DΛΣMӨП

// HackTricks · Linux

Local Network and Socket Triage

Local Network and Socket Triage

After getting a shell on a Linux host, the most useful network targets are often not exposed externally. Loopback-only services, veth networks, Unix sockets, temporary listeners, packet captures, and local firewall rules can expose credentials or local-only attack surfaces.

This page focuses on practical local post-exploitation techniques, not general remote network pentesting.

Loopback and Local Service Enumeration

Start by identifying listening services, their bind addresses, and the owning process when permissions allow it.[1][2]

ss -lntup
ss -lnx
ip addr
ip route

Important patterns:

  • 127.0.0.1:<port> or [::1]:<port>: reachable only from the host by default.[3][4]
  • 0.0.0.0:<port>: reachable on all IPv4 interfaces unless filtered.[3]
  • 10.0.0.0/8, 172.16.0.0/12, or 192.168.0.0/16 on veth*, docker*, br-*, cni*: likely container or local lab networks.[23][24]
  • Unix sockets under /run, /var/run, /tmp, or application directories: local IPC surfaces.[5]

Map local ports with lightweight probes.[6][7]

for p in 80 443 8000 8080 8081 9000 5000; do
  timeout 1 bash -c "echo >/dev/tcp/127.0.0.1/$p" 2>/dev/null && echo "open: $p"
done

Use nmap locally when available.[8][9][10]

nmap -sT -Pn -p- 127.0.0.1
nmap -sT -Pn --open 127.0.0.1

Hidden veth and Container Subnets

Containerized or lab environments often expose services only on a bridge or veth subnet. Enumerate interfaces and routes before assuming a service is unreachable.[2]

ip -br addr
ip route
ip neigh

Find likely local subnets.[2]

ip -o -4 addr show | awk '{print $2, $4}'

Probe a discovered subnet carefully.[8][9][10]

nmap -sT -Pn --open 172.17.0.0/24
nmap -sT -Pn -p 80,443,8000,8080,9000 172.17.0.0/24

The technique is useful when a web panel, debug endpoint, or helper service is hidden from external scans but reachable from the compromised host or container network.

Local Pivot With socat or SSH

If a service is bound to loopback, expose it through an allowed channel instead of changing the service itself.

Forward a local-only HTTP service with SSH.[11]

ssh -L 8080:127.0.0.1:8080 user@target

Bridge a local port with socat when you already have shell access.[12]

socat TCP-LISTEN:18080,fork,reuseaddr TCP:127.0.0.1:8080

Forward a Unix socket to TCP for local testing.[5][12]

socat TCP-LISTEN:18081,fork,reuseaddr UNIX-CONNECT:/run/app/app.sock

This does not exploit anything by itself. It makes a local-only surface reachable from your tooling so you can interact with it like a normal service.

Not every service is HTTP. Many local services leak enough information through a banner or one-line protocol.

Basic probes.[13]

nc -nv 127.0.0.1 9000
printf 'help\n' | nc -nv 127.0.0.1 9000
printf 'version\n' | nc -nv 127.0.0.1 9000

HTTP check without a browser.[13][14]

printf 'GET / HTTP/1.1\r\nHost: 127.0.0.1\r\nConnection: close\r\n\r\n' | nc -nv 127.0.0.1 8080
curl -i http://127.0.0.1:8080/

For TLS.[14][15]

openssl s_client -connect 127.0.0.1:8443 -servername localhost
curl -k -i https://127.0.0.1:8443/

The goal is to identify the protocol, authentication scheme, version, and whether the service trusts local clients.

Capturing Loopback Traffic

Local traffic can expose headers, bearer tokens, Basic Auth credentials, or application-specific secrets.[17][25] Capture only in authorized environments.

Capture loopback HTTP traffic.[16]

sudo tcpdump -i lo -A -s0 'tcp port 80 or tcp port 8080'

Capture a specific local service.[16]

sudo tcpdump -i lo -w /tmp/loopback.pcap 'tcp port 8080'

Decode Basic Auth from a captured or logged header.[17][18]

printf '%s' 'dXNlcjpwYXNz' | base64 -d

Useful strings to look for in text captures:

grep -Ei 'Authorization:|Cookie:|Bearer|Basic|token|api[_-]?key|password' /tmp/capture.txt

TLS Key Logging

If you can control the client process environment in a lab, SSLKEYLOGFILE can make TLS sessions decryptable in Wireshark or compatible tooling.[19][20] This is useful for understanding local HTTPS traffic without attacking TLS itself.

Run a client with key logging enabled.[19][20]

export SSLKEYLOGFILE=/tmp/sslkeys.log
curl -k https://127.0.0.1:8443/
ls -l /tmp/sslkeys.log

Capture the traffic at the same time.[16]

sudo tcpdump -i lo -w /tmp/tls.pcap 'tcp port 8443'

Then load /tmp/tls.pcap and /tmp/sslkeys.log into Wireshark. This only works when the client library supports NSS-style key logging and you can set the environment before the connection is made.[20][21]

Unix Socket Interaction and Command Injection

Unix sockets are local IPC endpoints.[5] They may expose HTTP APIs, custom protocols, or unsafe command handlers.[12][14]

Find sockets.[1][5]

ss -lnx
find /run /var/run /tmp -type s -ls 2>/dev/null

Interact with HTTP over a Unix socket.[14]

curl --unix-socket /run/app/app.sock http://localhost/
curl --unix-socket /run/app/app.sock -i http://localhost/admin

Interact with a raw socket.[12][13]

printf 'status\n' | socat - UNIX-CONNECT:/run/app/app.sock
printf 'help\n' | nc -U /run/app/app.sock

If user-controlled socket input is passed to a shell or privileged helper, it can become command injection.[26] For a focused example, see Socket Command Injection.

nftables Review and Authorized Rule Changes

Local firewall rules may explain why a service is visible locally but blocked remotely, or why a high port appears unreachable from one interface.[22]

Review rules.[22]

sudo nft list ruleset
sudo nft list tables
sudo nft list chains

Look for drops affecting a target port.[22]

sudo nft list ruleset | grep -Ei 'drop|reject|dport|tcp|udp'

In an authorized lab, remove a specific blocking rule by handle.[22]

sudo nft -a list chain inet filter input
sudo nft delete rule inet filter input handle <handle>

Prefer deleting the exact handle over flushing full tables. The technique is to identify the precise filter causing the behavior and change only that rule.[22]

Quick Workflow

ss -lntup
ss -lnx
ip -br addr
ip route
nmap -sT -Pn --open 127.0.0.1
find /run /var/run /tmp -type s -ls 2>/dev/null
sudo nft list ruleset 2>/dev/null | head -n 80

Prioritize services that are local-only, run as a more privileged user, expose admin/debug functions, or trust loopback/container-network clients.

References