VLAN hopping,
or virtual local area network hopping.
Now, a virtual local area network
or VLAN is used to partition a broadcast domain
and isolate it from the rest of the computer network
at the data link layer
or layer two of the OSI model.
VLANs are commonly used in intranets
and local area networks
to increase the security of the network
by creating segmentation between different portions
of the larger network.
This forces all of the traffic
to use layer three routing to move
between the different VLANs.
And this gives the network defenders a chance
to apply access control lists to the layer three switch
or router reports that are providing the segmentation
and filtering of the traffic between the two VLANs.
As a network penetration tester, if you gain access
to a user's workstation that's located in one VLAN,
you're going to need to learn how to break out of
that VLAN in order to gain access to other sensitive areas
of the network that you're going to want to access.
Things like the server VLAN
that houses all the critical business servers, for example.
This involves VLAN hopping.
Now, VLAN hopping is a technique
that exploits a misconfiguration to direct traffic
to a different VLAN without proper authorization.
VLAN hopping is usually accomplished using either double
tagging, switch spoofing or a MAC table overflow attack.
Double tagging is a method where the attacker tries
to reach a different VLAN using vulnerabilities in the
trunk port configuration as a form of VLAN hopping.
This can occur when the threat actor is connected
to an interface port on a switch using access mode
with the same VLAN
as the native untagged VLAN on that trunk.
Then whenever the attacker sends a frame on the network,
they instead send it with two 802.1q tags,
which is why we call this double tagging.
The inner tag is going to contain the true destination
that the attacker wants to reach while the outer tag is
going to contain the native VLAN.
The native VLAN is the one VLAN
that normally travels across the trunk port
without a VLAN tag by itself.
So when the switch receives the double tagged frame,
it's first going to remove that outer tag
that contains the native VLAN,
and then it's going to forward the frame to the VLAN
of the second tag, which had the inner tag with the location
that the attacker really wanted to get their traffic to.
The result of this double tagging attack is
that the attacker can now break out of the current VLAN,
in this case, the native VLAN,
and then migrate themselves into the destination VLAN
resulting in a successful VLAN hop.
Unfortunately though, for us as attackers,
this technique is really a one-way trip for those frames
that are being double tagged
because the destination is not going to double tag the return
data and send it back to us as attackers.
Instead, the return frames are sent to the initial tag.
Now, you may be wondering, "Why would an attacker
or a penetration tester want to use double tagging
to send data into a VLAN without being able
to receive any responses back?"
Well, usually this double tagging technique is going
to be used as part of a blind attack
or part of a denial of service or stress testing attack.
A blind attack is one where commands are set to the victim,
but the attacker, or in our case, a pen tester, doesn't get
to see any of the responses.
For example, if I knew that a machine in
that VLAN was vulnerable to a specific exploit
that could allow me to perform a remote code execution,
I could send the exploit into the VLAN using double tagging
with that payload that can then establish a beacon,
and that would call out to my command
and control server every morning at 3:00 AM for example.
Now when the beacon goes out
and connects to my server, this is going to be outside
of the local area network, and therefore
I can establish two-way communications with
that device from the internal network in that other VLAN out
to my server out in the internet and back again.
The other reason for using this type
of VLAN hopping is from when you don't necessarily need
to get a response back.
This is the case if you're doing a denialist service attack
or a stress test.
In a denialist service attack,
the attacker won't need to receive a response for any
of the data being forwarded into
that VLAN using the double tagging technique
because they're simply trying to flood that VLAN
with a bunch of data as part of their attack,
and they don't care about the response.
To prevent a double tagging attack from being successful,
cybersecurity professionals always need
to ensure they change the default configuration
of their native VLAN from VLAN ID One to something else.
And also, they should never add user devices into the native
VLAN inside of their network.
Now, the second method
of conducting a VLAN hopping attack is known
as switch spoofing.
Switch spoofing occurs when an attacker attempts
to use the dynamic trunking protocol
or DTP to negotiate a trunk port with a switch.
Normally, DTP negotiations are only performed
by the switch when initially connects to a trunk port.
Now, by default, trunk ports are set up
to support auto negotiation between two different switches.
This way they can share their VLAN information,
but if an attacker configures their attack workstation
to look like it's a switch, they can configure it
to be set up as dynamic auto
or dynamic desirable when they're in switch port mode.
Then when they connect to the trunk port,
it's going to automatically negotiate a trunking connection
just like a switch would.
Now, once that trunk is established
with the attacker's workstation by the switch,
that attacker workstation now has access to all the VLANs
inside of the network.
To prevent a switch spoofing attack from being used
during a VLAN hopping exploit,
cybersecurity professionals should always configure their
switch ports to have dynamic switch port modes
disabled by default.
This will ensure your switch doesn't support auto
negotiation by default,
and you can then prevent switch spoofing from allowing VLAN
hopping to occur in your network.
The final method of conducting VLAN hopping isn't as much
of a technique that allows VLAN hopping as it is one
that allows VLANs to no longer be enforced.
Do you remember how switches maintain a CAM table
that remembers all the MAC addresses that are being used
by the different switch ports?
Well switch manufacturers built in a backup method in case
those CAM tables became overloaded
or they couldn't be read at a given time.
If these cam tables become overloaded,
the switch will stop acting like a switch
and essentially it will fail open
and start to act like a hub.
Now, just in case you don't remember the difference
between a switch and a hub from your earlier network
studies, a switch uses intelligence
to only transmit frames out to the switch ports
that are involved in a given conversation.
A hub, on the other hand, doesn't have any intelligence,
and so it just repeats out every frame
it receives out every single port that's connected to it,
and it relies on the network clients on the other end
of those ports to ignore any frames
that aren't addressed to them.
So as a penetration tester, you can go ahead
and overload the cam table of the switch by flooding it
with MAC addresses, which will then cause the switch
to fail open and begin acting like a hub.
This will start sending out all the frames it receives out
on every port, including the port
that you have a packet sniffer hooked up to,
so you can read the traffic destined for other VLANs.