N-VLAN-HOPLateral Movement

VLAN Hopping

Double-tagging / dynamic-trunk negotiation to send frames across VLAN boundaries — bypass network segmentation.

§ Where this technique fits

N-VLAN-HOP is catalogued under the Lateral Movement tactic of the offensive-security kill-chain. It appears in 1 approved dossier in the registry, typically at step 2 on average.

§ Dossiers chaining this technique

VLAN hopping → cross into production
Discover that the access port negotiates trunking (DTP). Send double-tagged frames or set up a fake trunk to send packets into restricted VLANs.
step 2 / 5

§ What commonly comes next

01
Internal Nmap Sweep
N-NMAP-INTERNAL · Discovery
seen 1×

§ Where this technique fits

§ Dossiers chaining this technique

VLAN hopping → cross into production

§ What commonly comes next