Viproy VoIP Pen-Test Kit - Cisco CDP Testing Module

[fozavci]

This modules is developed to send custom Cisco CDP packets. It can be used to attack Cisco VLAN environment or voice VLANs. This was ported from Viproy (http://www.viproy.com)

Validation

• Use the module with default options as non-root. It should fail gracefully
• Use the module with default options as root. It should send properly formed CDP packets (validate with wireshark)
• Use the module as root, changing the various options. It should send properly formed CDP packets (validate with wireshark) that reflect the set options.

[jhart-r7]

I'm not sure about the sniff functionality in this module. It needs a lot of cleanup and does less than what tcpdump/wireshark could already do for you. I'm going to just remove it unless there are any objections.

[jhart-r7]

My most recent push completes the almost complete rewrite of this module. Someone else will need to handle landing this.

[fozavci]

I agree with all the changes, it may be improved when it lands. Thanks for the corrections.

[jhart-r7]

I discussed this (and #4067) with @todb-r7 and it is OK to land. I walked through the validation steps and everything checks out. As an added bonus, where I happened to be when I tested this is a Cisco environment with CDP enabled -- when I ran the module, the Cisco switch I was connected to responds to my CDP messages with useful information, which proves that the CDP messages sent by this module are sound.

Thanks for the contribution, @fozavci!

[jhart-r7]

Also, I am not sure why this didn't auto-close, but you can see in 31b366d that this was merged OK.

[fozavci]

Thanks for your assistance.

[todb-r7]

@jhart-r7 looks like there was no merge commit for this module, which is why you never saw the autoclose.

git log --merges modules/auxiliary/spoof/cisco/cdp.rb

Incidentally, none of the commits are signed, either. Not sure how you got in this position. I'm sure it's all okay and it was really you, but I bet there was some rebasing going on, as the commit history on this file doesn't appear to match up with this PR. (See how commit 7e93d89 has a different timestamp from c80dc39).

[todb-r7]

My guess is that you merged, rebased, got a change from upstream, then pushed. The rebase will remove signatures and rewrite commit history.

[todb-r7]

By the way, what's the purpose of this module, @fozavci ? The description isn't all that descriptive of why anyone would do this. As far as I can tell, you're sending the discovery packets, sleep for a minute, but then you don't do anything with any response.

I'd love to have some more whys and wherefores in the description. Like mentioning, for starters, that the user should be watching for responses with an external packet sniffer.

[todb-r7]

#4258 takes a stab and making the description on this more accurate and useful.