Port for Port Forwarding on Cheat Sheet about chvancooten.github.io HOT 1 CLOSED

Hi @digitalohm! Glad to hear you're liking the cheat sheet, and love the fact you're using git to submit a question on it. Didn't even realize this is one of the advantages of hosting my blog via Git :)

To answer your question, yes, that is correct! Chisel uses port 1080 for socks proxies by default (and it is a common proxy port in general). As per the Chisel readme:

When the chisel server has --socks5 enabled, remotes can
specify "socks" in place of remote-host and remote-port.
The default local host and port for a "socks" remote is
127.0.0.1:1080. Connections to this remote will terminate
at the server's internal SOCKS5 proxy.

We are using both the --reverse and --socks5 options, so the below also goes:

When the chisel server has --reverse enabled, remotes can
be prefixed with R to denote that they are reversed. That
is, the server will listen and accept connections, and they
will be proxied through the client which specified the remote.
Reverse remotes specifying "R:socks" will listen on the server's
default socks port (1080) and terminate the connection at the
client's internal SOCKS5 proxy.

In short, we are setting up a reverse socks proxy using the default port (1080). This basically means that we opened up port 1080 on our Chisel server (our attacking machine) which will proxy traffic through the tunnel and out from the perspective of the Chisel client (our target system).

Hope this clarifies things!

from chvancooten.github.io.