Pivoting & tunneling

When it applies

You have a foothold on host A, and the objective (or the next host B) is only reachable from A's network. You need to route your tools through A.

Why it works

The foothold sits inside the trust boundary. A tunnel turns that host into a router/proxy so your attack host can reach internal services as if it were on that subnet.