Bdtyktl

You can do it in one command, but you need netcat (nc) installed on the proxy machine:

ssh -o "ProxyCommand ssh poxyuser@proxy.machine nc -w 1 %h 22" targetuser@target.machine

[EDIT: mixed up the order of machines...]

If you don't mind using rsync instead of scp, you can use the following one-liner:

rsync -v --rsh "ssh proxy.machine ssh" target.machine:/remote/file /local/dir/

(you'll need passwordless access to the proxy machine)

You can now* do this as a one-liner, without requiring nc anywhere:

scp -o "ProxyCommand ssh pcreds@proxy.machine -W %h:%p" tcreds@target.machine:file .

Explanation

pcreds and tcreds represent your proxy and target credentials if required (username, username:password, etc.).

This is possible because of a built-in netcat-like ability, removing the requirement for nc on the intermediate host. Using ssh -W host:port sets up a tunnel to the specified host and port and connects it to stdin/stdout, and then scp runs over the tunnel.

The %h and %p in the ProxyCommand are replaced with the target host and port you specify.

For even more convenience, you can configure the proxy in your ssh configuration:

Host target.machine

    ProxyCommand ssh pcreds@proxy.machine -W %h:%p

and from then on just do

scp tcreds@target.machine:file .

* since OpenSSH 5.4 - released March 2010

$ ssh -f -N -L <localport>:<target.machine:port> user@proxy.machine

$ scp target-user@local.machine:/remote/file -P <localport> .

OK, actually two commands...

A one-liner? Not off the top of my head. You need to establish a proxy first and you can't do that with scp by itself.

When doing it manually, I open up a screen session for my tunnel:

screen -S tunnel

Screen is used to keep the tunnel going in a background shell. Use any technique you want to keep the tunnel open in the background (@weeheavy's answer is probably the simplest). Once in the screen session I start my tunnel like so

ssh -L 2222:target.machine:22 [user@]proxy.machine

To break that down, that basically says "On my local machine, open port 2222 and any connetion hitting localhost:2222 is proxied through proxy.machine to target.machine:22"

Once you've got the ssh connection and tunnel established, detach from the screen session with "C-a d". To get back to that screen session, type screen -raAd tunnel

Once you are back in your original shell your scp command will look like

scp -P 2222 localhost:your/file/on/target.machine local/path

Remember that localhost port 2222 is really just a tunnel going to target.machine.

How about:

scp -o "ProxyCommand ssh user@myproxyserver.com nc %h %p" your.filename username@yourdestination.yourdomain.com:/whatever_location

Appears that scp supports the"-o" option just like ssh does, though I'm not sure how to pass it a proxy username/password:

scp -o "ProxyCommand=nc -X connect -x proxyhost:proxyport %h %p" remote_user@remote_host:remote_path local_path

If you get nc: invalid option -- X see https://stackoverflow.com/a/23616021/32453

You could try something like:

ssh user@proxy.machine "ssh user@target.machine 'cat > file'" < file

But it won't work if your proxy.machine needs to ask you password (that SSH is not in a TTY, so askpass will fail).

If you have more than one file, you could use tar like this (untested, I usually use a netcat that way):

tar cf - file1 file2 folder1/ | ssh user@proxy.machine "ssh user@target.machine 'tar xvf -'"

Another simple solution
to transfer a source_file from the source_host to a destination_host via a proxy_host:

Log in on the proxy_server:

ssh login@proxy_host

From the proxy server, transfer the source_file from the source_host to the destination_host (you can type this as one line, omitting the ,
or as two lines, as shown below):

scp login@source_host:/path_to_source_file 

  login@destination_host:/path_to_destination_directory

This requires that the login on the source_host to the proxy_host uses an rsa_key.

In case you need to use public keys you will need something like this.

Host target-machine

  User          target-user

  HostName      target.example.com

  IdentityFile  /path/to/file.pem

  ProxyCommand  ssh bastion -W %h:%p



Host bastion

  User         bastion-user

  HostName     bastion.example.com

  IdentityFile /path/to/file.pem