Advanced Infrastructure Penetration Testing

Private VLAN attacks

We saw in the previous sections that a VLAN divides a LAN into broadcast domains. Private VLANs (PVLAN) are also subdomains of VLANs, and there are isolated subdomains, such as sub-VLANs.

VLANs require a layer 3 device, such as a router, to communicate with each other, PVLANs also require routers to communicate, but the hosts are still in the same IP subnet. We have three PVLAN ports:

• Promiscuous (P): Connected to a router
• Isolated (I): Connected to hosts
• Community (C): Connected to other community ports

Attackers can attack PVLANs by sending frames with their IP and MAC addresses and the destination IP address: