Re: IP Telephony pen-test and VLAN's

[Sheran Gunasekera <sheran () scanit net>]

Hi Frank,

If you've got separate VLAN's for voice and data, then all you would
need to do is to hop on to the Voice VLAN using 802.1q tagging.  This
would mean that you would have to send a DHCP request packet tagged with
the voice VLAN.

In Linux, the process is fairly straightforward.  You will need to
enable 802.1q VLAN Tagging in your kernel (build it in or have it as a
module - your choice)

You would then have to add an interface which would send and receive
packets with a VLAN Tag of your choice.  You can use the "vconfig"
utility (On Debian it is the "vlan" package) to do this.  After that,
it's simply a matter of running your DHCP client for the new interface.

In Windows, you will need a NIC with a driver that supports 802.1q.  I
have an Intel PRO/100VE and there are drivers which allow you to add
VLAN's to the NIC.  You can get the drivers here:
http://support.intel.com/support/network/sb/cs-006103.htm

It's then a similar case of adding a new interface with the new VLAN ID
and configuring it using DHCP.  I'm not sure if you will need to have a
specific MAC Address range that qualifies you for an IP from the DHCP
server; if you do, you can use "macshift" to change your Adapater IP on
Windows or "macchanger" on Linux.

Links you may find useful:

http://www.candelatech.com/~greear/vlan/howto.html
http://wiki.ethereal.com/CaptureSetup/VLAN
http://support.intel.com/support/network/sb/CS-005897.htm
http://devices.natetrue.com/macshift/

Hope this is helpful,
Regards,

Sheran Gunasekera



Frank Bussink wrote:
> Hello,
>
> I'm trying to do a pen-test on a Cisco IPT system.
>
> Cisco IP telephone are connected on the same network cable as the PC, but
> are working on another vlan.
> The access switches have a configuration like :
> switchport mode access
> switchport access vlan 123
> switchport voice vlan 124
>
> I think the negotation with the access switch is done by CDP but I'm not
> sure.
>
> Does anyone have a tool that emulates the PC as a voice device in order
> to receive a dhcp lease on vlan 124, so I can start to inject ARP MITM
> with Cain for example ?
>
> Kind regards
> Frank
>
> _________________________________________________________________
> Express yourself instantly with MSN Messenger! Download today it's FREE!
> http://messenger.msn.click-url.com/go/onm00200471ave/direct/01/
>
>
> ------------------------------------------------------------------------------
>
> This List Sponsored by: Cenzic
>
> Concerned about Web Application Security? Why not go with the #1
> solution - Cenzic, the only one to win the Analyst's Choice Award from
> eWeek. As attacks through web applications continue to rise, you need to
> proactively protect your applications from hackers. Cenzic has the most
> comprehensive solutions to meet your application security penetration
> testing and vulnerability management needs. You have an option to go
> with a managed service (Cenzic ClickToSecure) or an enterprise software
> (Cenzic Hailstorm). Download FREE whitepaper on how a managed service
> can help you: http://www.cenzic.com/news_events/wpappsec.php And, now
> for a limited time we can do a FREE audit for you to confirm your
> results from other product. Contact us at request () cenzic com for details.
> ------------------------------------------------------------------------------


------------------------------------------------------------------------------
This List Sponsored by: Cenzic

Concerned about Web Application Security? 
Why not go with the #1 solution - Cenzic, the only one to win the Analyst's 
Choice Award from eWeek. As attacks through web applications continue to rise, 
you need to proactively protect your applications from hackers. Cenzic has the 
most comprehensive solutions to meet your application security penetration 
testing and vulnerability management needs. You have an option to go with a 
managed service (Cenzic ClickToSecure) or an enterprise software 
(Cenzic Hailstorm). Download FREE whitepaper on how a managed service can 
help you: http://www.cenzic.com/news_events/wpappsec.php 
And, now for a limited time we can do a FREE audit for you to confirm your 
results from other product. Contact us at request () cenzic com for details.
------------------------------------------------------------------------------