Plink, Chisel, and iodine (authorized test)

Protocol tunneling encapsulates traffic in another protocol to connect approved endpoints or relay access to a destination reachable from the tunnel server. ATT&CK T1572 is categorized under Command and Control. The Plink, Chisel, and iodine examples below are independent implementation choices; select one path rather than running them in sequence. They can be initiated from an Internet-connected test client when the authorized SSH, Chisel, or iodined endpoint is publicly reachable; destination reachability depends on that endpoint and does not imply every destination is Internet-exposed. Tunneling can evade network filtering, so use only within written scope and for explicit destinations.