Attacking Layer-2 DTP with Yersinia
Channel: Gr@ve_Rose
Date: 2020-03-26

Skip to 5:04 if you already know about VLANs. Make sure to click on "Show More" for errata of the video.

A somewhat long-ish video explaining what VLANs are and how to attack them. 



A few notes:
- I ran "ip link set up eth0" but should've used "eth0.20". 
- VLANs are like Layer-2 rooms. Think of them as Layer-3 subnets for Ethernet. :)
- You can't attack Layer-2 remotely; You'll need to be on-site or have an already established internal connection (like a pwned box).
- I did say that VLANs are on switches however I neglected to mention that they can (and do) exist on other devices such as firewalls, WLAN controllers, servers and more.
- A PVLAN is a way to further segment an existing VLAN so that only specific hosts can talk to others on the same network. Think client isolation but more configurable. I don't have a PVLAN-capable device so I couldn't demonstrate.



How to protect against this attack: Set your trunked switchports to not negotiate DTP with the command: "switchport nonegotiate". Keep in mind that this will prevent automatic DTP negotiation from happening even from trusted devices.


Twitter: https://twitter.com/Grave_Rose
Subreddit: https://www.reddit.com/r/tcpdump101/
Online PCap Builder: https://tcpdump101.com
Passive PCap Enumeration: https://bitbucket.org/Grave_Rose/grope/src/master/


Donations

PayPal: https://www.paypal.me/tcpdump101
BitCoin: 1AYBCHhoHc4SfgVuwAXZuhF1B4FWXajynG
Litecoin: LMGPbbUeHxewcBkNTCxSoRqmrF5LNcGfYT