11.1 On-Path, VLAN Hopping, Relay, and Multihomed Hosts

Domain 4, Attacks and Exploits, is 35 percent of CompTIA PenTest+ PT0-003. Objective 4.2 — Given a scenario, perform network attacks using the appropriate tools — is the first live-attack matching drill after 4.1 prioritization. You already ranked the target. Now you pick a network attack that fits the path, the protocol, and the authorization. This section covers four positioning attacks: on-path, VLAN hopping, relay, and multihomed hosts. Default credentials, misconfigured services, packet crafting, certificate services, and share-as-attack belong in the next section with the full tool table. Domain 4 is not Domain 3: a Nessus row is not an attack. It is also not Domain 5: finding a second NIC is not the same as pivoting through it.

On-path attacks: sit between the peers

An on-path attack is CompTIA's current name for what older material called man-in-the-middle. What it does: it places the tester between two legitimate peers so traffic can be observed or altered. The classic local-Ethernet method is ARP spoofing: you answer Address Resolution Protocol requests as if you were the default gateway or the peer, so frames that should go host-to-host land on your adapter. IPv6 neighbor-discovery spoofing is the same idea on a different Layer-2 protocol. When you pick it: you already share a broadcast domain with the victims and the rules of engagement (RoE) allow poisoning the local path. You do not pick on-path against a host that only exists across a routed firewall you cannot sit in front of.

TLS can fail the attack. If the application speaks HTTPS and clients validate certificates, your intercept presents a certificate the client does not trust. Users see a warning, or the handshake dies, and passwords never leave the browser. That is the control working. On-path against TLS is not automatically a credential steal unless the client ignores certificate errors or you otherwise break trust — a topic adjacent to certificate services in the next section. Exam trap: "ARP spoofing decrypts TLS by itself." It does not. Wireshark or tcpdump will show you are on the path; they will not magically yield plaintext HTTP from a validated TLS session.

On Windows LANs, the exam's favorite on-path-adjacent pattern is LLMNR / NBT-NS / mDNS poisoning. A client fails DNS, broadcasts a name query, and a tool in the Responder family answers. The client then authenticates to you as if you were the file server. You did not crack a hash and you did not yet relay. You became the named destination. That is why CompTIA lists Responder under 4.2 tools next to on-path and relay. Which tool family: Responder to become the name, Wireshark or tcpdump to prove you are on path, Impacket if the next move is relay. Not Hydra. Not msfvenom. Not hashcat.

Exam trap: poisoning is not cracking

A captured Net-NTLMv2 blob in Responder is evidence you were on path (or name-adjacent). Turning that blob into a password is 4.3 cracking with hashcat or John the Ripper. Forwarding the live authentication without cracking it is relay, still 4.2. Mixing those three items is how candidates miss an otherwise easy stem.

VLAN hopping: trunk abuse, not a user-port spell

VLAN hopping is reaching a virtual LAN you were not assigned by abusing how switches handle trunks. What it does: it lets frames from a tester port appear on a VLAN the access policy never granted. Two conceptual families appear on the exam.

Switch spoofing is pretending to be a switch and negotiating a trunk (historically Dynamic Trunking Protocol). If the access port is willing to become a trunk, you see tagged frames for VLANs the user port should never carry.

Double tagging is sending an 802.1Q-in-Q frame: an outer tag matching the native VLAN, an inner tag for the victim VLAN. The first switch strips the outer tag and forwards the inner tag into the trunk. You need a path that actually treats the native VLAN that way.

When you pick it: you are on a trunk-adjacent or misconfigured port — a port that trunks, that will negotiate a trunk, or that shares a native VLAN with a trunk. When you do not: a correctly configured access port in VLAN 20. Setting a laptop NIC's VLAN ID to 30 is not hopping. The switch strips or ignores the tag and keeps you in the assigned VLAN.

Exam trap: treating VLAN hopping as magic from any user jack. Trap two: treating hopping as the same thing as a dual-homed host. That host already has a second cable; hopping abuses tagging on a single path. Wireshark showing 802.1Q tags is evidence of a trunked path. Hydra against the switch enable password is a default-credential problem, not hopping. Packet crafting can build a double-tagged frame, but the attack type the stem is scoring is still VLAN hopping when the goal is "reach VLAN 30."

Relay attacks: forward live authentication

A relay attack takes an authentication that was aimed at you (or that you observed) and presents it to a different host, so that host treats you as the original client. The Windows exam pattern is NTLM relay when SMB or LDAP signing is not required. A workstation authenticates to the tester after name poisoning; the tester forwards that NTLM exchange to FILE01; FILE01 accepts it because it does not demand a signed session.

What it does: you borrow a live logon attempt. You do not need the password and you do not need a reusable stolen hash. When you pick it: you have a captured live authentication and a second in-scope host that will accept it without signing (or an equivalent binding such as LDAP without signing or channel binding). Which tool family: Impacket is the 4.2 Windows/AD tradecraft family for the relay itself. CrackMapExec (CME) is how testers check signing, SMBv1, and fleet-wide SMB posture before they bother relaying. Responder is often the eliciting half. Wireshark confirms NTLM on the wire.

Exam trap: relay is not pass-the-hash

Pass-the-hash (PtH) is objective 4.3. PtH reuses a stolen NT hash as if you were logging on with that hash later. Relay does not require you to crack or even to possess the hash as a reusable secret: you forward a live challenge-response. If the stem says "signing is off" and "forward the authentication to another host," the answer is relay. If the stem says you dumped hashes and are authenticating later as that user, the answer is 4.3 PtH. Do not pick hashcat, John the Ripper, or Mimikatz for 4.2 relay. Do not pick msfvenom. Mimikatz is a 4.4 credential-dumping tool.

Multihomed hosts: extra NIC, not the pivot yet

A multihomed (dual-homed) host has two or more interfaces — two NICs, a NIC plus a VPN adapter, a host on both the user VLAN and a restricted OT or DMZ network. What it does for 4.2: the extra interface is a pivot candidate. The network-attack surface is "this box already sits on two worlds." Inventory the second address, the second gateway, and whether the RoE includes that other network. When you pick it: ipconfig / ip addr / a host route table shows a second connected network after a foothold, or a scanner shows the same MAC or hostname on two subnets.

Exam trap: performing the pivot on this objective. Pivoting, proxying, and living on that second NIC as a jump path are Domain 5. 4.2 asks you to recognize the dual-home. Proxychains, sshuttle, and "build a tunnel" are the wrong-domain distractors. Trap two: calling every dual-stack IPv4-plus-IPv6 host "multihomed" in the 4.2 sense. CompTIA means extra networks, not two address families on the same LAN.

Worked LAN

10.4.20.0/24 is the user VLAN. A workstation fails DNS for files and broadcasts LLMNR. Responder answers. That is on-path-adjacent positioning, not a hash crack. SMB signing is not required on FILE01 (10.4.30.12). Forwarding the live NTLM to FILE01 is relay, not pass-the-hash. A jump box with one NIC on VLAN 20 and one NIC on VLAN 40 (OT) is multihomed — a candidate for later Domain 5 movement, not a VLAN hop. VLAN 30 servers remain unreachable from a locked VLAN-20 access port; hopping would require a trunk-adjacent mistake, which this worked path did not give you. Record the dual-home. Do not route OT traffic because 4.2 named the host type.

Sequence on the exam: position (on-path or poison), then relay if signing is off, call dual-NICs multihomed, and do not call a user access port a VLAN hop.