on-site. This eliminates the need for the tester to be physically present for the duration of the engagement.
CLI Reference
Command Examples
Start Agent
Start the pivot agent daemon.
Third-Party Tool Invocations
Commands and flags used when this tool invokes third-party dependencies during operation.
Invocation Methods
| Method | Usage |
|---|---|
| CLI — Direct |
cd /opt/pr0t31n/Pivot && python3 pivot/agent/main.py [OPTIONS]
Run directly with command-line arguments. |
Integration
Third-Party Dependencies & Credits
| Tool / Library | Developer | Type | Link |
|---|---|---|---|
| cryptography | Python Cryptographic Authority | python | https://github.com/pyca/cryptography |
Metadata
| Name | Pivot |
| Category | Egress & Control |
| Version | 1.0.1 |
| Install Path | /opt/pr0t31n/Pivot |
| Main File | pivot/agent/main.py |
| GitHub | https://github.com/pr0t31n/Pivot.git |