radouane

Networking

VLAN Hopping Attack: EVE-NG Lab

VLAN Hopping attack. How to escape your VLAN and get into any other VLAN in the network.

Published 2 min read
EVE-NG lab topology: a Linux attacker (10.10.0.1, VLAN 1) on switch R15 and a Windows target (10.10.10.1, VLAN 10) on switch R16, joined by an 802.1Q trunk with native VLAN 1, above the Scapy sendp command used for the attack

There are a lot of network attacks, but here’s a fun one.

What is VLAN hopping?

In brief, it’s the act of escaping from your VLAN to access another VLAN that you shouldn’t be allowed into.

Does it always work?

No, because it depends on the switch model and vendor. But it’s a good attack for every network engineer to simulate, to learn how it works.

I used the following image:

i86bi_linux_l2-ipbasek9-ms.may8-2013-team_track.bin

What you should know about this attack

For the attacker to escape from their VLAN to another VLAN, the attacker MUST be in the native VLAN.

The attack is very simple:

  1. The attacker prepares a frame with two 802.1Q (dot1q) tags. The first (outer) tag is the attacker’s own VLAN, which also needs to be the native VLAN on the trunk link.
  2. The second (inner) tag is the VLAN our target belongs to. The order is important.
  3. The attacker sends the frame.

Here’s what happens next.

The first switch, the one the attacker is connected to, receives the frame and removes the first tag, because it matches the native VLAN. And as we all know, native VLAN traffic is sent untagged.

Open full-size image: Two Wireshark captures of the same ICMP echo request from 10.10.0.1 to 10.10.10.1. Before the first switch (left) the frame carries two 802.1Q tags, VLAN 1 outer and VLAN 10 inner; after it (right) only the VLAN 10 tag is left
VLAN hopping in Wireshark

Not all switches behave like this, but most do. They “play it smart” and remove the tag since it’s just the native VLAN, but they don’t check whether there’s another tag underneath. That’s why the order of the tags matters.

The second switch receives the frame with only one 802.1Q tag left, the inner tag the first switch never looked at, so it simply forwards the frame into the VLAN in that tag.

And that’s the VLAN hopping attack: very simple and fun.

Here’s the command I used:

sendp(Ether(dst='50:00:00:11:00:00', src='50:00:00:0e:00:00')/Dot1Q(vlan=1)/Dot1Q(vlan=10)/IP(dst='10.10.10.1', src='10.10.0.1')/ICMP(), iface='eth0')

You must have Scapy installed.