Listen to this Post
Introduction:
In the dynamic world of cybersecurity and penetration testing, the ability to quickly expose a local service to the internet is paramount for demonstrations, webhook testing, and client collaboration. A recent revelation by security researcher Luke Stephens highlights a powerful, often overlooked method to leverage ngrok’s tunneling capabilities directly via SSH, eliminating the need for local installation and streamlining the red team workflow.
Learning Objectives:
- Understand how to use `ssh` as a reverse proxy to expose local services.
- Learn the syntax and functionality of the `-R` remote forwarding flag.
- Discover practical applications for this technique in penetration testing and development.
You Should Know:
1. The Foundation: SSH Remote Forwarding
The core of this technique is the Secure Shell (SSH) protocol’s remote port forwarding feature, specified with the `-R` flag. This command establishes a secure tunnel from the ngrok server’s public port back to your local machine.
`ssh -R 80:localhost:8080 tunnel.us.ngrok.com http`
Step-by-step guide: This command tells the SSH client to request that the remote server (tunnel.us.ngrok.com) forward any traffic it receives on its port 80 to your local machine (localhost) on port 8080. The final `http` argument is the username for the ngrok SSH service. It’s crucial to ensure your local web service (e.g., on port 8080) is running before executing this command. Upon success, the ngrok server will provide you with a public URL (e.g., `https://abc-123.ngrok.io`) that tunnels directly to your local service.
2. Service-Specific Tunneling for Web Applications
Different services require targeting specific local ports. This command is essential for exposing a web application server running on a non-standard port.
`ssh -R 80:localhost:3000 tunnel.us.ngrok.com http</h2>
Step-by-step guide: This is ideal for developers testing a Node.js or Python web app running onlocalhost:3000`. The command creates a public tunnel that maps the ngrok server’s port 80 to your local port 3000. After running the command and receiving the public URL, any visitor to that URL will interact with your locally hosted application as if it were a live website, perfect for client previews or testing third-party integrations.
3. Securing Services with HTTPS Tunnels
Step-by-step guide: This is ideal for developers testing a Node.js or Python web app running on
For services that require encrypted communication, you can leverage ngrok’s built-in TLS termination. This command exposes a local service via HTTPS, automatically handling certificate provisioning.
`ssh -R 443:localhost:8443 tunnel.us.ngrok.com http`
Step-by-step guide: If you are running a local service with TLS enabled (e.g., on port 8443), this command will create a secure public HTTPS endpoint. The ngrok infrastructure manages the SSL certificate for the public `ngrok.io` domain, ensuring all traffic between the end-user and the ngrok server is encrypted. This is critical for testing webhook endpoints that require HTTPS or demonstrating secure applications without deploying them.
4. Advanced TCP Tunneling for Non-HTTP Services
The ngrok SSH gateway isn’t limited to web traffic; it can tunnel any TCP-based service, which is invaluable for exposing databases, SSH servers, or custom protocols.
`ssh -R 0:localhost:3306 tunnel.us.ngrok.com http 2>&1 | grep “started tunnel”`
Step-by-step guide: This advanced command exposes a local MySQL database (default port 3306). The `-R 0:localhost:3306` argument requests a TCP tunnel on a dynamically assigned port. The output filtering (grep "started tunnel") helps parse the ngrok terminal output to find the assigned public TCP address (e.g., tcp://1.tcp.ngrok.io:12345). You can then connect to your local database from a remote machine using this public address.
5. Integrating with Penetration Testing Workflows
This method seamlessly integrates into red team operations, especially for callback phases in phishing campaigns or C2 server setup.
`ssh -R 443:localhost:443 tunnel.us.ngrok.com http &`
Step-by-step guide: This command is used to expose a local Command and Control (C2) framework like Covenant or Metasploit, which is listening on port 443. The ampersand (&) runs the tunnel in the background, freeing up the terminal. A payload generated by the C2 framework would be configured with the public ngrok URL. When the payload executes on a target machine, it will call back to the ngrok tunnel, which forwards the connection to your local C2 server, effectively establishing a foothold behind the ngrok infrastructure.
6. Automation and Scripting for Continuous Testing
For repeated testing, incorporating the tunnel command into a shell script or build pipeline automates the process, ensuring a consistent environment.
`!/bin/bash
start_local_server.sh
./my_app.sh & Start your local application
ssh -R 80:localhost:8080 tunnel.us.ngrok.com http
Step-by-step guide: This simple Bash script demonstrates automation. It first starts your local web application in the background (&`). It then immediately establishes the SSH tunnel to ngrok. This can be triggered by a CI/CD pipeline (e.g., GitHub Actions, GitLab CI) to automatically create a public preview of a feature branch upon every push, allowing for immediate stakeholder feedback.
7. Troubleshooting and Connection Management
Managing multiple tunnels and diagnosing issues is a key skill. Using verbose output and process management commands ensures reliability.
`ssh -R 80:localhost:8080 -v tunnel.us.ngrok.com http`
`ps aux | grep “ssh.tunnel.us.ngrok.com”`
`kill -9 $(ps aux | grep “ssh.tunnel.us.ngrok.com” | awk ‘{print $2}’)`
Step-by-step guide: The `-v` (verbose) flag provides detailed connection logs, crucial for debugging authentication or network issues. The `ps aux | grep` command lists all active SSH tunnel processes, helping you identify running tunnels. The `kill` command, using process ID extraction with awk, forcefully terminates all ngrok SSH tunnel processes, which is useful for cleaning up stale connections.
What Undercode Say:
- The ngrok SSH gateway democratizes rapid prototyping and testing by removing the friction of software installation and API key configuration.
- This technique represents a broader shift towards “infrastructure-as-command,” where complex networking tasks are abstracted into single, executable statements, accelerating both development and adversarial simulation.
This method is more than a simple shortcut; it’s a paradigm shift for red teams and developers. Its power lies in its universality—SSH is ubiquitous on systems from Linux to macOS and Windows (via WSL/OpenSSH). This allows operators to establish critical reverse tunnels from virtually any environment without raising detection flags associated with downloading and executing unknown binaries. For blue teams, this underscores the need to monitor outbound SSH connections to unfamiliar domains, as `tunnel.us.ngrok.com` could be a strong indicator of this kind of activity. The line between developer convenience and attacker tradecraft has never been thinner.
Prediction:
The convergence of common administrative tools (like SSH) with powerful, cloud-based infrastructure will continue to blur the lines between legitimate operations and offensive security tactics. We predict a rise in “living-off-the-land” style attacks that leverage sanctioned SaaS platforms and protocols for malicious tunneling, data exfiltration, and C2. Defensive strategies will increasingly need to focus on behavioral analysis and egress filtering for trusted protocols, rather than just blocking known malicious IPs or binaries, as attackers seamlessly weaponize the very tools and services the enterprise relies on.
🎯Let’s Practice For Free:
IT/Security Reporter URL:
Reported By: Hakluke Http – Hackers Feeds
Extra Hub: Undercode MoN
Basic Verification: Pass ✅
