Infrastructure
Test network infrastructure for vulnerabilities including network services, protocols, and perimeter security.
Techniques
| Type |
Key Vectors |
| Port Scanning |
SYN scan, UDP scan, service detection, OS fingerprinting |
| DNS |
Zone transfers, cache poisoning, subdomain takeover, DNS rebinding |
| MITM |
ARP spoofing, DNS spoofing, SSL stripping, LLMNR/NBT-NS poisoning |
| VLAN Hopping |
Switch spoofing, double tagging |
| IPv6 |
RA flooding, neighbor spoofing, tunneling attacks |
| SMB/NetBIOS |
Null sessions, relay attacks, enumeration |
| Sniffing |
Packet capture, credential harvesting, protocol analysis |
| DoS |
Resource exhaustion, amplification, application-layer |
| ICS/SCADA |
Modbus TCP, PLC exploitation, coil/register manipulation, session hijacking |
| Space / CCSDS |
Satellite telecommand framing (Space Packet + TC Transfer Frame), APID/SCID/VCID routing, VCFC sequencing, CRC-16/CCITT, ASCII 0x%02x: command counters |
| UPnP / IoT / CPE |
rootDesc/SCPD enumeration, vendor SOAP info disclosure (GetPassword), command injection via vendor actions, cross-action auth-key reuse |
| Hardware / Embedded |
Logic captures (Saleae .sal), CAN/UART decoding, side-channel password recovery, legacy CPU errata, i386 tools via docker |
Workflow
- Network discovery and topology mapping
- Port scanning and service enumeration
- Protocol-specific vulnerability testing
- Network attack execution (authorized scope only)
- Evidence capture with packet captures and logs
Reference
Quickstart guides (per attack type):
reference/port-scanning-quickstart.md - Port scanning and service discoveryreference/dns-quickstart.md - DNS attacks and enumerationreference/mitm-quickstart.md - Man-in-the-middle attacksreference/vlan-hopping-quickstart.md - VLAN hopping techniquesreference/ipv6-quickstart.md - IPv6 attack vectorsreference/smb-netbios-quickstart.md - SMB/NetBIOS exploitationreference/sniffing-quickstart.md - Network sniffing and capturereference/dos-quickstart.md - DoS assessmentreference/ics-modbus-quickstart.md - ICS/SCADA Modbus PLC exploitationreference/ccsds-space-telecommand-quickstart.md - Satellite CCSDS telecommand frame crafting (Space Packet + TC Transfer Frame)reference/upnp-iot-quickstart.md - UPnP / IoT / CPE firmware web UI enumeration and exploitationreference/hardware-embedded-quickstart.md - Logic captures, CAN/UART decoding, side-channel char-by-char recovery, legacy CPU bugs (6502), i386 tooling on ARM macOS
Scan techniques: reference/syn-scan.md, reference/udp-scan.md, reference/icmp-scan.md, reference/os-fingerprint.md
Other: reference/firewall-detection.md, reference/service-enum.md, reference/ip-reputation.md, reference/overview.md
1---
2name: infrastructure
3description: Network infrastructure testing - port scanning, DNS attacks, MITM, VLAN hopping, IPv6, SMB/NetBIOS, sniffing, and DoS assessment.
4---
5
6# Infrastructure
7
8Test network infrastructure for vulnerabilities including network services, protocols, and perimeter security.
9
10## Techniques
11
12| Type | Key Vectors |
13|------|-------------|
14| **Port Scanning** | SYN scan, UDP scan, service detection, OS fingerprinting |
15| **DNS** | Zone transfers, cache poisoning, subdomain takeover, DNS rebinding |
16| **MITM** | ARP spoofing, DNS spoofing, SSL stripping, LLMNR/NBT-NS poisoning |
17| **VLAN Hopping** | Switch spoofing, double tagging |
18| **IPv6** | RA flooding, neighbor spoofing, tunneling attacks |
19| **SMB/NetBIOS** | Null sessions, relay attacks, enumeration |
20| **Sniffing** | Packet capture, credential harvesting, protocol analysis |
21| **DoS** | Resource exhaustion, amplification, application-layer |
22| **ICS/SCADA** | Modbus TCP, PLC exploitation, coil/register manipulation, session hijacking |
23| **Space / CCSDS** | Satellite telecommand framing (Space Packet + TC Transfer Frame), APID/SCID/VCID routing, VCFC sequencing, CRC-16/CCITT, ASCII `0x%02x:` command counters |
24| **UPnP / IoT / CPE** | rootDesc/SCPD enumeration, vendor SOAP info disclosure (`GetPassword`), command injection via vendor actions, cross-action auth-key reuse |
25| **Hardware / Embedded** | Logic captures (Saleae `.sal`), CAN/UART decoding, side-channel password recovery, legacy CPU errata, i386 tools via docker |
26
27## Workflow
28
291. Network discovery and topology mapping
302. Port scanning and service enumeration
313. Protocol-specific vulnerability testing
324. Network attack execution (authorized scope only)
335. Evidence capture with packet captures and logs
34
35## Reference
36
37**Quickstart guides** (per attack type):
38- `reference/port-scanning-quickstart.md` - Port scanning and service discovery
39- `reference/dns-quickstart.md` - DNS attacks and enumeration
40- `reference/mitm-quickstart.md` - Man-in-the-middle attacks
41- `reference/vlan-hopping-quickstart.md` - VLAN hopping techniques
42- `reference/ipv6-quickstart.md` - IPv6 attack vectors
43- `reference/smb-netbios-quickstart.md` - SMB/NetBIOS exploitation
44- `reference/sniffing-quickstart.md` - Network sniffing and capture
45- `reference/dos-quickstart.md` - DoS assessment
46- `reference/ics-modbus-quickstart.md` - ICS/SCADA Modbus PLC exploitation
47- `reference/ccsds-space-telecommand-quickstart.md` - Satellite CCSDS telecommand frame crafting (Space Packet + TC Transfer Frame)
48- `reference/upnp-iot-quickstart.md` - UPnP / IoT / CPE firmware web UI enumeration and exploitation
49- `reference/hardware-embedded-quickstart.md` - Logic captures, CAN/UART decoding, side-channel char-by-char recovery, legacy CPU bugs (6502), i386 tooling on ARM macOS
50
51**Scan techniques**: `reference/syn-scan.md`, `reference/udp-scan.md`, `reference/icmp-scan.md`, `reference/os-fingerprint.md`
52**Other**: `reference/firewall-detection.md`, `reference/service-enum.md`, `reference/ip-reputation.md`, `reference/overview.md`
transilienceai