ACL Vulnerability Assessment & Penetration Testing 3

Question 1

When conducting a vulnerability assessment, which tool is most commonly used to automatically audit Cisco ACL configurations for weaknesses?

Accepted Answer

Nipper or CIS-CAT for network device configuration analysis

Answer

Nipper and CIS-CAT are specialized tools designed to audit router and switch configurations, including ACL rules, against security best practices and known vulnerabilities.

Question 2

A tester discovers an ACL that permits 'established' keyword for TCP return traffic. What vulnerability does improper use of this keyword introduce?

Accepted Answer

Attackers can craft packets with the ACK bit set to bypass the ACL and probe internal hosts

Answer

The 'established' keyword only checks for the ACK or RST bit in stateless ACLs, allowing attackers to send crafted packets with ACK set to bypass filtering without a prior legitimate connection.

Question 3

During an ACL penetration test, a tester finds that management interfaces (SSH, SNMP) are not restricted by source IP in the ACL. What is the highest-priority remediation?

Accepted Answer

Add ACL entries restricting management protocol access to specific trusted management subnets only

Answer

Management interfaces should only be reachable from designated management networks; source IP restrictions in ACLs prevent attackers on untrusted networks from reaching these high-value targets.

Question 4

A penetration tester uses fragmented IP packets to attempt to bypass an ACL. Which ACL feature is specifically designed to counter this technique?

Accepted Answer

IP Fragment handling with the 'fragments' keyword or stateful inspection

Answer

Cisco ACLs support a 'fragments' keyword that controls how non-initial IP fragments are handled, preventing attackers from hiding malicious traffic in packet fragments that skip layer-4 inspection.

Question 5

Which OWASP testing technique most directly applies when assessing whether web application ACLs properly enforce authorization?

Accepted Answer

Horizontal and vertical privilege escalation testing to verify access control enforcement

Answer

Horizontal privilege escalation (accessing other users' resources) and vertical privilege escalation (accessing higher-privilege functions) directly test whether ACL-enforced authorization controls are correctly implemented.

(ACL) Access Control Lists Practice Test

(ACL) Access Control Lists Practice Test

ACL Vulnerability Assessment & Penetration Testing 3