During a network penetration test, a tester performs a VLAN hopping attack using double tagging. What is the PREREQUISITE condition that makes double-tag VLAN hopping possible?

Question

Accepted Answer

B. The attacker's port must be on the same native VLAN as the trunk port's native VLAN. Double-tag VLAN hopping works by embedding two VLAN tags in a frame. The first tag matches the native VLAN of the trunk, which the first switch strips; the second tag is for the target VLAN, which the second switch forwards to. This attack only works when the attacker's access port is on the same native VLAN as the trunk port's native VLAN, which is a common misconfiguration when native VLANs are not explicitly changed from the default (VLAN 1).

During a network penetration test, a tester performs a VLAN hopping attack using double tagging. What is the PREREQUISITE condition that makes double-tag VLAN hopping possible?

Related Questions

Discussion