hacktricks/generic-methodologies-and-resources/pentesting-network/lateral-vlan-segmentation-bypass.md

# Lateral VLAN Segmentation Bypass

{% hint style="success" %}
Learn & practice AWS Hacking:<img src="/.gitbook/assets/arte.png" alt="" data-size="line">[**HackTricks Training AWS Red Team Expert (ARTE)**](https://training.hacktricks.xyz/courses/arte)<img src="/.gitbook/assets/arte.png" alt="" data-size="line">\
Learn & practice GCP Hacking: <img src="/.gitbook/assets/grte.png" alt="" data-size="line">[**HackTricks Training GCP Red Team Expert (GRTE)**<img src="/.gitbook/assets/grte.png" alt="" data-size="line">](https://training.hacktricks.xyz/courses/grte)

<details>

<summary>Support HackTricks</summary>

* Check the [**subscription plans**](https://github.com/sponsors/carlospolop)!
* **Join the** 💬 [**Discord group**](https://discord.gg/hRep4RUj7f) or the [**telegram group**](https://t.me/peass) or **follow** us on **Twitter** 🐦 [**@hacktricks\_live**](https://twitter.com/hacktricks\_live)**.**
* **Share hacking tricks by submitting PRs to the** [**HackTricks**](https://github.com/carlospolop/hacktricks) and [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) github repos.

</details>
{% endhint %}

Ikiwa ufikiaji wa moja kwa moja kwa swichi upo, ugawaji wa VLAN unaweza kupuuziliwa mbali. Hii inahusisha kubadilisha mipangilio ya bandari iliyounganishwa kuwa hali ya trunk, kuanzisha interfaces za virtual kwa VLAN zinazolengwa, na kuweka anwani za IP, ama kwa njia ya kidinamik (DHCP) au kwa njia ya statiki, kulingana na hali (**kwa maelezo zaidi angalia [https://medium.com/@in9uz/cisco-nightmare-pentesting-cisco-networks-like-a-devil-f4032eb437b9](https://medium.com/@in9uz/cisco-nightmare-pentesting-cisco-networks-like-a-devil-f4032eb437b9)).**

Kwanza, utambulisho wa bandari maalum iliyounganishwa unahitajika. Hii kwa kawaida inaweza kufanywa kupitia ujumbe wa CDP, au kwa kutafuta bandari kupitia **include** mask.

**Ikiwa CDP haifanyi kazi, utambulisho wa bandari unaweza kujaribiwa kwa kutafuta anwani ya MAC**:
```
SW1(config)# show mac address-table | include 0050.0000.0500
```
Kabla ya kubadilisha kuwa hali ya trunk, orodha ya VLAN zilizopo inapaswa kuandaliwa, na vitambulisho vyao kubainishwa. Vitambulisho hivi kisha vinapewa kiunganishi, na kuwezesha ufikiaji wa VLAN mbalimbali kupitia trunk. Bandari inayotumika, kwa mfano, inahusishwa na VLAN 10.
```
SW1# show vlan brief
```
**Kuhamia katika hali ya trunk kunahusisha kuingia katika hali ya usanidi wa kiunganishi**:
```
SW1(config)# interface GigabitEthernet 0/2
SW1(config-if)# switchport trunk encapsulation dot1q
SW1(config-if)# switchport mode trunk
```
Kuhamia kwenye hali ya trunk kutasababisha usumbufu wa muda katika muunganisho, lakini hii inaweza kurejeshwa baadaye.

Mikondo ya virtual kisha inaundwa, inatolewa ID za VLAN, na inactivated:
```bash
sudo vconfig add eth0 10
sudo vconfig add eth0 20
sudo vconfig add eth0 50
sudo vconfig add eth0 60
sudo ifconfig eth0.10 up
sudo ifconfig eth0.20 up
sudo ifconfig eth0.50 up
sudo ifconfig eth0.60 up
```
Kisha, ombi la anwani linafanywa kupitia DHCP. Vinginevyo, katika hali ambapo DHCP haiwezekani, anwani zinaweza kuwekwa kwa mikono:
```bash
sudo dhclient -v eth0.10
sudo dhclient -v eth0.20
sudo dhclient -v eth0.50
sudo dhclient -v eth0.60
```
Mfano wa kuweka anwani ya IP ya kudumu kwenye kiunganishi (VLAN 10):
```bash
sudo ifconfig eth0.10 10.10.10.66 netmask 255.255.255.0
```
Connectivity inajaribiwa kwa kuanzisha maombi ya ICMP kwa milango ya default ya VLANs 10, 20, 50, na 60.

Hatimaye, mchakato huu unaruhusu kupita kwa segmentation ya VLAN, hivyo kuwezesha ufikiaji usio na kikomo kwa mtandao wowote wa VLAN, na kuweka msingi wa hatua zinazofuata.

## References

* [https://medium.com/@in9uz/cisco-nightmare-pentesting-cisco-networks-like-a-devil-f4032eb437b9](https://medium.com/@in9uz/cisco-nightmare-pentesting-cisco-networks-like-a-devil-f4032eb437b9)

{% hint style="success" %}
Learn & practice AWS Hacking:<img src="/.gitbook/assets/arte.png" alt="" data-size="line">[**HackTricks Training AWS Red Team Expert (ARTE)**](https://training.hacktricks.xyz/courses/arte)<img src="/.gitbook/assets/arte.png" alt="" data-size="line">\
Learn & practice GCP Hacking: <img src="/.gitbook/assets/grte.png" alt="" data-size="line">[**HackTricks Training GCP Red Team Expert (GRTE)**<img src="/.gitbook/assets/grte.png" alt="" data-size="line">](https://training.hacktricks.xyz/courses/grte)

<details>

<summary>Support HackTricks</summary>

* Check the [**subscription plans**](https://github.com/sponsors/carlospolop)!
* **Join the** 💬 [**Discord group**](https://discord.gg/hRep4RUj7f) or the [**telegram group**](https://t.me/peass) or **follow** us on **Twitter** 🐦 [**@hacktricks\_live**](https://twitter.com/hacktricks\_live)**.**
* **Share hacking tricks by submitting PRs to the** [**HackTricks**](https://github.com/carlospolop/hacktricks) and [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) github repos.

</details>
{% endhint %}