Pivoting, Tunneling & Lateral Movement

CPTS · 30 questions

• A city web foothold can reach hosts on a payroll VLAN that the tester laptop cannot route to. What is the appropriate next judgment?
• A county tester gains a low-privilege shell and wants to reach a different subnet. Why is pivoting the wrong label for simply becoming local Administrator on that same host?
• A municipal RoE lists exact CIDR blocks allowed for lateral movement. The tester’s tunnel can technically reach an unlisted research segment. What should they do?
• A transit engagement needs RDP to an internal workstation that is reachable only from a jump host the tester already controls. Which approach best matches that goal at a concept level?
• A library IT lead asks how local and remote port forwards differ at a high level. What distinction should the tester emphasize?
• A city needs several protocols into an isolated subnet through one foothold, not just a single mapped port. What class of approach is generally more suitable than one-off forwards alone?
• A county firewall permits only HTTPS egress from a foothold. Which tunneling judgment fits that constraint without writing a configuration recipe?
• A municipal SOC notices unexpected reverse connections from a workstation used as a pivot. Beyond stopping the noise, what should the tester ensure for the engagement record?
• A water utility’s OT network sits adjacent to an in-scope IT foothold but is explicitly out of scope. The path is technically reachable. What is the correct action?
• A civic Windows foothold can speak SMB to a file server that the tester’s laptop cannot reach. What conceptual use of the foothold is appropriate?
• A city wants the tester to exercise browser-based admin apps that are only reachable through an internal path after foothold. Which pivoting pattern fits that use-case?
• A county path requires DMZ web → internal app → AD subnet hops. What planning posture should the tester take?
• A transit tester’s overlapping local forwards collide and break their own access mid-assessment. What hygiene lesson applies?
• A library Linux foothold is non-root. The tester still wants a user-level forward. What privilege constraint should they remember conceptually?
• A municipal RoE bans reverse shells but allows SSH-based forwards when valid credentials exist. How should the tester choose a pivot channel?
• A city asks whether ARP spoofing on a production VLAN is an acceptable default pivot method. What is the sound judgment?
• A county foothold drops intermittently. The team wants to race into deep lateral movement immediately. What should come first?
• A civic app tier is compromised; the database tier is segmented. What should the tester assume about DB access?
• A city tester pastes cleartext passwords used for pivots into a shared team chat. What is wrong with that practice?
• A municipal Windows host can open admin shares on peer systems using stolen user credentials. How should that pattern be framed in findings?
• A transit team debates dropping many binaries on a pivot host versus running tools remotely over an established tunnel. What footprint advantage can the tunnel approach offer?
• A county IPv6 path reaches internal hosts that IPv4 filtering blocked. What dual-stack lesson belongs in pivot planning?
• A city jump host requires interactive MFA, which breaks unattended tunnel automation. What planning adjustment is appropriate?
• A library engagement ends today, but tester tunnels and forwards are still active. What closeout action is required?
• A municipal tester discovers a trust route into a partner extranet. What must happen before testing across that trust?
• A water utility SCADA historian is reachable through an approved pivot path but the rules of engagement mark the system as fragile. What is the sound next move?
• A city security lead asks how adding layer-3 routes on a compromised foothold differs from using application-layer tunnels for reachability. What conceptual contrast should the tester emphasize?
• A county blue team requests an IOC-style list of all pivot ports and protocols used during the engagement. What should already be true of the tester's working notes?
• From a civic Kubernetes worker-node foothold, the tester notices pod networks that look flatter than the surrounding datacenter VLANs. What awareness should guide further pivoting?
• A municipal sponsor starts treating 'number of pivots completed' as the engagement success metric instead of risk to crown-jewel systems. How should the tester recenter the work?