Chisel
TCP and UDP tunnel over HTTP secured with SSH, shipped as a single Go executable.
Technical Architecture & Overview
Chisel tunnels TCP and UDP over HTTP transports secured with SSH, in a single executable that is a client or server. It supports SOCKS5 proxying, reverse port forwarding, and multiple tunnel endpoints over one TCP connection, and the server can double as a reverse proxy. Its stated main use is passing through firewalls, and it can also provide a secure endpoint into a network.
Targeted Technical Use Cases
Reliable tunneling over HTTP-only egress paths during authorized testing.
Evaluation & Trade-offs
Core Strengths
- +Single executable for client and server, cross-platform.
- +HTTP transport crosses restrictive egress filters.
- +Server can double as a reverse proxy.
Trade-Offs & Limitations
- -Layer-4 only; layer-3 pivoting needs a TUN-based tool.
- -Threat actors also use it (documented in CISA advisory AA20-259A), so security tools may flag it.
Defensive Security Application
Testing egress filtering by demonstrating what tunneling survives the current controls.
Frequently Asked Questions
What is Chisel?→
Chisel tunnels TCP and UDP over HTTP transports secured with SSH, in a single executable that is a client or server. It supports SOCKS5 proxying, reverse port forwarding, and multiple tunnel endpoints over one TCP connection, and the server can double as a reverse proxy. Its stated main use is passing through firewalls, and it can also provide a secure endpoint into a network.
What is Chisel used for?→
Reliable tunneling over HTTP-only egress paths during authorized testing.
What are the strengths of Chisel?→
- +Single executable for client and server, cross-platform.
- +HTTP transport crosses restrictive egress filters.
- +Server can double as a reverse proxy.
What are the limitations of Chisel?→
- +Layer-4 only; layer-3 pivoting needs a TUN-based tool.
- +Threat actors also use it (documented in CISA advisory AA20-259A), so security tools may flag it.
How is Chisel used defensively?→
Testing egress filtering by demonstrating what tunneling survives the current controls.