Pivoting and tunneling into non-routable internal networks on an HTB lab (Pro Labs, multi-machine) or authorized environment. Trigger when a compromised machine gives access to a subnet that your attack host cannot reach directly. Covers: ligolo-ng, chisel, proxychains, sshuttle, and SSH port forwarding. Produces a route/proxy into the internal network to relaunch scans and exploits there.
