VLAN Attacks

VLAN Hopping attack (Switch spoofing)

-Spoofing DTP Messages from the attacking host to cause the switch to enter trunking mode.

-Attacking device gains access to data on all VLANs carried by the negotiated trunk.

the attack steps:-

1. Attacker gains access to a switch port and sends DTP negotiation frames toward a switch with DTP running and auto negotiation turned on.
2. Attacker and switch negotiate trunking over the port.
3. Switch allows all VLANs to traverse the trunk link.
4. Attacker sends data to, or collects it from, all VLANs carried on that trunk.

The Mitigation:-

1. Turn off trunking on all ports, except the ones that specifically require trunking.
2. enable access on the access ports manually.
3. disable the DTP.

Double-Tagging VLAN Attack

-An important characteristic of the double encapsulated VLAN hopping attack is that it works even if trunk ports are disabled.

-the attacker must be in the native VLAN.

-one way attack. (can use to send malicious).

-this attack is unidirectional.

The Mitigation

Change the native VLAN and don’t put any device on the native VLAN.