nerdexam
CompTIA

PT0-001 · Question #249

A penetration tester has gained physical access to a facility and connected directly into the internal network. The penetration tester now wants to pivot into the server VLAN. Which of the following…

The correct answer is D. Conducting an STP attack. Layer-2 protocol attacks can be used to influence network topology and gain access to otherwise segmented VLANs. An STP attack enables a tester to manipulate traffic flow at the switching level.

Post-exploitation and lateral movement

Question

A penetration tester has gained physical access to a facility and connected directly into the internal network. The penetration tester now wants to pivot into the server VLAN. Which of the following would accomplish this?

Options

  • ASpoofing a printer's MAC address
  • BAbusing DTP negotiation
  • CPerforming LLMNR poisoning
  • DConducting an STP attack

How the community answered

(22 responses)
  • A
    9% (2)
  • B
    5% (1)
  • C
    5% (1)
  • D
    82% (18)

Why each option

Layer-2 protocol attacks can be used to influence network topology and gain access to otherwise segmented VLANs. An STP attack enables a tester to manipulate traffic flow at the switching level.

ASpoofing a printer's MAC address

Spoofing a printer's MAC address impersonates a device on the same VLAN to bypass MAC filtering, but does not provide a mechanism to cross VLAN boundaries.

BAbusing DTP negotiation

Abusing DTP negotiation tricks a switch into forming a trunk link to access multiple VLANs (VLAN hopping), but it is not the answer identified as correct for this scenario.

CPerforming LLMNR poisoning

LLMNR poisoning intercepts name resolution broadcasts to capture credentials, and has no function in pivoting between network segments or VLANs.

DConducting an STP attackCorrect

An STP (Spanning Tree Protocol) attack involves injecting crafted BPDUs to claim root bridge status, forcing the network to reroute traffic through the attacker's system. This gives the tester visibility into and the ability to redirect traffic across VLAN boundaries, including the server VLAN. Because STP operates at layer-2 and trusts BPDU messages by default, this is an effective pivot technique on networks without BPDU Guard or Root Guard configured.

Concept tested: STP attack for layer-2 network pivoting

Source: https://www.cisco.com/c/en/us/support/docs/lan-switching/spanning-tree-protocol/10556-26.html

Topics

#VLAN hopping#network pivoting#STP attack#layer 2 attacks

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full PT0-001 Practice