I'm a junior penetration tester and recently went into the client's office in order to test an internal server of theirs.

They gave me their laptop with Windows installed that is connected to the AD domain and the laptop had VirtualBox installed so I could use a Kali machine for testing.

I wanted a direct connection between me and the server so I set up the machine to be on a bridged connection. Unfortunately, what happened next wasted most of my day:

  1. It seems that the laptop (Windows machine) was no longer connected to any network adapter.

  2. The laptop was blocked by the secure connector (ForeScout) but I asked the guy in charge to release the laptop.

  3. After releasing the blocked laptop, the problem persisted and I didn't have any connection to the network.

Unfortunately, the client is the type of client that has a lot of money to spend on technologies but not so much on how to properly troubleshoot them.

My questions:

From your experience, what could be the issue?

I think it might be a layer 2 problem (the switch might have blocked the network port) but I think that would be weird because the Kali machine would have a different MAC address and a different IP address. Could it be that the switch detects 2 IP/MAC addresses coming from the same port?

Any recommendation on what would be the best procedure in these cases?

(sadly, VPN connections are not an option for this client)

migrated from security.stackexchange.com Jun 21 at 11:41

This question came from our site for information security professionals.

  • Your question is not about information security, but rather on how to configure a virtual machine correctly. As such, I voted to migrate the question to Super User. – MechMK1 Jun 21 at 9:32
  • You might be right but the issue here involves security mechanisms that the client has in his environment, I want to know why I was blocked. – Maxim Jun 21 at 9:34

Could it be that the switch detects 2 IP/MAC addresses coming from the same port?

Yes, this is commonly done in corporate settings to stop users from plugging in a switch, causing all sorts of problems.

This is of course purely a guess, as any other answer will have to be. I imagine physical network security should be in scope for a penetration test. If it was my network, I would certainly like to include it.

  • The problem with broadening the scope is that it either increases the time it takes to complete the test (and thus increases the cost) or it takes away time from other things (thus reducing quality for those aspects). – MechMK1 Jun 21 at 12:29
  • This does answer my question but I certainly agree with MechMK1, ideally, I would've liked to check every part in an enterprise's environment but sadly, I get a very limited time frame to finish it. – L0wRider Jun 23 at 12:30

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.