Install

docker run --rm -it jpillora/chisel --help

$ go get -v github.com/jpillora/chisel

Features

Demo

$ chisel server --port$PORT --proxy http://example.com# listens on $PORT, proxy web requests to 'http://example.com'

$ chisel client https://chisel-demo.herokuapp.com 3000# connects to 'https://chisel-demo.herokuapp.com',# tunnels your localhost:3000 to the server's localhost:3000

Usage

$ chisel --help   Usage: chisel [command] [--help]   Version: 0.0.0-src   Commands:     server - runs chisel in server mode     client - runs chisel in client mode   Read more:     https://github.com/jpillora/chisel

$ chisel server --help  Usage: chisel server [options]  Options:    --host, Defines the HTTP listening host – the network interface    (defaults the environment variable HOST and falls back to 0.0.0.0).    --port, -p, Defines the HTTP listening port (defaults to the environment    variable PORT and fallsback to port 8080).    --key, An optional string to seed the generation of a ECDSA public    and private key pair. All commications will be secured using this    key pair. Share the subsequent fingerprint with clients to enable detection    of man-in-the-middle attacks (defaults to the CHISEL_KEY environmentvariable, otherwise a new key is generate each run).    --auth, An optional string representing a single user with fullaccess, in the form of <user:pass>. This is equivalent to creating anauthfile with {"<user:pass>": [""]}.    --authfile, An optional path to a users.json file. This file should    be an object with users defined like:      "<user:pass>": ["<addr-regex>","<addr-regex>"]      when <user> connects, their <pass> will be verified and then      each of the remote addresses will be compared against the list      of address regular expressions for a match. Addresses will      always come in the form "<host/ip>:<port>".    --proxy, Specifies another HTTP server to proxy requests to whenchisel receives a normal HTTP request. Useful for hiding chisel inplain sight.    --socks5, Allows client to access the internal SOCKS5 proxy. See    chisel client --help for more information.    --pid Generate pid file in current directory    -v, Enable verbose logging    --help, This help text  Version:    0.0.0-src  Read more:    https://github.com/jpillora/chisel

$ chisel client --help  Usage: chisel client [options] <server> <remote> [remote] [remote] ...  <server> is the URL to the chisel server.  <remote>s are remote connections tunnelled through the server, each of  which come in the form:    <local-host>:<local-port>:<remote-host>:<remote-port>    ■ local-host defaults to 0.0.0.0 (all interfaces).    ■ local-port defaults to remote-port.    ■ remote-port is required*.    ■ remote-host defaults to 0.0.0.0 (server localhost).    example remotes      3000      example.com:3000      3000:google.com:80      192.168.0.5:3000:google.com:80      socks      5000:socks    *When the chisel server enables --socks5, remotes can    specify "socks" in place of remote-host and remote-port.    The default local host and port for a "socks" remote is    127.0.0.1:1080. Connections to this remote will terminate    at the server's internal SOCKS5 proxy.  Options:    --fingerprint, A *strongly recommended* fingerprint string    to perform host-key validation against the server's public key.    You may provide just a prefix of the key or the entire string.    Fingerprint mismatches will close the connection.    --auth, An optional username and password (client authentication)    in the form: "<user>:<pass>". These credentials are compared to    the credentials inside the server's --authfile. defaults to theAUTH environment variable.    --keepalive, An optional keepalive interval. Since the underlying    transport is HTTP, in many instances we'll be traversing through    proxies, often these proxies will close idle connections. You must    specify a time with a unit, for example '30s' or '2m'. Defaults    to '0s' (disabled).    --proxy, An optional HTTP CONNECT proxy which will be used reach    the chisel server. Authentication can be specified inside the URL.For example, http://admin:password@my-server.com:8081    --pid Generate pid file in current directory    -v, Enable verbose logging    --help, This help text  Version:    0.0.0-src  Read more:    https://github.com/jpillora/chisel

Security

Authentication

Performance

(direct)        .--------------->----------------.       /    chisel         chisel         \request--->client:2001--->server:2002---->fileserver:3000       \                                  /        '--> crowbar:4001--->crowbar:4002'             client           server

:3000 => 1 bytes in 1.291417ms:3000 => 10 bytes in 713.525µs:3000 => 100 bytes in 562.48µs:3000 => 1000 bytes in 595.445µs:3000 => 10000 bytes in 1.053298ms:3000 => 100000 bytes in 741.351µs:3000 => 1000000 bytes in 1.367143ms:3000 => 10000000 bytes in 8.601549ms:3000 => 100000000 bytes in 76.3939ms

:2001 => 1 bytes in 1.556521ms:2001 => 10 bytes in 1.310739ms:2001 => 100 bytes in 1.26706ms:2001 => 1000 bytes in 1.189441ms:2001 => 10000 bytes in 1.509267ms:2001 => 100000 bytes in 2.98981ms:2001 => 1000000 bytes in 14.737928ms:2001 => 10000000 bytes in 141.936428ms:2001 => 100000000 bytes in 1.208960105s

:4001 => 1 bytes in 3.335797ms:4001 => 10 bytes in 1.453007ms:4001 => 100 bytes in 1.811727ms:4001 => 1000 bytes in 1.621525ms:4001 => 10000 bytes in 5.20729ms:4001 => 100000 bytes in 38.461926ms:4001 => 1000000 bytes in 358.784864ms:4001 => 10000000 bytes in 3.603206487s:4001 => 100000000 bytes in 36.332395213s

Known Issues

Contributing

Changelog

Todo

MIT License