ligolo-ng

Ligolo-ng is a simple, lightweight, and fast tool designed for pentesters to create tunnels using a TUN interface over reverse TCP or TLS connections. It eliminates the need for SOCKS proxies, making it efficient for network pivoting during penetration tests.

The tool consists of two main binaries: ligolo-agent and ligolo-proxy. The agent runs on the target to establish connections, while the proxy manages the tunnel on the attacker's side. This setup allows for seamless network access and traffic forwarding in compromised environments.

It supports TLS for secure connections and features like certificate fingerprint validation and autocert for Let's Encrypt, enhancing its usability in real-world scenarios.

Ligolo-ng operates by deploying a ligolo-agent on the target system, which binds to an IP:port or connects to a proxy, establishing a reverse TCP/TLS connection. The ligolo-proxy on the attacker's machine listens and manages the tunnel via a TUN interface, enabling direct IP routing and pivoting without SOCKS. It supports TLS certificate handling, domain restrictions, and API access for control.