PAGES
← all tools
◆ Post-Exploitation

ligolo-mp

v2.2.0 open-source

Ligolo-MP is an advanced version of Ligolo-ng that enables multiple pentesters to collaboratively manage concurrent network tunnels via a client-server architecture.

Summary

ligolo-mp is an open-source, GPLv3-licensed pivoting tool run from the command line, extending Ligolo-ng with a client-server setup so several operators can work the same tunnels at once instead of running solo. It manages TUNTUNA virtual network device in Linux (and other OSes) that lets a userspace program read and write raw IP packets, making it the standard building block for VPNs and traffic-manipulation tools. interfaces and routing automatically and adds a terminal-based GUIGUIA graphical user interface, controls such as windows, buttons and menus. It lets people use software visually rather than entering commands. on top, generating mTLSmTLSMutual TLS, an encrypted connection where both client and server present certificates to prove their identity. It helps services verify who they are communicating with. agent binaries for Linux, FreeBSD, macOS and Windows targets, with SOCKSSOCKSA proxy protocol that relays TCP (and optionally UDP) connections through an intermediary server, letting cyber tools route traffic through a pivot host or anonymizing layer without needing raw network access. and HTTP proxying including SSPI/SPNEGO. This is a red team or pentest tool, aimed at operators doing lateral movementlateral movementMoving from an initially compromised system or identity to other resources in a network. Attackers often use stolen credentials or trusted connections to expand their access. on an engagement where more than one person needs to see and use the same pivots. It sits in the post-exploitation tunneling and lateral-movement space alongside other pivoting utilities, though its own documentation frames it specifically as the multiplayer version of Ligolo-ng. Started in 2024 with five contributors, it has kept up a steady release cadence, the most recent about five months old.

Ligolo-MP is an advanced version of Ligolo-ng that enables multiple pentesters to collaboratively manage concurrent network tunnels via a client-server architecture.

How ligolo-mp helps

Which teammates currently have a foothold on this network, and are we stepping on each other's tunnels?

every operator connects to the same server, so all active agents and relays show up in one shared view instead of living only in one person's terminal session

Which compromised host can get me to a network segment I can't reach directly?

builds and manages the TUN interfaces and routes for each pivot automatically, and restores routing when a tunnel is torn down, so reachable subnets behind an agent are visible without hand-editing routes

How do I reach a service bound only to a target's own loopback?

routes traffic directly to the agent's loopback address, removing the need to set up separate port forwards for those services

Which of my deployed agents are still checking in, and which went dark?

tracks first-seen and last-seen times per agent in the interface, so stale or lost footholds are distinguishable from live ones

Can I get an agent through a host that enforces domain authentication on its proxy?

agent connections support SSPI/SPNEGO and NTLM, so an agent can authenticate through a Windows-integrated proxy on its way back to the server

Who still has valid access to this engagement's operation, and can I cut someone off mid-op?

operator certificates are managed and revocable from the tool, so a specific operator's access can be pulled without rebuilding the whole setup

all 11 features, with the evidence for each →

Languages

Not documented

Features

11 capabilities · 1 backed by code, an API document or a real run

Built from ligolo-mp's releases, docs, README and our own runs. “Seen” marks the month we first spotted a release the vendor didn't date. Group names and tags are our labels.

Compare with peers →

What ligolo-mp offers you

  • Command-line interface1
All capabilities 11 capabilities
Server connection configuration verified Allows the user to specify the server to connect to and optionally disable TLS certificate verification for the server or agents. 2 releases · 4 other sources · first seen Mar 2025

Also counts toward: Command-line interface

release

  • Adds singleplayer mode for solo operator use without a separate server setup. v2.0.0 · Mar 2025 · source · release history
  • Adds operator management functionality including certificate revocation for operators. v2.0.0 · Mar 2025 · source · release history

docs

  • Multi-player pivot tool extending Ligolo-ng with client-server architecture for collaborative concurrent tunnels and automatic TUN management.

command line

Agent TLS certificate validation control shipped Provides an option to ignore the agent's TLS certificate validation. 1 release · first seen Mar 2026

release

  • Adds an option to ignore the agent's TLS certificate validation. v2.2.0 · Mar 2026 · source · release history
FreeBSD agent generation support shipped Adds FreeBSD as a target OS option in the agent generate form. 1 release · first seen Mar 2026

release

  • Adds FreeBSD as a target OS option in the agent generate form. v2.2.0 · Mar 2026 · source · release history
NTLM and Windows SSPI/SPNEGO authentication shipped Enables NTLM authentication and Windows SSPI/SPNEGO support for agent connections. 1 release · first seen Mar 2026

release

  • Adds NTLM authentication and Windows SSPI/SPNEGO support for agent connections. v2.2.0 · Mar 2026 · source · release history
Runtime connect-back address override shipped Allows the server override option for agents, allowing the connect-back address to be changed at runtime. 1 release · first seen Mar 2026

release

  • Adds a server override option for agents, allowing the connect-back address to be changed at runtime. v2.2.0 · Mar 2026 · source · release history
Agent connection proxy support shipped Allows agents to connect through an HTTP/S proxy, with options to override environment settings. 1 release · first seen Mar 2025

release

  • Adds HTTP/S proxy support for agent connections, including an option to ignore environment proxy configuration. v2.0.0 · Mar 2025 · source · release history
Agent tracking visibility shipped Displays 'last seen' and 'first seen' timestamps for agents in the UI. 1 release · first seen Mar 2025

release

  • Adds last seen and first seen tracking for agents in the UI. v2.0.0 · Mar 2025 · source · release history
Form usability improvements shipped Adds form hints and pre-fills last-used values as defaults on agent generation forms. 1 release · first seen Mar 2025

release

  • Adds form hints on agent generation and other forms, with last-used values pre-filled as defaults. v2.0.0 · Mar 2025 · source · release history
Operator export details shipped Displays the full path in the operator export result popup. 1 release · first seen Mar 2025

release

  • Adds full path display in the operator export result popup. v2.0.0 · Mar 2025 · source · release history
Singleplayer mode shipped Enables singleplayer mode for solo operator use without a separate server setup. 1 release · first seen Mar 2025

release

  • Adds singleplayer mode for solo operator use without a separate server setup. v2.0.0 · Mar 2025 · source · release history
UI interaction enhancements shipped Improves user interface with escape button support and reset on disconnect. 1 release · first seen Mar 2025

release

  • Adds escape button support on all UI pages and nested page reset on disconnect. v2.0.0 · Mar 2025 · source · release history

Lines in monospace are the tool's own words: help text parsed from its source, or an endpoint from its API document. Under release, a line is our summary of a dated release. Under docs, it is quoted from the tool's own documentation or website. Each links back to the source it came from.

Score card

  1. Shipping velocity releases a month, last 12 months
  2. Documentation quality release-notes rubric, 0–100
  3. Breaking-change discipline how rarely a release breaks users, and notice given
  4. Maintenance risk quiet time against its own cadence, maintainers
  5. Innovation & surface new capabilities, API and MCP surface
  6. Community health
  7. Contributor trend distinct committers, this year against last
  8. Maintainer concentration bus factor now against a year ago
  9. Issue backlog trend issues closed per issue opened, 12 months
  10. Responsiveness median time to a maintainer’s first reply

Nine scores for ligolo-mp, each built from the releases, notes and API history this site tracks — and, on Researcher and Business, where it stands among every measured tool in its category and how that has moved.

Score cards are part of every paid plan.

See plans →

Each score is 0–100 on a published rubric, derived from data this site already shows. A dimension we cannot measure says so — it is never scored 0 and never enters a rank.

How this is scored
  • Shipping velocity — releases a month over the last 12 months, on a log scale where 16 a month scores 100. Needs 3 releases in the window.
  • Documentation quality — the release-notes rubric published on the analytics page, unchanged.
  • Breaking-change discipline — the share of releases carrying a breaking change (none scores 100, half or more scores 0). Only projects that label breaking changes are measured: a clean record cannot be told from an unlabelled one.
  • Maintenance risk — quiet time measured against the tool's own release cadence (quiet longer than 90 days and three typical gaps scores 0), plus the number of active maintainers and whether contributors are growing, where known. Higher is lower risk.
  • Innovation & surface — new capabilities in the feature ledger this year, API and MCP operations added, and the share of commits that are features: the mean of whichever we hold.
  • Community health (open-source tools only) — each is a direction, not a size: contributors this year against last, the bus factor now against a year ago, and issues closed per issue opened, where steady scores 50, doubled 100 and halved 0; plus the median time to a maintainer's first reply (an hour scores about 100, a month or more 0). A commercial card has no repository and carries none of the four.
  • Documented delivery (commercial tools) — when a vendor's documented new capabilities have slowed against its own baseline, that counts against the overall standing as heavily as two low dimensions. Steady delivery, or too little history to judge, leaves the standing alone; it is never a sixth score.
  • Open-source tools are scored on repository signals; commercial tools on their published changelog. Ranks compare tools within one category and one profile and need at least five measured peers; the overall standing needs three ranked dimensions. Best-in-breed or consolidator is a shape, not a quality, and is never scored.

Release-note detail over time

See how much detail ligolo-mp puts in its release notes, quarter by quarter, and compare it with tracked tools in the same category. This history uses up to ten retained, reviewed notes per tool; sparse or blank older quarters may reflect that limit.

Checking release-note history…

Explore the full chart →

Releases

Show

2 entries

  1. March 20261
  2. March 20251
    Show

    2 entries

    Project health

    Issue, contributor and maintainer activity in ttpreport/ligolo-mp, 2023-10 – 2026-09, as of 2026-09-25. Twelve-month figures first; the trend lines run the whole window.

    1. Contributors 2 −1 vs prior 12 months
    2. Maintainers 1 +0 joined · −0 left, last 12 months
    3. Bus factor 1 committers behind half the commits
    4. Community-filed 100% of issues opened, last 12 months
    5. Median time to close 11 days first maintainer reply 11 hours
    6. Open backlog 2 of 28 issues ever filed
    1. Issues opened / month 0 · 0 communitymaintainers
    2. Open backlog 2
    3. Contributors / month 0
    4. Commits / month 0
    5. Stars 535
    Issue themes, last 12 months
    • bugs 20%
    • features 20%
    • other 60%

    Counts from the project's public repository and git history; no individuals are identified. Maintainers are the committers covering 80% of the last year's commits. how we measure this

    Articles

    1 article · updated Nov 4, 2026

    Where ligolo-mp turns up in what others publish: how-tos, attack reports that name it, and incident write-ups. A row says why it is here and quotes where the article names it; the link goes to the publisher.

    Tutorials & guides 1

    • Network Pivoting using Ligolo-MP – Complete Guide Hacking Articles
      Ligolo-mp Installation Installing Ligolo-mp on Kali Linux using: sudo apt install ligolo-mp Once the Ligolo-mp is installed, execute the ligolo-server using sudo ligolo-mp Press enter to login as the admin operator.
      2 more quotes
      Starting the Ligolo-mp Proxy Server Press enter to start the ligolo-mp ui.
      The standard ligolo-mp window consist of 5 sections – SERVER : Displays operator and agent listener details, confirming active control and callback ports.

    Libraries its release ships

    What its latest release locks, checked against known advisories.

    None of its release's images build from a lockfile we can read.

    Add the badge to your README

    Maintain this project? The badge links readers straight to this page, so they can follow every release here.

    Tracked by Cyber Toolchain Choose a badge style and copy the code →
    browse all tools → score card for your toolchain →