Study guide
11.1 On-Path, VLAN Hopping, Relay, and Multihomed Hosts
CompTIA PenTest+ PT0-003
Track your progress as you read
Finished sections get a check mark.
1 Introduction & Exam Overview
1.1 Current PT0-003 Exam Facts 1.2 Format, PBQs, Scoring, and Retake Policy 1.3 Recertification, CEUs, and Career Fit
2 Pre-Engagement Planning
2.1 Scope, Rules of Engagement, and Agreements 2.2 Target Selection and Assessment Types 2.3 Shared Responsibility, Legal Authorization, and Ethics
3 Collaboration, Frameworks, and Threat Modeling
3.1 Collaboration, Escalation, and Stakeholder Communication 3.2 Testing Frameworks and Methodologies 3.3 Threat Modeling: STRIDE, DREAD, and OCTAVE
4 Reporting and Remediation
4.1 Penetration Test Report Components 4.2 Findings Analysis and Remediation Recommendations
5 Information Gathering
5.1 Active vs Passive Reconnaissance 5.2 OSINT Sources and Techniques 5.3 DNS, Certificate Transparency, and Search Engine Enumeration 5.4 Network Recon, Protocol Scanning, Sniffing, and Banner Grabbing
6 Enumeration Techniques
6.1 OS Fingerprinting, Service Discovery, and Host Discovery 6.2 DNS, Directory, Share, and Account Enumeration 6.3 Secrets, Permissions, and Wireless Enumeration 6.4 WAF Enumeration, Web Crawling, and Attack Path Mapping
7 Recon Scripting and Tools
7.1 Modifying Bash, Python, and PowerShell for Recon 7.2 Recon and Enumeration Tools
8 Vulnerability Scan Types
8.1 Network, Host, Authenticated, and Wireless Scans 8.2 SAST, DAST, IAST, SCA, IaC, and Mobile Scans 8.3 Container, Secrets, and ICS Vulnerability Assessment 8.4 Core Vulnerability Scanners (Nessus, OpenVAS, Nikto)
9 Scan Analysis and Physical Security
9.1 Specialized Discovery Tools 9.2 Validating Scan, Recon, and Enumeration Results 9.3 Public Exploit Selection and Scripted Validation 9.4 Physical Security Concepts for PenTests
10 Attack Prioritization and Preparation
10.1 Target Prioritization: CVSS, CVE, CWE, and EPSS 10.2 Exploit Selection, Customization, and Attack Documentation
11 Network Attacks
11.1 On-Path, VLAN Hopping, Relay, and Multihomed Hosts 11.2 Default Credentials, Misconfigured Services, Packet Crafting, and Certificate Services
12 Authentication Attacks
12.1 Pass-the-Hash, Pass-the-Ticket, Pass-the-Token, and Kerberos Attacks 12.2 Password Attacks, MFA Fatigue, LDAP Injection, OIDC, and SAML
13 Host-Based Attacks
13.1 Privilege Escalation and Credential Dumping 13.2 Process Injection, Security Bypass, and Host Attack Tools
14 Web Application Attacks
14.1 SQL, Command, XSS, and SSTI Injection 14.2 CSRF, SSRF, Deserialization, IDOR, and Directory Traversal 14.3 LFI/RFI, Web Shells, API Abuse, JWT, and Session Hijacking
15 Cloud Attacks
15.1 IAM Misconfiguration, Metadata Service, and Exposed Storage 15.2 Container Escape, Supply Chain, and Cloud Attack Tools
16 Wireless and Social Engineering
16.1 Wireless Attacks and Tools 16.2 Phishing, Spearphishing, Whaling, Vishing, and Smishing 16.3 Physical Social Engineering and SE Tools
17 Specialized Systems
17.1 Mobile Attacks and AI Prompt/Model Attacks 17.2 OT/ICS, NFC, RFID, and Bluetooth Attacks
18 Attack Scripting and BAS
18.1 PowerShell, Python, and Bash Attack Automation 18.2 Breach and Attack Simulation (Caldera, Infection Monkey, Atomic Red Team)
19 Persistence
19.1 Scheduled Tasks, Services, Accounts, and Shells 19.2 C2, Backdoors, Rootkits, and Security-Control Tampering
20 Lateral Movement
20.1 Pivoting, Relays, and Additional Credential Capture 20.2 Remote Services: SMB, RDP, WinRM, WMI, SSH, and Others 20.3 Lateral Movement Tools and LOLbins
21 Exfiltration and Cleanup
21.1 Staging and Exfiltration 21.2 Cleanup, Restoration, and Artifact Preservation
11.1 On-Path, VLAN Hopping, Relay, and Multihomed Hosts
Key Takeaways Explain This Topic AI
Domain 4 Attacks and Exploits is 35 percent of PT0-003; objective 4.2 is performing a network attack with the matching tool, not discovering a CVE.
On-path (MITM) places you between peers via ARP spoofing or name poisoning; TLS can fail the attack unless clients ignore certificates or trust is otherwise broken.
Responder LLMNR, NBT-NS, and mDNS poisoning is the exam's Windows-LAN on-path-adjacent example; it is not a hash-cracking tool.
VLAN hopping uses switch spoofing or double tagging and needs a trunk-adjacent or mis-trunked port — it is not magic from a locked user access port.
A relay forwards live NTLM when signing is off and is not pass-the-hash (4.3); a multihomed extra NIC is a pivot candidate, while pivoting itself is Domain 5.
Last updated: August 2026
Domain 4, Attacks and Exploits , is 35 percent of CompTIA PenTest+ PT0-003. Objective 4.2 — Given a scenario, perform network attacks using the appropriate tools — is the first live-attack matching drill after 4.1 prioritization. You already ranked the target. Now you pick a network attack that fits the path, the protocol, and the authorization. This section covers four positioning attacks: on-path , VLAN hopping , relay , and multihomed hosts . Default credentials, misconfigured services, packet crafting, certificate services, and share-as-attack belong in the next section with the full tool table. Domain 4 is not Domain 3: a Nessus row is not an attack. It is also not Domain 5: finding a second NIC is not the same as pivoting through it.
On-path attacks: sit between the peers
An on-path attack is CompTIA's current name for what older material called man-in-the-middle. What it does: it places the tester between two legitimate peers so traffic can be observed or altered. The classic local-Ethernet method is ARP spoofing : you answer Address Resolution Protocol requests as if you were the default gateway or the peer, so frames that should go host-to-host land on your adapter. IPv6 neighbor-discovery spoofing is the same idea on a different Layer-2 protocol. When you pick it: you already share a broadcast domain with the victims and the rules of engagement (RoE) allow poisoning the local path. You do not pick on-path against a host that only exists across a routed firewall you cannot sit in front of.
TLS can fail the attack. If the application speaks HTTPS and clients validate certificates, your intercept presents a certificate the client does not trust. Users see a warning, or the handshake dies, and passwords never leave the browser. That is the control working. On-path against TLS is not automatically a credential steal unless the client ignores certificate errors or you otherwise break trust — a topic adjacent to certificate services in the next section. Exam trap: "ARP spoofing decrypts TLS by itself." It does not. Wireshark or tcpdump will show you are on the path; they will not magically yield plaintext HTTP from a validated TLS session.
On Windows LANs, the exam's favorite on-path-adjacent pattern is LLMNR / NBT-NS / mDNS poisoning . A client fails DNS, broadcasts a name query, and a tool in the Responder family answers. The client then authenticates to you as if you were the file server. You did not crack a hash and you did not yet relay. You became the named destination. That is why CompTIA lists Responder under 4.2 tools next to on-path and relay. Which tool family: Responder to become the name, Wireshark or tcpdump to prove you are on path, Impacket if the next move is relay. Not Hydra. Not msfvenom. Not hashcat.
Exam trap: poisoning is not cracking
A captured Net-NTLMv2 blob in Responder is evidence you were on path (or name-adjacent). Turning that blob into a password is 4.3 cracking with hashcat or John the Ripper. Forwarding the live authentication without cracking it is relay , still 4.2. Mixing those three items is how candidates miss an otherwise easy stem.
VLAN hopping: trunk abuse, not a user-port spell
VLAN hopping is reaching a virtual LAN you were not assigned by abusing how switches handle trunks . What it does: it lets frames from a tester port appear on a VLAN the access policy never granted. Two conceptual families appear on the exam.
Switch spoofing is pretending to be a switch and negotiating a trunk (historically Dynamic Trunking Protocol). If the access port is willing to become a trunk, you see tagged frames for VLANs the user port should never carry.
Double tagging is sending an 802.1Q-in-Q frame: an outer tag matching the native VLAN, an inner tag for the victim VLAN. The first switch strips the outer tag and forwards the inner tag into the trunk. You need a path that actually treats the native VLAN that way.
When you pick it: you are on a trunk-adjacent or misconfigured port — a port that trunks, that will negotiate a trunk, or that shares a native VLAN with a trunk. When you do not: a correctly configured access port in VLAN 20. Setting a laptop NIC's VLAN ID to 30 is not hopping. The switch strips or ignores the tag and keeps you in the assigned VLAN.
Exam trap: treating VLAN hopping as magic from any user jack. Trap two: treating hopping as the same thing as a dual-homed host. That host already has a second cable; hopping abuses tagging on a single path. Wireshark showing 802.1Q tags is evidence of a trunked path. Hydra against the switch enable password is a default-credential problem, not hopping. Packet crafting can build a double-tagged frame, but the attack type the stem is scoring is still VLAN hopping when the goal is "reach VLAN 30."
Relay attacks: forward live authentication
A relay attack takes an authentication that was aimed at you (or that you observed) and presents it to a different host , so that host treats you as the original client. The Windows exam pattern is NTLM relay when SMB or LDAP signing is not required . A workstation authenticates to the tester after name poisoning; the tester forwards that NTLM exchange to FILE01; FILE01 accepts it because it does not demand a signed session.
What it does: you borrow a live logon attempt. You do not need the password and you do not need a reusable stolen hash. When you pick it: you have a captured live authentication and a second in-scope host that will accept it without signing (or an equivalent binding such as LDAP without signing or channel binding). Which tool family: Impacket is the 4.2 Windows/AD tradecraft family for the relay itself. CrackMapExec (CME) is how testers check signing, SMBv1, and fleet-wide SMB posture before they bother relaying. Responder is often the eliciting half. Wireshark confirms NTLM on the wire.
Exam trap: relay is not pass-the-hash
Pass-the-hash (PtH) is objective 4.3 . PtH reuses a stolen NT hash as if you were logging on with that hash later. Relay does not require you to crack or even to possess the hash as a reusable secret: you forward a live challenge-response. If the stem says "signing is off" and "forward the authentication to another host," the answer is relay. If the stem says you dumped hashes and are authenticating later as that user, the answer is 4.3 PtH. Do not pick hashcat, John the Ripper, or Mimikatz for 4.2 relay. Do not pick msfvenom. Mimikatz is a 4.4 credential-dumping tool.
Multihomed hosts: extra NIC, not the pivot yet
A multihomed (dual-homed) host has two or more interfaces — two NICs, a NIC plus a VPN adapter, a host on both the user VLAN and a restricted OT or DMZ network. What it does for 4.2: the extra interface is a pivot candidate . The network-attack surface is "this box already sits on two worlds." Inventory the second address, the second gateway, and whether the RoE includes that other network. When you pick it: ipconfig / ip addr / a host route table shows a second connected network after a foothold, or a scanner shows the same MAC or hostname on two subnets.
Exam trap: performing the pivot on this objective. Pivoting , proxying, and living on that second NIC as a jump path are Domain 5 . 4.2 asks you to recognize the dual-home. Proxychains, sshuttle, and "build a tunnel" are the wrong-domain distractors. Trap two: calling every dual-stack IPv4-plus-IPv6 host "multihomed" in the 4.2 sense. CompTIA means extra networks, not two address families on the same LAN.
Worked LAN
10.4.20.0/24 is the user VLAN. A workstation fails DNS for files and broadcasts LLMNR. Responder answers. That is on-path-adjacent positioning, not a hash crack. SMB signing is not required on FILE01 ( 10.4.30.12 ). Forwarding the live NTLM to FILE01 is relay , not pass-the-hash. A jump box with one NIC on VLAN 20 and one NIC on VLAN 40 (OT) is multihomed — a candidate for later Domain 5 movement, not a VLAN hop. VLAN 30 servers remain unreachable from a locked VLAN-20 access port; hopping would require a trunk-adjacent mistake, which this worked path did not give you. Record the dual-home. Do not route OT traffic because 4.2 named the host type.
Attack What it does When you pick it Tool family Exam trap
On-path Sit between peers Shared L2 or name poisoning Responder, Wireshark/tcpdump TLS without broken or ignored certs
VLAN hopping Abuse trunks to see another VLAN Trunk-adjacent or native-VLAN mistake Conceptual; Wireshark for tags Not from a locked access port
Relay Forward live auth to a second host Signing off; captured NTLM Impacket, CME Not pass-the-hash (4.3)
Multihomed Extra NIC as a path candidate Dual-homed host found Host IP and route inventory The pivot itself is Domain 5
Sequence on the exam: position (on-path or poison), then relay if signing is off, call dual-NICs multihomed, and do not call a user access port a VLAN hop.