From Spoofing to Tunneling - New Red Team's Networking Techniques for Initial Access and Evasion

Explore advanced red team networking techniques that bypass traditional security measures through innovative approaches to initial access and evasion in this 38-minute Black Hat conference presentation. Learn how to leverage stateless tunnels like GRE and VxLAN for gaining intranet access without relying on phishing, exploiting public-facing applications, or using valid credentials. Discover how these techniques affect major companies including Cloudflare customers and other organizations that utilize these widely-adopted networking technologies. Master evasion strategies that exploit company intranets lacking proper source IP filtering, enabling confident execution of password spraying attacks within internal networks without risking compromised footholds. Understand critical VxLAN vulnerabilities in Linux Kernel and RouterOS that allow complete tunnel hijacking and intranet access, even when VxLAN is configured on private IP interfaces through encrypted tunnels. Examine how these default-enabled features create security nightmares for ISPs and other companies, with RouterOS users unable to disable the problematic functionality. Analyze attack vectors for exploiting hijacked tunnels and compromised routers through routing protocol manipulation, including BGP and OSPF attacks that can lead to internal IP hijacking and potential domain compromises. Review practical mitigation strategies that companies can implement to protect against these vulnerabilities, while gaining insights into scanning techniques and tools for accessing company intranets through these novel attack vectors.