skills.rest
xalgord
xalgordCOMMUNITY
Explore all skills by this author →
WebsiteGitHub

performing-vlan-hopping-attack

Tests VLAN segmentation using switch spoofing and double tagging attacks in authorized environments.

954|172|Updated Mar 13, 2026
Search Tags:#penetration testing#network security#scapy#802.1q#double tagging#dtp#vlan hopping
One-click install
npx skills add https://github.com/xalgord/xalgorix --skill performing-vlan-hopping-attack
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: performing-vlan-hopping-attack
Source: https://github.com/xalgord/xalgorix/tree/main/internal/tools/skills/data/network-security/performing-vlan-hopping-attack
Command: npx skills add https://github.com/xalgord/xalgorix --skill performing-vlan-hopping-attack

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill requires scapy.

What problem does it solve?

Network teams often assume VLAN segmentation isolates sensitive zones, but misconfigured switch ports (DTP enabled, default native VLAN) let attackers bypass that isolation at Layer 2. This Skill validates whether VLAN boundaries actually hold by simulating real VLAN hopping attacks under authorized testing conditions.

Core Features & Use Cases

  • DTP Switch Spoofing: Uses Yersinia and Scapy to negotiate a trunk port from an access port, gaining access to all VLANs when DTP is left enabled.
  • 802.1Q Double Tagging: Crafts double-tagged frames with Scapy to push traffic into a target VLAN when the native VLAN is misconfigured, with guidance on confirming delivery via packet capture since the attack is unidirectional.
  • VTP Attack Testing & Verification: Assesses VTP server-mode risks and verifies switch hardening via show interfaces switchport, native VLAN, and port security checks.
  • Use Case: During a PCI-DSS assessment, a tester connects to a corporate VLAN port, negotiates a trunk via DTP, reaches the cardholder data VLAN, and documents the segmentation failure with concrete remediation steps.

Quick Start

Test whether the switch port I am connected to is vulnerable to VLAN hopping using DTP spoofing and double tagging, then document the findings and remediation steps.

Frequently Asked Questions about performing-vlan-hopping-attack

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I perform a VLAN hopping attack with Yersinia?▼

Run `sudo yersinia dtp -attack 1 -interface eth0` to send DTP desirable frames that negotiate the access port into a trunk. If successful, create 802.1Q VLAN subinterfaces (e.g., eth0.10) and verify reachability to other VLAN gateways.

What is the difference between switch spoofing and double tagging?▼

Switch spoofing abuses DTP to turn an access port into a trunk, giving bidirectional access to all VLANs. Double tagging nests two 802.1Q tags so the switch strips the outer native-VLAN tag and forwards the inner tag, but it is unidirectional and only works when your access VLAN equals the trunk's native VLAN.

Why does double tagging get no ping reply?▼

Double tagging is unidirectional by design, so no ICMP reply returns to the attacker. Confirm delivery from the target VLAN side using a mirror or monitor port capture, for example `tshark -i ethX -Y "vlan.id == 20 && icmp"`.

When does a double tagging attack fail?▼

It fails when the trunk's native VLAN has been changed from the default VLAN 1, because the outer tag is no longer stripped. Confirm the native VLAN first and set the outer Dot1Q tag to match it, with the inner tag set to the target VLAN.

Is it safe to test VTP attacks on a production network?▼

No. A VTP summary advertisement with a higher revision number can rewrite or delete the VLAN database across the entire switching domain, causing widespread outages. Restrict VTP injection tests to isolated lab environments with explicit authorization.

How do I verify a switch is hardened against VLAN hopping?▼

Check `show interfaces switchport` for static access mode with negotiation off, confirm the native VLAN is an unused VLAN rather than VLAN 1, verify VTP is in transparent mode, and ensure unused ports are shut down with port security enabled.

Related Skills

Explore More Software Engineering Skills→
afoxnyc3afoxnyc3

switch-port-lookup

Resolve Meraki switch ports and generate structured reports of configuration and live status.

Community
Intermediate
wgpsecwgpsec
1.6k

report-generate

Generate structured penetration testing reports with CVSS risk ratings and remediation guidance.

Official
Intermediate
nonputtipongnonputtipong

protocol-reverse-engineering

Capture and analyze network traffic to document custom protocols.

Community
Advanced
jaskaranhundaljaskaranhundal
3

network-exposure

Analyze network exposure from scan data, firewall rules, and topology.

Community
Advanced