Hi Frank,
If you've got separate VLAN's for voice and data, then all you would
need to do is to hop on to the Voice VLAN using 802.1q tagging. This
would mean that you would have to send a DHCP request packet tagged with
the voice VLAN.
In Linux, the process is fairly straightforward. You will need to
enable 802.1q VLAN Tagging in your kernel (build it in or have it as a
module - your choice)
You would then have to add an interface which would send and receive
packets with a VLAN Tag of your choice. You can use the "vconfig"
utility (On Debian it is the "vlan" package) to do this. After that,
it's simply a matter of running your DHCP client for the new interface.
In Windows, you will need a NIC with a driver that supports 802.1q. I
have an Intel PRO/100VE and there are drivers which allow you to add
VLAN's to the NIC. You can get the drivers here:
http://support.intel.com/support/network/sb/cs-006103.htm
It's then a similar case of adding a new interface with the new VLAN ID
and configuring it using DHCP. I'm not sure if you will need to have a
specific MAC Address range that qualifies you for an IP from the DHCP
server; if you do, you can use "macshift" to change your Adapater IP on
Windows or "macchanger" on Linux.
Links you may find useful:
http://www.candelatech.com/~greear/vlan/howto.html
http://wiki.ethereal.com/CaptureSetup/VLAN
http://support.intel.com/support/network/sb/CS-005897.htm
http://devices.natetrue.com/macshift/
Hope this is helpful,
Regards,
Sheran Gunasekera
Frank Bussink wrote:
Hello,
I'm trying to do a pen-test on a Cisco IPT system.
Cisco IP telephone are connected on the same network cable as the PC, but
are working on another vlan.
The access switches have a configuration like :
switchport mode access
switchport access vlan 123
switchport voice vlan 124
I think the negotation with the access switch is done by CDP but I'm not
sure.
Does anyone have a tool that emulates the PC as a voice device in order
to receive a dhcp lease on vlan 124, so I can start to inject ARP MITM
with Cain for example ?
Kind regards
Frank
_________________________________________________________________
Express yourself instantly with MSN Messenger! Download today it's FREE!
http://messenger.msn.click-url.com/go/onm00200471ave/direct/01/
------------------------------------------------------------------------------
This List Sponsored by: Cenzic
Concerned about Web Application Security? Why not go with the #1
solution - Cenzic, the only one to win the Analyst's Choice Award from
eWeek. As attacks through web applications continue to rise, you need to
proactively protect your applications from hackers. Cenzic has the most
comprehensive solutions to meet your application security penetration
testing and vulnerability management needs. You have an option to go
with a managed service (Cenzic ClickToSecure) or an enterprise software
(Cenzic Hailstorm). Download FREE whitepaper on how a managed service
can help you: http://www.cenzic.com/news_events/wpappsec.php And, now
for a limited time we can do a FREE audit for you to confirm your
results from other product. Contact us at request@cenzic.com for details.
------------------------------------------------------------------------------
------------------------------------------------------------------------------
This List Sponsored by: Cenzic
Concerned about Web Application Security?
Why not go with the #1 solution - Cenzic, the only one to win the Analyst's
Choice Award from eWeek. As attacks through web applications continue to rise,
you need to proactively protect your applications from hackers. Cenzic has the
most comprehensive solutions to meet your application security penetration
testing and vulnerability management needs. You have an option to go with a
managed service (Cenzic ClickToSecure) or an enterprise software
(Cenzic Hailstorm). Download FREE whitepaper on how a managed service can
help you: http://www.cenzic.com/news_events/wpappsec.php
And, now for a limited time we can do a FREE audit for you to confirm your
results from other product. Contact us at request@cenzic.com for details.
------------------------------------------------------------------------------
