5.1 Router & Switch Management: SNMP, SSH & Authentication

CREST Practitioner Security Analyst CPSA

Track your progress as you read

Finished sections get a check mark.

1 Chapter 1: Soft Skills, Legal Framework & Assessment Management

1.1 The Penetration Testing Engagement Lifecycle & Scoping 1.2 Legal Framework: Computer Misuse Act & Compliance 1.3 Understanding, Explaining & Managing Technical Risk 1.4 Record Keeping, Interim Escalation & Reporting Standards

2 Chapter 2: Core Networking: IP Protocols & Network Architectures

2.1 IPv4 and IPv6 Addressing, Subnetting & Header Architecture 2.2 TCP and UDP Transport Protocols & Handshake Mechanics 2.3 ICMP Protocol, Network Diagnostics & Error Messages 2.4 Network Topologies, Switched Media & VLAN Segmentation 2.5 Network Media, Ethernet Standards & Physical Topologies

3 Chapter 3: Cryptography & Secure Communication Protocols

3.1 Symmetric & Asymmetric Cryptographic Algorithms 3.2 Cryptographic Hash Functions, MACs & Digital Signatures 3.3 Secure Protocols: SSL/TLS, IPsec & SSH

4 Chapter 4: Background Information Gathering & OSINT Reconnaissance

4.1 WHOIS Records, Domain Registrars & Autonomous Systems 4.2 DNS Infrastructure, Record Types & Zone Transfers 4.3 Search Engine Reconnaissance, Google Dorking & Information Leakage 4.4 Newsgroups, Mailing Lists & Public Archive Reconnaissance

5 Chapter 5: Networking Equipment & Infrastructure Protocols

5.1 Router & Switch Management: SNMP, SSH & Authentication 5.2 Layer 2 Protocols: ARP, CDP, STP, VTP & Redundancy 5.3 Core Network Services: DHCP, NTP & TFTP 5.4 Wireless Security (802.11) & VoIP Assessment 5.5 Out-of-Band Management, Console Access & Cisco Reverse Telnet

6 Chapter 6: Network Mapping, Nmap Techniques & Target Identification

6.1 Host Discovery Techniques & Ping Sweep Methodologies 6.2 Port Scanning Mechanics: TCP, UDP & Stealth Scans 6.3 OS Fingerprinting, Service Detection & Timing Templates 6.4 Firewall and IDS/IPS Evasion Techniques 6.5 Passive OS & Service Fingerprinting 6.6 Network Access Control Analysis & Firewall Rule Base Review

7 Chapter 7: Vulnerability Identification & Tool Output Analysis

7.1 Vulnerability Scanning Principles & Methodology 7.2 CVE Referencing, CVSS Scoring & Risk Prioritisation 7.3 Banner Grabbing, Service Verification & Manual Triage 7.4 Host Audit Techniques: Processes, Sockets, Patch Levels & Interesting Files

8 Chapter 8: Microsoft Windows Security Assessment & Active Directory

8.1 Active Directory Architecture & Domain Reconnaissance 8.2 Windows User & Group Enumeration via SMB & RPC 8.3 Windows Authentication: NTLM, Kerberos & Password Security 8.4 Windows Patch Management, Local Security & Common Services 8.5 Windows File System, Share & Registry Permissions 8.6 Desktop Lockdown, Citrix Breakout & Common Windows Applications

9 Chapter 9: Unix & Linux Security Assessment & Legacy Services

9.1 Linux/Unix Security Architecture, Permissions & Filesystem 9.2 Unix User Enumeration & Service Discovery 9.3 Network File System (NFS) & RPC Services Assessment 9.4 Legacy Unix Services: R-Services, X11, FTP & Modern SSH 9.5 Unix Remote Information Services: rusers, rwho, finger & systat 9.6 Unix Vulnerability Exploitation & Post-Exploitation Workflow

10 Chapter 10: Web Architectures, Technologies & Testing Methodologies

10.1 Web Server Architecture & the HTTP/HTTPS Protocol 10.2 Web Application Components, Frameworks & State Management 10.3 Web Reconnaissance, Content Discovery & Threat Modelling 10.4 Testing Authentication, Authorization & Session Management 10.5 Web Service Protocols: SOAP, REST & XML Messaging 10.6 Web APIs, Server Extensions & Client-Side Sub-Components

11 Chapter 11: Web Testing Techniques & OWASP Top Vulnerabilities

11.1 Input Validation Vulnerabilities & Parameter Manipulation 11.2 Cross-Site Scripting (XSS): Types, Impact & Defenses 11.3 Cross-Site Request Forgery (CSRF) & Client-Side Attacks 11.4 Command Injection, File Upload Vulnerabilities & API Flaws 11.5 Information Disclosure: Error Messages & Mark-up Leakage 11.6 Injection Beyond SQL: LDAP, XPath, Code & Template Injection 11.7 Source Code Review & Encoded/Cryptographic Value Analysis

12 Chapter 12: Database Security Assessment & SQL Injection

12.1 Database Architectures, Default Ports & Authentication 12.2 SQL Injection (SQLi) Foundations & In-Band Techniques 12.3 Blind SQL Injection & Database Enumeration 12.4 Database Attack Vectors, Stored Procedures & Hardening

5.1 Router & Switch Management: SNMP, SSH & Authentication

Key Takeaways Explain This Topic AI

Simple Network Management Protocol (SNMP) operates over UDP ports 161 (polling/agent queries) and 162 (asynchronous traps/informs); versions 1 and 2c transmit community strings in cleartext, enabling credential sniffing and unauthorized MIB walking.

SNMPv3 introduces the User-Based Security Model (USM) providing three discrete operational tiers: noAuthNoPriv (unauthenticated cleartext), authNoPriv (HMAC-MD5 or HMAC-SHA authentication without encryption), and authPriv (HMAC authentication paired with CBC-DES or AES encryption).

Cisco IOS password encryption formats vary significantly in cryptographic strength: Type 0 is plaintext, Type 7 is a reversible Vigenère-style XOR obfuscation cipher, Type 5 is a salted MD5 hash vulnerable to GPU brute-forcing, while Types 8 (PBKDF2 with SHA-256) and 9 (scrypt) provide modern resistance against offline attacks.

The AAA framework bifurcates access control across network devices: TACACS+ (TCP port 49) fully decouples Authentication, Authorization, and Accounting while encrypting the entire packet payload, whereas RADIUS (UDP ports 1812/1813) binds authentication and authorization together while encrypting only the user password attribute.

Last updated: September 2026

5.1 Router & Switch Management: SNMP, SSH & Authentication

In enterprise network environments, the management plane governs administrative access, telemetry collection, device provisioning, and operational monitoring. A vulnerability or misconfiguration in management protocols grants an adversary full control over the underlying control and data planes, bypassing perimeter firewalls and segmentations. For the CREST Practitioner Security Analyst (CPSA) examination, candidates must understand how network devices are managed, how administrative protocols operate at the packet level, and how legacy protocols expose network equipment to reconnaissance and unauthorized reconfiguration.

1. Simple Network Management Protocol (SNMP)

Simple Network Management Protocol (SNMP) is an Application Layer protocol that provides a standardized framework for monitoring and managing network-connected devices, including routers, switches, firewalls, load balancers, and servers. +-------------------------------------------------------------------------+

• | SNMP ARCHITECTURE OVERVIEW |
• +-------------------------------------------------------------------------+
• | |
• | +-----------------------+ +--------------------------+ |
• | | SNMP Manager | | SNMP Managed Device | |
• | | (NMS / Monitoring) | | (Router / Switch / OS) | |
• | +-----------------------+ +--------------------------+ |
• | | ^ | ^ |
• | | UDP 161 | | UDP 161 | |
• | | Polling | UDP 162 | Polling | UDP 162 |
• | v | Traps v | Traps |
• | +-----------------------+ +--------------------------+ |
• | | Get / GetNext / Set | ------------>| SNMP Agent Software | |
• | | GetBulk Requests | | Reads / Writes to MIB | |
• | +-----------------------+ +--------------------------+ |
• +-------------------------------------------------------------------------+
• SNMP Architecture & Transport Mechanics

SNMP operates in a client-server relationship across two specific UDP ports:

UDP Port 161 (SNMP Agent): The SNMP Manager (Network Management Station or NMS) issues polling queries ( GetRequest , GetNextRequest , GetBulkRequest , SetRequest ) to the SNMP Agent listening on UDP 161 of the managed device.

UDP Port 162 (SNMP Trap/Notification Receiver): The managed device's SNMP Agent emits unsolicited asynchronous event alerts ( Trap or InformRequest ) to the SNMP Manager listening on UDP 162.

The Management Information Base (MIB) and Object Identifiers (OIDs)

SNMP exposes operational variables organized within a hierarchical, tree-structured database called the Management Information Base (MIB) . Each accessible parameter or metric within the MIB is uniquely designated by an Object Identifier (OID) —a dot-delimited sequence of integers representing the path from the root of the tree down to the specific leaf node: Root → iso(1) → org(3) → dod(6) → internet(1) → mgmt(2) → mib-2(1) → 1.3.6.1.2.1 \text{Root} \rightarrow \text{iso(1)} \rightarrow \text{org(3)} \rightarrow \text{dod(6)} \rightarrow \text{internet(1)} \rightarrow \text{mgmt(2)} \rightarrow \text{mib-2(1)} \rightarrow 1.3.6.1.2.1 Root → iso(1) → org(3) → dod(6) → internet(1) → mgmt(2) → mib-2(1) → 1.3.6.1.2.1

Standard OID Prefix MIB Subtree Name Operational Data Disclosed

1.3.6.1.2.1.1 system Device description ( sysDescr ), uptime ( sysUpTime ), contact ( sysContact ), system name ( sysName ), and physical location ( sysLocation ).

1.3.6.1.2.1.2 interfaces Physical/virtual interface counts, link speeds, MTU sizes, MAC hardware addresses, and dynamic link operational statuses ( ifTable ).

1.3.6.1.2.1.4.21 ipRouteTable Active Layer 3 IPv4 routing tables, including destination subnets, next-hop IP gateways, route metrics, and interface bindings.

1.3.6.1.2.1.4.22 ipNetToMediaTable Device ARP cache table, binding active IPv4 addresses to physical Layer 2 MAC addresses across adjacent subnets.

1.3.6.1.2.1.25 host (Host Resources) Running system processes ( hrSWRun ), installed software packages ( hrSWInstalled ), CPU/memory utilization, and mounted storage drives.

1.3.6.1.4.1.77.1.2.25 LanManager User Domain Local Windows user account names, domain membership, and logon domains via the Microsoft enterprise enterprise tree.

Protocol Versions: SNMPv1, SNMPv2c, and SNMPv3 +---------------------------------------------------------------------------------------------------+

• | SNMP PROTOCOL EVOLUTION |
• +---------------------------------------------------------------------------------------------------+
• | Feature / Dimension | SNMPv1 (RFC 1157) | SNMPv2c (RFC 1901) | SNMPv3 (RFC 3411-3418)|
• +-------------------------+------------------------+------------------------+-----------------------+
• | Authentication | Cleartext Community | Cleartext Community | USM: MD5 or SHA HMAC |
• | Encryption / Privacy | None (Plaintext) | None (Plaintext) | USM: DES, 3DES, AES |
• | Access Control | Primitive Community | Primitive Community | VACM (View-Based) |
• | Counter Width | 32-bit only | 64-bit counter support | 64-bit counter support|
• | Bulk Data Retrieval | Iterative GetNext only | High-speed GetBulk | High-speed GetBulk |
• | Trap Reliability | Unacknowledged Trap | InformRequest (ACKed) | InformRequest (ACKed) |
• +---------------------------------------------------------------------------------------------------+
• SNMPv1 and SNMPv2c Security Weaknesses

Both SNMPv1 and SNMPv2c rely on community strings , which act as cleartext, unencrypted shared passwords transmitted directly within each UDP datagram:

public (Read-Only / RO): Permits querying device status, interface statistics, and system parameters.

private (Read-Write / RW): Permits modifying device configurations, altering routing entries, and rebooting network devices.

Because community strings traverse the network in cleartext, an eavesdropper with an active packet capture tool (e.g., Wireshark or tcpdump ) can extract valid strings instantly. Furthermore, default community strings ( public , private , cisco , manager , monitor ) are routinely left unchanged by administrators. Attackers exploit this using high-speed brute-force tools such as onesixtyone to test thousands of community string dictionaries per second against target ranges: # Rapid community string scanning using onesixtyone

onesixtyone -c /usr/share/wordlists/metasploit/snmp_default_pass.txt 192.168.1.1

• # Performing recursive subtree walk using snmpwalk
• snmpwalk -v2c -c public 192.168.1.1 1.3.6.1.2.1.1

If an attacker discovers a Read-Write (RW) community string on a Cisco IOS device, they can trigger remote configuration extraction or modification by leveraging the cisco-copy-entry OID ( 1.3.6.1.4.1.9.9.96.1.1.1.1 ), instructing the target router to upload its entire active running-config to an attacker-controlled TFTP server.

SNMPv3 Security Architecture: USM and VACM

SNMPv3 addresses the vulnerabilities of legacy versions by introducing two cryptographic models:

User-Based Security Model (USM): Defines user credentials, message authentication algorithms, and payload encryption mechanisms.

View-Based Access Control Model (VACM): Restricts which MIB trees, subtrees, and individual OID objects a specific authenticated user or group is authorized to view or configure.

SNMPv3 USM establishes three distinct Security Levels :

noAuthNoPriv : No authentication and no privacy. Uses a simple username without cryptographic validation; packets traverse the wire in cleartext. Rare in production.

authNoPriv : Provides message authentication and integrity verification without privacy. Utilizes HMAC-MD5 or HMAC-SHA to hash the message payload with a shared user secret, defeating packet tampering and unauthorized origin spoofing; however, the payload remains unencrypted.

authPriv : Enforces both authentication and privacy. In addition to HMAC-SHA (or MD5) integrity checking, the entire SNMP PDU payload is encrypted using symmetric block ciphers—historically 56-bit CBC-DES, and modernly AES-128, AES-192, or AES-256 (CFB mode).

2. Cisco IOS Configuration Analysis & Password Security

Cisco Internetwork Operating System (IOS) switches and routers store configuration directives in two primary files:

startup-config : Persisted in Non-Volatile RAM (NVRAM); loaded into active system memory during boot.

running-config : Stored in volatile dynamic RAM (DRAM); reflects the immediate, real-time operational state of the device.

When conducting a configuration review during a CREST assessment, a penetration tester or security auditor must scrutinize these files for structural vulnerabilities and password hashing weaknesses. +---------------------------------------------------------------------------------------------------+

• | CISCO IOS PASSWORD ENCRYPTION TYPES |
• +---------------------------------------------------------------------------------------------------+
• | Type | Algorithm / Cipher | Hashcat Mode | Practical Security Status |
• +--------+-------------------------------+--------------+-------------------------------------------+
• | Type 0 | Plaintext (Unencrypted) | N/A | Critical risk; fully human-readable |
• | Type 7 | Vigenère-style XOR Table | N/A | Trivial; decoded instantly (cisco-decrypt)|
• | Type 5 | Salted MD5 (cisco-ios-md5) | 500 | Deprecated; vulnerable to GPU cracking |
• | Type 8 | PBKDF2 with HMAC-SHA256 | 9200 | Robust; standard modern protection |
• | Type 9 | scrypt (Memory-Hard) | 9300 | High security; resistant to ASIC/GPU |
• +---------------------------------------------------------------------------------------------------+
• Password Hashing and Encryption Mechanics
• 1. Type 0 (Plaintext)

Passwords entered directly without encryption directives (e.g., password Cisco123 or enable password Cisco123 ) appear as unencoded plaintext within the configuration file, visible to anyone with read privileges.

2. Type 7 (Proprietary Obfuscation)

Enabled when the global configuration command service password-encryption is executed. Type 7 was designed to protect passwords from casual "shoulder-surfing" over an administrator's monitor. It is not a cryptographic hash; it is a symmetric, reversible Vigenère-style polyalphabetic substitution cipher utilizing a fixed, hardcoded 16-byte key table ( dsfd;kfo30rvbvfl ) embedded directly within the Cisco IOS binary image.

The first two characters of a Type 7 string represent the numeric index (from 00 to 15 ) of the starting position within Cisco's hardcoded key array.

Type 7 passwords can be reversed in microseconds using tools like cisco-decrypt or one-line scripts: # Reversing a Type 7 password using cisco-decrypt

• cisco-decrypt 0822455B0A10091E1D
• # Result: "CiscoAdmin123"
• 3. Type 5 (Salted MD5 Crypt)

Generated using the command enable secret <password> or username <user> secret <password> . Type 5 hashes are formatted as $1$<salt>$<hash> , utilizing a variant of the standard Unix crypt() MD5 function with a 4-character salt and 1,000 hashing iterations. While significantly stronger than Type 7, modern GPU cracking clusters can evaluate hundreds of millions of Type 5 hashes per second using Hashcat ( hashcat -m 500 hashes.txt wordlist.txt ).

4. Type 8 (PBKDF2 with HMAC-SHA256)

Configured using enable algorithm-type sha256 . Type 8 implements the Password-Based Key Derivation Function 2 (PBKDF2) standard, pairing HMAC-SHA256 with an 80-bit salt and 20,000 hashing iterations. Hash strings appear formatted as $8$<salt>$<hash> .

5. Type 9 (scrypt)

Configured using enable algorithm-type scrypt . Type 9 applies the memory-hard scrypt key derivation function, deliberately forcing high memory consumption during hash calculation to render parallel ASIC and FPGA hardware brute-forcing computationally cost-prohibitive. Hash strings appear formatted as $9$<salt>$<hash> .

Critical Audit Checks in Cisco Configurations

During security reviews, penetration testers evaluate device configuration blocks for common hardening deficiencies:

Insecure Administrative Interfaces:

Unencrypted Web Servers: Directives ip http server (listening on TCP port 80) transmit administrative sessions, authentication headers, and credentials in cleartext. Configurations must mandate no ip http server and restrict secure access via ip http secure-server (HTTPS/TLS) bound to management ACLs.

Exposed Telnet Lines: Inspect the Virtual Terminal ( line vty 0 4 ) configuration. If transport input telnet or transport input all is present, administration credentials traverse the network in cleartext. Hardened configurations mandate transport input ssh and require login local .

Console and Auxiliary Port Hardening:

Unprotected auxiliary ports ( line aux 0 ) must be disabled via no exec and transport output none to prevent backdoor modem access.

Console ports ( line con 0 ) must enforce an administrative idle timeout via exec-timeout 5 0 (5 minutes, 0 seconds) to prevent unauthorized local terminal hijacking.

Logging and Telemetry Verification:

Logging buffers must be sized appropriately ( logging buffered 64000 warnings ).

Syslog output ( logging host <IP> ) must forward event logs to an isolated SIEM or syslog collector.

Audit timestamps must record sub-second telemetry using service timestamps log datetime msec .

3. AAA Framework: TACACS+ vs RADIUS

The AAA (Authentication, Authorization, and Accounting) framework governs centralized identity and policy enforcement across enterprise network devices:

Authentication: Validates the identity of the user attempting access (e.g., verifying a username against a central database via password, token, or digital certificate).

Authorization: Dictates the specific commands, privilege tiers (0-15 on Cisco), and resources an authenticated user is permitted to execute.

Accounting: Generates an auditable record detailing when the user logged in, which commands they entered, files transferred, and session termination times. +---------------------------------------------------------------------------------------------------+

• | AAA PROTOCOL COMPARISON ARCHITECTURE |
• +---------------------------------------------------------------------------------------------------+
• | Feature / Dimension | TACACS+ (RFC 8907 / Cisco) | RADIUS (RFC 2865 / 2866 - IETF) |
• +-------------------------+-------------------------------------+-----------------------------------+
• | Transport Layer | TCP Port 49 (Connection-Oriented) | UDP Ports 1812 (Auth) / 1813 (Acct|
• | | | Legacy: UDP 1645 (Auth) / 1646(Acct
• | AAA Architectural Model | Completely Decoupled / Independent | Combines Auth & Authorization |
• | Packet Encryption Scope | Encrypts ENTIRE packet payload | Encrypts ONLY the Password field |
• | | (Only 12-byte header in cleartext) | (Headers, attributes in cleartext)|
• | Command Authorization | Per-command granularity | Session-level / Service profile |
• | Primary Deployment Case | Administrative device management | Network access (802.1X, VPNs, Dial

+---------------------------------------------------------------------------------------------------+ TACACS+ Packet Layout (TCP Port 49):

• +---------------------+---------------------------------------------------------------+
• | 12-Byte Header | Encrypted Body Payload (Ciphertext via MD5 XOR Stream) |
• | (Cleartext) | Includes: Usernames, Passwords, Executed Commands, Arguments |
• +---------------------+---------------------------------------------------------------+

RADIUS Packet Layout (UDP Ports 1812 / 1813):

• +---------------------+-----------------------------------+---------------------------+
• | 20-Byte Header | Attribute 1: User-Name (Cleartext)| Attribute 2: User-Password|
• | (Cleartext) | Value: "admin" | (MD5 Encrypted Payload) |
• +---------------------+-----------------------------------+---------------------------+
• TACACS+ Mechanics

TACACS+ (Terminal Access Controller Access-Control System Plus) is a Cisco-developed enhancement to legacy TACACS, standardized in RFC 8907:

Connection Reliability: Operates over TCP port 49 , benefiting from connection-oriented acknowledgments and flow control.

Decoupled Architecture: TACACS+ treats Authentication, Authorization, and Accounting as separate processes. A device can authenticate an administrator against an Active Directory LDAP server, authorize specific Cisco CLI commands against a centralized Cisco Identity Services Engine (ISE) rule engine, and log session accounting to a dedicated audit cluster.

Cryptographic Security: TACACS+ encrypts the entire body of every packet using a pseudo-random keystream generated by hashing the shared secret key, session ID, and sequence number using MD5. Only the 12-byte fixed header (containing version, sequence number, flags, and session ID) remains unencrypted on the wire.

Granular Command Authorization: When an administrator types configure terminal or reload , the router suspends execution and sends a TACACS+ authorization request packet containing the exact command string. The server responds with PERMIT or DENY , enabling per-command access control.

RADIUS Mechanics

RADIUS (Remote Authentication Dial-In User Service) is an open standard protocol defined in RFC 2865 (Authentication) and RFC 2866 (Accounting):

Connectionless Transport: Operates over UDP ports 1812 (Authentication/Authorization) and 1813 (Accounting). Legacy implementations utilize UDP ports 1645 and 1646.

Combined Authentication & Authorization: When a network access client sends an Access-Request , the RADIUS server evaluates credentials and returns an Access-Accept containing authorization parameters (e.g., Assigned VLAN, Session Timeout, Filter-ID) inside Attribute-Value Pairs (AVPs). Authorization cannot be separated from initial authentication.

Cryptographic Limitations: RADIUS encrypts only the User-Password attribute by XORing the password with an MD5 hash of the shared secret and the 16-byte Request Authenticator. The packet header, username, IP addresses, vendor-specific attributes, and all accounting data are transmitted in unencrypted cleartext.

Operational Scope: RADIUS is optimized for bulk network admission control (such as IEEE 802.1X port-based authentication for enterprise Wi-Fi and switch access) rather than fine-grained administrative CLI command filtering.