-1

I'm a junior penetration tester and recently went into the client's office in order to test an internal server of theirs.

They gave me their laptop with Windows installed that is connected to the AD domain and the laptop had VirtualBox installed so I could use a Kali machine for testing.

I wanted a direct connection between me and the server so I set up the machine to be on a bridged connection. Unfortunately, what happened next wasted most of my day:

  1. It seems that the laptop (Windows machine) was no longer connected to any network adapter.

  2. The laptop was blocked by the secure connector (ForeScout) but I asked the guy in charge to release the laptop.

  3. After releasing the blocked laptop, the problem persisted and I didn't have any connection to the network.

Unfortunately, the client is the type of client that has a lot of money to spend on technologies but not so much on how to properly troubleshoot them.

My questions:

From your experience, what could be the issue?

I think it might be a layer 2 problem (the switch might have blocked the network port) but I think that would be weird because the Kali machine would have a different MAC address and a different IP address. Could it be that the switch detects 2 IP/MAC addresses coming from the same port?

Any recommendation on what would be the best procedure in these cases?

(sadly, VPN connections are not an option for this client)

Improve this question
2
  • Your question is not about information security, but rather on how to configure a virtual machine correctly. As such, I voted to migrate the question to Super User.
    – MechMK1
    Commented Jun 21, 2019 at 9:32
  • You might be right but the issue here involves security mechanisms that the client has in his environment, I want to know why I was blocked.
    – Maxim
    Commented Jun 21, 2019 at 9:34

1 Answer 1

Reset to default
0

Could it be that the switch detects 2 IP/MAC addresses coming from the same port?

Yes, this is commonly done in corporate settings to stop users from plugging in a switch, causing all sorts of problems.

This is of course purely a guess, as any other answer will have to be. I imagine physical network security should be in scope for a penetration test. If it was my network, I would certainly like to include it.

Improve this answer
2
  • The problem with broadening the scope is that it either increases the time it takes to complete the test (and thus increases the cost) or it takes away time from other things (thus reducing quality for those aspects).
    – MechMK1
    Commented Jun 21, 2019 at 12:29
  • This does answer my question but I certainly agree with MechMK1, ideally, I would've liked to check every part in an enterprise's environment but sadly, I get a very limited time frame to finish it.
    – user1053613
    Commented Jun 23, 2019 at 12:30

You must log in to answer this question.