In this lesson,
we're going to talk about segmentation bypassing,
VLAN hopping, and multihomed hosts,
and how these concepts are used in attacks
and exploitation for pen testing.
First, let's discuss segmentation bypassing.
Segmentation bypassing refers to techniques
used to circumvent network segmentation controls.
Network segmentation is a security practice
that divides a network into smaller segments
to limit the spread of potential attacks
and to contain threat.
However, attackers often find ways
to bypass these controls moving laterally within the network
to access restricted parts.
When conducting a PenTest,
understanding how to bypass segmentation is crucial
for assessing the security posture of a segmented network.
For example, an attacker might exploit
weak or misconfigured firewalls,
use compromised credentials to access multiple segments
or find unprotected routes between the segment.
Imagine doing a PenTest on a corporate network
with strict segmentation between departments
like HR, finance, IT, and sales.
You identify a critical flaw.
Each department is intended to be isolated
to prevent unauthorized access,
but you discover a misconfigured firewall rule
that allows certain traffic
between the sales and finance segment.
Initially accessing a workstation in the sales department
as the sales underscore user number one,
you perform a network scan using Nmap
and find that TCP traffic on port 1433
for SQL servers
is allowed between the two segments.
Exploiting this misconfiguration,
you connect to the finance department's SQL server
and use tools like Mimikatz to harvest credentials,
including those of a high privileged user named
finance underscore dbadmin.
Cracking the password hash with Hashcat,
you gain access to sensitive financial data
such as payroll information and financial transaction.
This shows a significant security lapse
in a network's segmentation policy.
Next, let's talk about VLAN hopping.
VLAN hopping is a technique used by attackers
to gain access to network segments
they should not have access to
by exploiting vulnerabilities in a virtual local area
network configuration.
VLANs are used to segment network traffic
at the data link layer,
also known as layer two,
creating isolated network segments
on the same physical network.
However, if VLANs are not properly configured,
attackers can use VLAN hopping
to move between these segments.
There are two primary methods for VLAN hopping,
switch spoofing and double tagging.
In switch spoofing an attacker configures the device
to mimic a trunk switching, which is a network switch
that can carry multiple VLANs
over a single physical connection between switches.
This did allows them to gain access to multiple VLANs.
In double tagging, an attacker sends packets
with two VLAN tags.
The first switch strips off the first tag,
and the packet is then forwarded
to the second VLAN based on the second tag,
allowing the attacker to access a different VLAN.
Consider a scenario where you're testing security
of a data center.
By using double tagging, you crack packets that allow you
to bypass the VLAN segmentation
and access sensitive systems in a different VLAN.
This exploit demonstrates a serious security issue
that could allow attackers to compromise critical systems
within the data center.
Finally, let's explore the concept of multihomed hosts.
A multihomed host is a device
that has multiple network interfaces,
each connected to a different network.
This configuration can be used for redundancy,
load balancing, or network segmentation.
However, multihomed hosts can also pose security risks,
if not properly managed,
as they can become conduits for traffic between
otherwise isolated networks.
When assessing the security of a network,
it's important to identify multihomed hosts
and understand their role within a network.
Attacker who compromises a multihomed host
can potentially bridge different network segments
facilitating lateral movements
and increasing the scope of the attack.
This makes multihomed hosts a key focus during a PenTest.
Imagine you are performing a penetration test
on a corporate network,
and you identify a server with interfaces connected
to both the internal network and a DMZ or screen subnet.
By exploiting a vulnerability on the server,
you gain access to both networks,
allowing you to launch further attacks and ex-filtrate data.
This highlights the risk posed by
improperly securing multihomed hosts
and underscores the need
for strict access controls and monitoring.
In practical terms, identifying and exploiting
segmentation bypassing, VLAN hopping
and multihomed hosts
involves a combination of network scanning,
traffic analysis, and exploiting known vulnerabilities.
Tools such as Nmap can help map the network
and identify potential points of exploitation
while manual analysis and testing
can help uncover
the specific weaknesses and misconfigurations.
So remember, segmentation bypassing, VLAN hopping,
and multihomed hosts are critical concepts
in network security and pen testing.
Segmentation bypassing involves finding ways
to move laterally within a network,
despite segmentation controls.
VLAN hopping exploits vulnerabilities,
and VLAN configurations to access different network segments
and multihomed hosts have multiple network interfaces
that can connect to different networks
posing potential security risks.