p3ta-tricks
Ctrl+K
🐚 GTFOBins 🪟 LOLBAS 🩸 BloodHound 🩸 bloodyAD 📜 Certipy ☁️ Cloud ⚡ goexec 🤖 HackTricks 🔌 HardwareATT 📦 Impacket 🏰 InternalATT 🔀 Ligolo-ng 🐱 Mimikatz 💣 msfvenom 🔧 NetExec 🤖 OSAI 💥 PATT 🍳 Recipes 🎟️ Rubeus 🐍 Sliver
Home
Distro
Tools
🔀

Ligolo-ng

9 pages
Agent as server (Bind Connection)
Agent as server (Bind Connection) The Ligolo-ng agent can operate using a bind connection (i.e. acting as a server). Ins…
Configuring A Reverse Proxy
If you ever need to hide the listener behind a reverse proxy (in our case Nginx), here is the Nginx configuration you wi…
Introduction
Introduction Ligolo-ng is a simple , lightweight and fast tool that allows pentesters to establish tunnels from a revers…
Installing/Building Ligolo-ng
Installing/Building Ligolo-ng Precompiled binaries Precompiled binaries (Windows/Linux/macOS) are available on the Relea…
Listeners (Agent Binding/Listening)
Listeners (Agent Binding/Listening) You can listen to ports on the agent and redirect connections to your control/proxy …
Access to agent's local ports (127.0.0.1)
Access to agent's local ports (127.0.0.1) If you need to access the local ports of the currently connected agent, there'…
Misc / FAQ
Misc / FAQ Demo Ligolo-ng-demo.webm Does it require Administrator/root access ? On the agent side, no! Everything can be…
Pivoting Cheatsheet
Pivoting Cheatsheet Initial Setup (Attacker C2) Create TUN interfaces and routes on your C2 before each pivot layer: # I…
Quickstart
Quickstart Prerequisites Linux When using Linux, you need to create a tun interface on the Proxy Server (C2): $ sudo ip …

Set Variables

Values apply to all code blocks on this page and persist across pages in this session.

Search & Navigation Guide

Search
Ctrl+KOpen search from anywhere on the page
↑ ↓Move through results
EnterOpen the highlighted result
EscClose search

Searches all sources at once. The source name appears as a coloured tag on each result.

Filtering Search by Source

The coloured badges across the top bar (BloodHound, HackTricks, GTFOBins, etc.) are toggle buttons that narrow search to a single source.

① Click a badge— restricts all results to that source only
② Click it again— deselects it, search returns to all sources

Only one source filter is active at a time. The active badge glows in its source colour. The search box placeholder updates to reflect which source is active.

BloodHound Edge Search

On the BloodHound page the edge search uses prefix matching — type Owns to find the Owns edge only, not AZOwns. Type AZ to see all Azure edges.
Switch to Collectors to pick SharpHound / BloodHound-Python / RustHound and see that collector's syntax inline.

Variables

Click Variables in the sidebar to fill placeholders like <domain>, <dc-ip>, <password> across every code block on the page. Values carry over between pages for the whole session. Edit All lets you update every saved value at once. Clear resets them all.

Distro Toggle

Controls the command style used in impacket code blocks.
Kali — impacket-secretsdump
Exegol — secretsdump.py
Script — python3 secretsdump.py

Tools Toggle (Impacket / GoPacket)

Switches between the Python impacket toolkit and its Go equivalent.
Impacket — standard Python tools, sidebar shows the Impacket reference
GoPacket — replaces every impacket- / secretsdump.py / python3 … with gopacket-secretsdump style, sidebar switches to the GoPacket reference. Distro selection is ignored when GoPacket is active.