Proxies and Pivoting Explained: Traffic Redirection for PenTest+

Proxies sit between a client and a destination, relaying traffic on the client's behalf. They appear on Network+ as infrastructure, on Security+ as a control, and on PenTest+ as a technique — and the exams expect you to recognise which role is in play.

Forward and reverse proxies

The distinction that comes up most.

Forward proxy. Sits in front of clients and acts on their behalf. The destination sees the proxy's address, not the client's. Used for content filtering, caching, monitoring outbound traffic and enforcing acceptable use. A corporate secure web gateway is a forward proxy.

Reverse proxy. Sits in front of servers and acts on their behalf. The client sees the proxy, not the server. Used for load balancing, TLS termination, caching and hiding internal architecture. A WAF typically operates as a reverse proxy.

A memory aid: a forward proxy hides the client, a reverse proxy hides the server.

Proxy types

HTTP proxy understands HTTP and can inspect, cache and filter at the application layer. It handles web traffic only.

SOCKS proxy operates at a lower level and relays arbitrary TCP, and with SOCKS5 also UDP. It does not understand the traffic it carries, which makes it flexible and means it cannot filter by content. SOCKS5 adds authentication and IPv6.

Transparent proxy intercepts traffic without client configuration, usually via routing or WCCP. Clients are unaware it exists.

Anonymising proxy chains route through several hops so no single relay knows both source and destination. Tor is the well-known implementation.

The exam point on SOCKS versus HTTP: SOCKS carries any protocol but provides no content inspection; HTTP proxies inspect but only handle web traffic.

Pivoting

The PenTest+ concept. Having compromised a host on a network segment you cannot otherwise reach, you use that host as a relay to reach systems behind it.

The reason it matters is segmentation. A tester who gains a foothold on a workstation in a user VLAN cannot directly address servers in a protected segment — but the workstation can, and traffic relayed through it inherits that access.

Attackers chain proxies for the same reason, plus two others: to obscure the true source of traffic, and to make outbound connections look ordinary. This is why pivoting and proxying are as much a defensive detection topic as an offensive technique.

The related terms: port forwarding relays a single port through a host; dynamic port forwarding creates a SOCKS proxy on the compromised host; lateral movement is the broader activity of moving between systems once inside.

Detecting tunnelled and proxied traffic

What CySA+ asks, and the genuinely useful half of this topic.

Protocol on an unexpected port, or traffic whose behaviour does not match its port. SSH on 443 is a classic.

Long-lived connections with steady low-volume traffic in both directions, which does not resemble ordinary browsing.

Beaconing — regular, periodic connections to the same destination, sometimes with jitter to disguise the interval.

DNS tunnelling indicators — unusually long subdomain labels, high query volume to one domain, TXT record queries at volume.

Internal hosts relaying for other internal hosts, which is rarely legitimate and is the signature of a pivot.

Connections to known Tor nodes, VPN services and anonymising infrastructure, which threat intelligence feeds identify.

A workstation accepting inbound connections from other workstations — workstations should almost never be servers.

Defensive controls

Force outbound web traffic through an authenticated proxy so direct egress is not available. Apply egress filtering — most networks permit far more outbound than they need, and restricting it is one of the highest-value controls against both exfiltration and command and control. Segment so a compromised workstation cannot reach sensitive segments even as a relay. Use TLS inspection where policy and law allow. Monitor east-west traffic, not just north-south, because pivoting is internal by definition.

The authorisation point

Pivoting reaches systems the initial target may not own. If a compromised host has connectivity to a partner network or a third-party service, relaying into it is outside the engagement unless that owner authorised it too. Scope boundaries are defined by ownership, not by reachability — and a client cannot authorise testing of infrastructure they do not control.

What to remember

A forward proxy hides the client, a reverse proxy hides the server. SOCKS relays any TCP traffic without inspecting it; HTTP proxies inspect but handle only web traffic. Pivoting uses a compromised host to reach segments that are otherwise unreachable, which is why segmentation and egress filtering matter. Detection looks for protocol-port mismatches, beaconing, long-lived low-volume sessions and internal hosts relaying for others.

Related reading: SSL accelerators and decryptors · Web application firewalls · SIEM