Common Intranet Penetration Tools: nps, frp, ew and ngrok Explained

0x00 Preface

This article collects several personal‑use intranet penetration and proxy tools from a penetration perspective, describing their basic principles and usage.

0x01 nps‑npc

1.1 Introduction

nps is a lightweight, high‑performance intranet penetration proxy server. It forwards TCP and UDP traffic, supports any upper‑layer protocol (web, payment interfaces, SSH, RDP, DNS, etc.), provides internal HTTP and SOCKS5 proxies, P2P, and a web management console.

Typical deployment:

A public‑IP server (VPS) runs the nps server.

One or more internal machines run the npc client.

1.2 Features

Written in Go.

Cross‑platform.

Supports multiple proxy protocols.

Web management interface.

1.3 Usage

Download the server package (example version v0.23.2):

cd ~
wget https://github.com/cnlh/nps/releases/download/v0.23.2/linux_amd64_server.tar.gz
tar xzvf linux_amd64_server.tar.gz
cd ~/nps

Edit conf/nps.conf to set the web console parameters:

web_host=YOUR_SERVER_IP_OR_DOMAIN
web_username=admin
web_password=YOUR_PASSWORD
web_port=8080

Adjust the bridge section if only ports 80/443 are allowed (e.g., change bridge_port to 443):

#bridge
type=tcp
bridge_port=443   # modify connection port
bridge_ip=0.0.0.0

Start the server:

# Mac/Linux
./nps test|start|stop|restart|status
# Windows
nps.exe test|start|stop|restart|status

Start a client (replace YOUR_IP and UNIQUE_PASSWORD):

./npc -server=YOUR_IP:8024 -vkey=UNIQUE_PASSWORD -type=tcp

The web console lists each client and its tunnels; a client can create multiple protocol tunnels.

0x02 frp

2.1 Introduction

frp is a high‑performance reverse proxy focused on intranet penetration. It supports TCP, UDP, HTTP, HTTPS and can expose internal services through a public‑IP node.

2.2 Features

Client‑server communication supports TCP, KCP and WebSocket.

Port reuse allows many services to share a single server port.

Cross‑platform (slightly fewer protocols than nps).

Pluggable architecture for extensions (static file server, dashboard, etc.).

2.3 Usage

Download the binaries from the official releases:

https://github.com/fatedier/frp/releases

Example: expose an internal RDP service.

# frps.ini (server)
[common]
bind_port = 7000
token = abcdefgh

# Start server
./frps -c ./frps.ini

# frpc.ini (client)
[common]
server_addr = x.x.x.x
server_port = 7000
token = abcdefgh

[rdp]
type = tcp
local_ip = 127.0.0.1
local_port = 3389
remote_port = 6000

# Start client
./frpc -c ./frpc.ini

RDP is then reachable at x.x.x.x:6000.

SSH exposure (same server config, client adds an [ssh] section):

[ssh]
type = tcp
local_ip = 127.0.0.1
local_port = 22
remote_port = 6000

Connect with: ssh -p 6000 [email protected] Custom domain HTTP/HTTPS:

# frps.ini adds vhost_http_port
[common]
bind_port = 7000
vhost_http_port = 8080
token = abcdefgh

# frpc.ini for domain
[web]
type = http
local_port = 80
custom_domains = www.yourdomain.com

After DNS A‑record points www.yourdomain.com to the server IP, the internal web service is accessible at http://www.yourdomain.com:8080.

Static file plugin example (serve files from /tmp/file on port 6000):

[test_static_file]
type = tcp
remote_port = 6000
plugin = static_file
plugin_local_path = /tmp/file
plugin_strip_prefix = static
plugin_http_user = abc
plugin_http_passwd = abc

Browse to http://x.x.x.x:6000/static/ to download files.

Dashboard (optional monitoring UI): add the following to frps.ini and access http://SERVER_IP:7500 with default credentials admin/admin:

[common]
dashboard_port = 7500
dashboard_user = admin
dashboard_pwd = admin

Encryption & compression (disabled by default). Enable per‑proxy:

[ssh]
type = tcp
local_port = 22
remote_port = 6000
use_encryption = true
use_compression = true

TLS support (v0.25.0+). Add tls_enable = true under the [common] section of both server and client to encrypt the control channel.

Bandwidth limiting (per proxy, units MB or KB):

[ssh]
type = tcp
local_port = 22
remote_port = 6000
bandwidth_limit = 1MB

Range port mapping (multiple ports in one section):

[range:test_tcp]
type = tcp
local_ip = 127.0.0.1
local_port = 6000-6006,6007
remote_port = 6000-6006,6007

frp creates separate proxies named test_tcp_0, test_tcp_1, … for each mapped port.

0x03 ew

3.1 Introduction

EW is a portable network penetration tool written in C. It provides a SOCKS5 service and port forwarding, and supports multi‑level proxy chaining. The project is no longer maintained.

3.2 Features

Lightweight C implementation.

Cross‑platform.

Supports multi‑level proxy chaining.

Only SOCKS5 proxy.

3.3 Usage

All examples assume the default SOCKS5 port 1080.

# Forward SOCKS5 server
./ew -s ssocksd -l 1080

Reverse SOCKS5 server (two steps):

# Public host A
./ew -s rcsocks -l 1080 -e 8888
# Target host B
./ew -s rssocks -d 1.1.1.1 -e 8888

Two‑level chaining example (forward from local 1080 to remote 9999):

# Start forward server on port 9999
./ew -s ssocksd -l 9999
# Chain client
./ew -s lcx_tran -l 1080 -f 127.0.0.1 -g 9999

Three‑level chaining example:

# Step 1: public reverse server
./ew -s rcsocks -l 1080 -e 8888
# Step 2: intermediate listener
./ew -s lcx_slave -d 127.0.0.1 -e 8888 -f 127.0.0.1 -g 9999
# Step 3: local listener
./ew -s lcx_listen -l 9999 -e 7777
# Step 4: final reverse client
./ew -s rssocks -d 127.0.0.1 -e 7777

Data flow: SOCKS5 → 1080 → 8888 → 9999 → 7777 → rssocks.

0x04 ngrok

4.1 Introduction

ngrok is a reverse proxy that creates a secure tunnel between a public endpoint and a locally running service, exposing internal services to the Internet. It records traffic and can replay requests.

4.2 Features

Officially maintained, generally stable.

Cross‑platform, closed source.

Traffic logging and replay.

4.3 Usage

1. Register at https://ngrok.com/ and download the binary for the target platform.

2. Authenticate with the token provided by the website: ./ngrok authtoken YOUR_AUTHTOKEN 3. Expose a local HTTP service on port 80: ./ngrok http 80 ngrok returns a public URL that forwards to the local service.

File sharing with basic authentication:

ngrok http -auth="user:password" file:///Users/alan/share

Expose a Windows folder (no authentication):

ngrok http "file:///C:\Users\alan\Public Folder"

Expose RDP (TCP 3389) to the Internet: ngrok tcp 3389 Further commands and options are documented at https://ngrok.com/docs.