/infrastructure

name: infrastructure
description: Network infrastructure testing - port scanning, DNS attacks, MITM, VLAN hopping, IPv6, SMB/NetBIOS, sniffing, and DoS assessment.

Infrastructure

Test network infrastructure for vulnerabilities including network services, protocols, and perimeter security.

Techniques

| Type | Key Vectors | |------|-------------| | **Port Scanning** | SYN scan, UDP scan, service detection, OS fingerprinting | | **DNS** | Zone transfers, cache poisoning, subdomain takeover, DNS rebinding | | **MITM** | ARP spoofing, DNS spoofing, SSL stripping, LLMNR/NBT-NS poisoning | | **VLAN Hopping** | Switch spoofing, double tagging | | **IPv6** | RA flooding, neighbor spoofing, tunneling attacks | | **SMB/NetBIOS** | Null sessions, relay attacks, enumeration | | **Sniffing** | Packet capture, credential harvesting, protocol analysis | | **DoS** | Resource exhaustion, amplification, application-layer | | **ICS/SCADA** | Modbus TCP, PLC exploitation, coil/register manipulation, session hijacking | | **Space / CCSDS** | Satellite telecommand framing (Space Packet + TC Transfer Frame), APID/SCID/VCID routing, VCFC sequencing, CRC-16/CCITT, ASCII `0x%02x:` command counters | | **UPnP / IoT / CPE** | rootDesc/SCPD enumeration, vendor SOAP info disclosure (`GetPassword`), command injection via vendor actions, cross-action auth-key reuse | | **Hardware / Embedded** | Logic captures (Saleae `.sal`), CAN/UART decoding, side-channel password recovery, legacy CPU errata, i386 tools via docker |

Workflow

1. Network discovery and topology mapping 2. Port scanning and service enumeration 3. Protocol-specific vulnerability testing 4. Network attack execution (authorized scope only) 5. Evidence capture with packet captures and logs

Reference

**Quickstart guides** (per attack type):

• `reference/port-scanning-quickstart.md` - Port scanning and service discovery
• `reference/dns-quickstart.md` - DNS attacks and enumeration
• `reference/mitm-quickstart.md` - Man-in-the-middle attacks
• `reference/vlan-hopping-quickstart.md` - VLAN hopping techniques
• `reference/ipv6-quickstart.md` - IPv6 attack vectors
• `reference/smb-netbios-quickstart.md` - SMB/NetBIOS exploitation
• `reference/sniffing-quickstart.md` - Network sniffing and capture
• `reference/dos-quickstart.md` - DoS assessment
• `reference/ics-modbus-quickstart.md` - ICS/SCADA Modbus PLC exploitation
• `reference/ccsds-space-telecommand-quickstart.md` - Satellite CCSDS telecommand frame crafting (Space Packet + TC Transfer Frame)
• `reference/upnp-iot-quickstart.md` - UPnP / IoT / CPE firmware web UI enumeration and exploitation
• `reference/hardware-embedded-quickstart.md` - Logic captures, CAN/UART decoding, side-channel char-by-char recovery, legacy CPU bugs (6502), i386 tooling on ARM macOS

**Scan techniques**: `reference/syn-scan.md`, `reference/udp-scan.md`, `reference/icmp-scan.md`, `reference/os-fingerprint.md` **Other**: `reference/firewall-detection.md`, `reference/service-enum.md`, `reference/ip-reputation.md`, `reference/overview.md`