Authorized Network Pentesting: VLAN Hopping, AD Kerberoasting & SMB Lateral Movement
Running live offensive tooling (Impacket, Responder, CrackMapExec, or aggressive Nmap stealth scans) during internal pentests and purple-team audits risks locking out Active Directory accounts, tripping endpoint EDR quarantines, or flooding SOC queues.
The Problem It Solves
When network technicians and security engineers run authorized internal penetration tests or PCI-DSS segmentation audits, executing live exploitation tools on production subnets carries real operational risk: repeated Kerberos or SMB probes lock out domain service accounts, EDR agents isolate jump hosts mid-engagement, and broad port scans bury the SOC in background noise.
Writing custom Layer 2–7 packet reproducers by hand in Python Scapy is equally painful: encoding IEEE 802.1ad double-tagged VLAN-hopping frames, ASN.1 DER Kerberos TGS-REQ (etype 23 RC4) structures, stateful LDAPv3 BER search filters, and UTF-16LE SMB2 \\ADMIN$ tree-connects normally takes hundreds of lines of error-prone byte manipulation and root raw-socket access.
Purple-Team Active Directory Lateral Movement & Segmentation Audit
During a quarterly purple-team assessment, a network security technician needs to prove whether an attacker on User VLAN 10 (10.20.5.101) can bypass trunk segmentation or evade NDR sensors when targeting Server VLAN 20 (10.20.1.0/24). Using FrameAssembly, the technician builds a surgical 15-packet capture testing four attack vectors: (1) an 802.1ad double-tagged VLAN-hopping frame (outer native VLAN 10, inner target VLAN 20); (2) a stealth TCP Xmas scan (FIN+PSH+URG) against RDP port 3389; (3) an RC4-HMAC (etype 23) Kerberoasting TGS-REQ for "mssqlsvc/sql01.corp.local" paired with stateful LDAP SPN enumeration on TCP 389; and (4) an SMB2 "\\10.20.1.50\ADMIN$" lateral-movement mount attempt answered with STATUS_ACCESS_DENIED (0xc0000022).
How to Customize This Capture
- Set jump_box, corp_dc, and file_srv to the test source and target segment IPs/MACs in your assessment scope.
- Customize the outer/inner qinq VLAN IDs, Kerberos realm/SPN, LDAP filter, or SMB UNC share path.
- Compile to .pcap and replay across segmentation trunks with tcpreplay or validate detections in Suricata and Zeek.
FrameAssembly (.fasm) Code Example
Compile & dissect packets in WebAssembly or open in PlaygroundBuilds a 15-packet multi-stage assessment capture covering 802.1ad VLAN-hopping, TCP Xmas stealth scanning, Kerberos RC4 TGS-REQ, stateful LDAP SPN enumeration, and SMB2 ADMIN$ lateral movement.
host jump_box { ip 10.20.5.101 mac 00:50:56:20:05:65 }host corp_dc { ip 10.20.1.10 mac 00:50:56:20:01:0a }host file_srv { ip 10.20.1.50 mac 00:50:56:20:01:32 }flow l2_vlan_hop_and_stealth_scan(box, srv) { // 1. 802.1ad double-tagged VLAN-hopping probe (outer VLAN 10 -> inner VLAN 20) box -> srv qinq 10 innervlan 20 icmp echorequest id 404 seq 1 payload "VLAN_HOP_AUDIT" wait 2ms // 2. Stealth TCP Xmas scan (FIN + PSH + URG) against RDP port 3389 box -> srv tcp fin psh urg srcport 59100 dstport 3389 win 1024 urgent 1 wait 5ms}flow ad_kerberoast_and_smb_lateral(box, dc, srv) { // 3. RC4-HMAC (etype 23) Kerberoast TGS-REQ + stateful LDAP SPN enumeration box -> dc kerberos tgsreq realm "CORP.LOCAL" cname "svc_audit" sname "mssqlsvc/sql01.corp.local" etype 23 wait 2ms box <- dc kerberos tgsrep realm "CORP.LOCAL" cname "svc_audit" sname "mssqlsvc/sql01.corp.local" etype 23 wait 2ms box -> dc tcp syn srcport 51389 dstport 389 win 64240 mss 1460 wait 1ms box <- dc tcp syn ack win 64240 mss 1460 wait 1ms box -> dc tcp ack wait 1ms box -> dc ldap searchreq msgid 2 basedn "dc=corp,dc=local" filter "(servicePrincipalName=*)" wait 2ms box <- dc ldap searchdone msgid 2 resultcode 0 wait 2ms // 4. SMB2 lateral-movement probe to ADMIN$ share on TCP 445 box -> srv tcp syn srcport 51445 dstport 445 win 64240 mss 1460 wait 1ms box <- srv tcp syn ack win 64240 mss 1460 wait 1ms box -> srv tcp ack wait 1ms box -> srv smb negotiate msgid 0 wait 1ms box -> srv smb treeconnect msgid 1 sessionid 0x0001000000000001 share "\\\\10.20.1.50\\ADMIN$" wait 2ms box <- srv smb treeconnect msgid 1 sessionid 0x0001000000000001 treeid 1 status 0xc0000022 wait 1ms}compile { l2_vlan_hop_and_stealth_scan(jump_box, file_srv) ad_kerberoast_and_smb_lateral(jump_box, corp_dc, file_srv)}# 1. Preview all 15 frames (QinQ, Xmas TCP, Kerberos, LDAP, SMB2) in terminal
frameassembly show pentest_lateral_audit.fasm
# 2. Compile to .pcap and inspect Kerberos SPN, LDAP filter, and SMB2 share in tshark
frameassembly pentest_lateral_audit.fasm pentest_lateral_audit.pcap
tshark -r pentest_lateral_audit.pcap
# 3. Validate NDR / IDS detections offline or replay onto an isolated test SPAN port
suricata -r pentest_lateral_audit.pcap -k none -l ./suricata_pentest/
zeek -C -r pentest_lateral_audit.pcapHow a Network Technician Benefits from Using FrameAssembly
Practical operational advantages during maintenance windows, alert validation, and security audits.
Zero AD Lockouts or Endpoint Disruption
Replay exact Kerberoasting, LDAP SPN discovery, and SMB2 ADMIN$ wire structures across firewall interfaces and NDR SPAN ports without authenticating against live Domain Controllers.
L2–L7 Protocol Framing Without Byte Math
Natively encodes 802.1ad double VLAN tags, anomalous TCP flag combinations (FIN+PSH+URG), ASN.1 DER/BER Kerberos and LDAP payloads, and 64-byte SMB2 headers in plain readable lines.
Pinpoint SOC & NDR Detection Gaps
Because the capture has zero background chatter and deterministic millisecond timestamps, blue-team analysts can correlate every Suricata, Zeek, or SIEM alert to the exact line of .fasm code.
Actionable Remediation Reproducers
Hand network technicians the exact .fasm script from the pentest finding so they can harden switch native-VLAN trunks or East-West ACLs and re-verify the fix in minutes.
Automate pentest_lateral_audit.fasm locally with the CLI & VS Code Extension
Commit .fasm files to Git, get live diagnostics, 1-click Quick Fixes, and Packet Ladder previews in VS Code, and compile .pcap captures in milliseconds.