Become VeryLazyTech member! 🎁
Follow us on:
✖ Twitter @VeryLazyTech.
👾 Github @VeryLazyTech.
📜 Medium @VeryLazyTech.
📺 YouTube @VeryLazyTech.
📩 Telegram @VeryLazyTech.
🕵️♂️ My Site @VeryLazyTech.
Visit our shop for e-books and courses. 📚
IPsec is widely recognized as the principal technology for securing communications between networks (LAN-to-LAN) and from remote users to the network gateway (remote access), serving as the backbone for enterprise VPN solutions.
The establishment of a security association (SA) between two points is managed by IKE, which operates under the umbrella of ISAKMP, a protocol designed for the authentication and key exchange. This process unfolds in several phases:
Phase 1: A secure channel is created between two endpoints. This is achieved through the use of a Pre-Shared Key (PSK) or certificates, employing either main mode, which involves three pairs of messages, or aggressive mode.
Phase 1.5: Though not mandatory, this phase, known as the Extended Authentication Phase, verifies the identity of the user attempting to connect by requiring a username and password.
Phase 2: This phase is dedicated to negotiating the parameters for securing data with ESP and AH. It allows for the use of algorithms different from those in Phase 1 to ensure Perfect Forward Secrecy (PFS), enhancing security.
Default port: 500/udp
Start by scanning the target for UDP port 500, which is used by the IKE (Internet Key Exchange) protocol in IPsec VPNs.
What it does:
-sU → Scans UDP ports
-p 500 → Scans IKE service
--script ike-version → Detects IKE version (IKEv1 or IKEv2)
Output
Use ike-scan to fingerprint the VPN system.
What it does:
-M → Main mode scanning
-A → Aggressive mode detection
Output
Why this matters:
If Aggressive Mode is enabled, the VPN may leak the group name and be vulnerable to credential brute-force attacks.
If aggressive mode is enabled, use ike-scan to grab the pre-shared key (PSK) hash.
If a PSK hash is found, crack it using pskcrack:
Warning: If aggressive mode is enabled, this is a security risk because it allows an attacker to retrieve VPN group names and crack credentials offline.
Try brute-forcing VPN credentials using Hydra.
What it does:
-L userlist.txt → List of possible usernames
-P passlist.txt → List of passwords
-e ns → Tries null and same-as-username passwords
-u → Tries usernames one by one instead of parallel requests
If you have access to network traffic, use Wireshark to capture and analyze IKE packets.
Apply the Wireshark filter:
Why this matters:
Helps detect IKE negotiations, key exchanges, and potential misconfigurations.
If Aggressive Mode is used, you may see the group name in plaintext.
Search for known VPN-related vulnerabilities:
or
If weak pre-shared keys are detected, use Metasploit to exploit them:
Disable Aggressive Mode (Only use Main Mode) Use strong Pre-Shared Keys (PSKs) and avoid weak passwords Implement Certificate-Based Authentication instead of PSK Limit VPN Access to Known IPs Use IKEv2 instead of IKEv1 for better security
Learn & practice For the OSCP.
Become VeryLazyTech member! 🎁
Follow us on:
✖ Twitter @VeryLazyTech.
👾 Github @VeryLazyTech.
📜 Medium @VeryLazyTech.
📺 YouTube @VeryLazyTech.
📩 Telegram @VeryLazyTech.
🕵️♂️ My Site @VeryLazyTech.
Visit our shop for e-books and courses. 📚
Last updated
nmap -sU -p 500 --script ike-version <target_ip>arduinoCopyEdit500/udp open isakmp
| ike-version:
| 1.0 (ISAKMP 1.0)
| 2.0 (IKEv2)ike-scan -M -A <target_ip>Starting ike-scan against <target_ip>
Responder matches: Cisco VPN 3000 Concentrator (IKEv1)ike-scan -A --trans=1,2,3,4,5 <target_ip>ike-scan -A --pskcrack <target_ip>pskcrack hashfile.txthydra -L userlist.txt -P passlist.txt -e ns -u <target_ip> ikeudp.port == 500searchsploit ikemsfconsole
msf> search ikeuse auxiliary/scanner/ipsec/ike_enum
set RHOSTS <target_ip>
exploit