Stowaway is a multi-hop proxy tool for penetration testers written in Go.
Stowaway addresses the problem of routing external traffic through multiple internal network nodes to bypass access restrictions and establish tree-structured node networks. It works by deploying an admin controller on the operator's machine and agent nodes within target networks, which can connect to each other in active or passive modes to form proxy chains. Traffic between nodes can traverse TCP, HTTP, or WebSocket protocols and is encrypted using TLS and AES-256-GCM. The tool supports both forward and reverse connections between nodes, automatic reconnection, and multi-level SOCKS5 traffic forwarding with UDP and TCP support across IPv4 and IPv6.
Stowaway suits penetration testers who need to pivot through multiple network segments and manage complex internal network topologies. The tool is particularly valuable for scenarios requiring interactive node management, as it provides command completion, history, and a tree-based node visualization. Beyond proxying, it offers SSH tunnel connections between nodes, remote shell access, file upload and download, local and remote port mapping, and port reuse capabilities. Nodes can authenticate each other and operate independently with toggleable services. The tool compiles to multiple platforms including Linux, macOS, Windows, MIPS, and ARM architectures.
Development activity shows consistent engagement with the project. The maintainer actively incorporates user feedback and bug reports from the community. The codebase demonstrates ongoing refinement, including optimization efforts that reduced binary size compared to earlier versions. The project maintains comprehensive documentation with detailed usage instructions, parameter explanations, and video demonstrations, indicating attention to user onboarding and clarity.
