Question

During an internal network penetration test, you are connected to a switch port on the native VLAN (VLAN 1). Your goal is to send traffic to a workstation on VLAN 20, which is normally segmented from your VLAN. You confirm the switch uses 802.1Q trunking and has not disabled dynamic trunking or changed the native VLAN. Which technique will allow you to forward crafted frames into VLAN 20 from your access port?

Accepted Answer

Double-tagging: craft frames with an outer 802.1Q tag matching the native VLAN and an inner tag for VLAN 20

Answer

Send a gratuitous ARP reply advertising your MAC as the VLAN 20 gateway

Answer

Flood the CAM table with random MAC addresses until the switch fails open

Answer

Perform a DHCP starvation attack to exhaust the VLAN 20 address pool