Advanced Infrastructure Penetration Testing

Disguised LSA

This attack exploits a condition in RFC 2328 to check whether two instances of LSA are identical based on three criteria: the sequence number, the checksum value, and the age. So, an attacker can advertise a fake LSA using these fields, but in the next valid instance, because the router will consider the LSA as a duplicated one, it will ignore it.

To perform a disguised LSA attack, follow these steps:

1. The attacker sends a spoofed LSA
2. The attacker sends a disguised LSA with the same three fields discussed before
3. Router 1 sends a fight-back LSA and they will be received by router 2, but it won't update the LSA database, whereas the received LSA is the same.
4. Router 2 triggers another fight back