Attacks and Exploits · Topic 1 of 10
Network Attacks
Recognise network attack categories: VLAN hopping, on-path attacks such as ARP and DNS spoofing, and service exploitation, with indicators and defences.
- 6 min
- VLAN hopping uses switch spoofing or double tagging, and both are prevented by correct port configuration.
- Disabling negotiation and avoiding the native VLAN for user traffic stops VLAN hopping.
- On-path attacks include ARP spoofing, DNS poisoning, rogue DHCP, LLMNR and NBT-NS poisoning, and evil twins.
What it is
Network attacks abuse how devices and protocols communicate. They target switching, name resolution, address assignment and the services that listen on the network.
This page covers three categories from the exam outline: virtual local area network (VLAN) hopping, on-path attacks and service exploitation. The aim is to recognise each attack, know the indicators and choose the right defence.
How it works
VLAN hopping
VLANs separate traffic on a switch. VLAN hopping is any technique that lets a device reach a VLAN it should not be in.
| Variant | Idea | Defence |
|---|---|---|
| Switch spoofing | A device pretends to be a switch and negotiates a trunk link, using a dynamic negotiation protocol, so it receives all VLANs | Disable negotiation, and set access ports explicitly as access ports |
| Double tagging | A frame carries two VLAN tags, and the first switch removes the outer tag, so the frame lands in another VLAN | Do not use the native VLAN for user traffic, and tag the native VLAN on trunks |
Both attacks depend on weak switch port configuration. Additional good practice is to shut down unused ports and place them in an unused VLAN.
On-path attacks
An on-path attack (formerly called a man-in-the-middle attack) places the attacker between two parties so that traffic can be read or changed. The attacker needs a position on the path, often gained by tricking hosts about where to send traffic.
| Technique | How it misleads | Defence |
|---|---|---|
| Address Resolution Protocol (ARP) spoofing | False ARP replies link the attacker's hardware address to another host's address | Dynamic ARP inspection, port security, static entries for critical hosts |
| Domain Name System (DNS) spoofing or poisoning | False DNS answers send victims to the wrong address | DNS Security Extensions (DNSSEC), secure resolvers |
| Rogue Dynamic Host Configuration Protocol (DHCP) server | False address settings set the attacker as gateway or DNS server | DHCP snooping |
| Name resolution poisoning (Link-Local Multicast Name Resolution, LLMNR, and NetBIOS Name Service, NBT-NS) | A rogue host answers broadcast name requests, and victims send credentials to it | Disable LLMNR and NBT-NS |
| Evil twin access point | A fake wireless network with a trusted name | Wireless intrusion detection, certificate-based authentication |
| Secure Sockets Layer (SSL) stripping | Downgrade of a secure connection to cleartext | HTTP Strict Transport Security (HSTS) |
Once in position the attacker can read cleartext, capture credential hashes, or alter responses. Encryption with proper certificate validation limits the damage because the attacker cannot read or change the content without being noticed.
Typical indicators include duplicate or changing hardware addresses in the ARP table, unexpected DHCP servers, certificate warnings and repeated name resolution replies from one host.
Service exploitation
Service exploitation targets a weakness in software that listens on the network, such as a file sharing, remote access or web service. The cause is usually one of the following.
- A known vulnerability in an unpatched version.
- A default or weak credential.
- A dangerous configuration, such as an open management interface or anonymous access.
- An outdated protocol, such as Server Message Block version 1 (SMBv1) or Telnet.
The tester uses scan results to match a service version with a public vulnerability, then verifies the flaw in a controlled way. A well known example of a wormable flaw was a vulnerability in SMBv1, which shows why patching and disabling old protocols matters.
Related network attacks that the exam may mention include denial of service (DoS), which makes a service unavailable, and replay attacks, which resend captured valid traffic. Stress tests and DoS are normally excluded in the rules of engagement unless explicitly agreed.
Certificate services attacks
Active Directory Certificate Services (AD CS) issues certificates in a Windows domain. A misconfiguration, such as an over-permissive certificate template or enrolment right, can let a low-privileged user obtain a certificate that proves a higher-privileged identity.
The defence is to harden templates, restrict who may enrol, and review the certificate authority configuration.
Tools for network attacks
Know the one-line purpose of each named tool.
| Tool | Purpose |
|---|---|
| Metasploit Framework | Organises exploit, auxiliary, payload and post modules, and helps validate a finding in a controlled way |
| msfvenom | The Metasploit payload generator, which builds payloads in chosen formats and encodings |
| Impacket | A Python library and scripts for Windows network protocols such as SMB and Kerberos, used in Active Directory testing |
| Responder | Poisons broadcast name-resolution requests (LLMNR and NBT-NS) and captures the hashes that victims send |
Defences in summary
| Weakness | Control |
|---|---|
| Open switch ports | Port security, disable unused ports, fixed port modes |
| Cleartext protocols | Use encrypted protocols such as Secure Shell (SSH) and Transport Layer Security (TLS) |
| Broadcast name resolution | Disable LLMNR and NBT-NS |
| Unpatched services | Patch management and vulnerability scanning |
| Flat network | Segmentation and host firewalls |
| Weak monitoring | Intrusion detection and logging of unusual ARP, DHCP and DNS behaviour |
When a question describes a host answering broadcast name requests and collecting credentials, think LLMNR or NBT-NS poisoning, and the fix is to disable those protocols.
What to remember for the exam
- VLAN hopping uses switch spoofing or double tagging, and both are prevented by correct port configuration.
- Disabling negotiation and avoiding the native VLAN for user traffic stops VLAN hopping.
- On-path attacks include ARP spoofing, DNS poisoning, rogue DHCP, LLMNR and NBT-NS poisoning, and evil twins.
- Dynamic ARP inspection and DHCP snooping are switch features that counter ARP and DHCP attacks.
- Encryption with certificate validation reduces the value of an on-path position.
- Service exploitation usually comes from unpatched software, default credentials or insecure configuration.
- Disable legacy protocols such as SMBv1 and Telnet.
- DoS testing needs explicit approval.
Common mistakes
Calling ARP spoofing a remote attack. It works only on the same local network segment.
Thinking VLANs are a security boundary on their own. They help, but weak switch settings can bypass them.
Assuming encryption stops all on-path attacks. It does when certificates are validated, but users who click through warnings undo the protection.
Treating a vulnerable service as proven exploitable. The scan result is a hypothesis, and testing must confirm it safely.
Ignoring name resolution settings. Default Windows broadcast name resolution is a common source of captured credentials.
Check yourself
Which switch feature counters ARP spoofing?
Dynamic ARP inspection.
What is the main control against double-tagging VLAN hopping?
Do not use the native VLAN for user traffic, and tag or change the native VLAN on trunks.
What was the older name for an on-path attack?
A man-in-the-middle attack.
Topic 1 of 10 in Attacks and Exploits
Test yourself on Attacks and Exploits
The full CompTIA PenTest+ PT0-003 question bank has 653 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by CompTIA. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.