Enterprise VPN Attack

--- name: enterprise-vpn-attack description: External SSL VPN / remote-access appliance attack matrix : Cisco ASA/AnyConnect, Fortinet FortiGate/FortiOS, Citrix NetScaler/ADC, Palo Alto GlobalProtect, Pulse Secure / Ivanti Connect Secure, SonicWall, F5 Big-IP. Covers version fingerprinting, CVE matrix (2018:2026), AAA-backend-identification, default credentials, configuration-disclosure paths, and pre-auth RCE/SSRF/path-traversal exploits where applicable. Built from authorized Cisco ASA testing engagements plus the 2024:2026 enterprise VPN CVE landscape. Use whenever the target’s perimeter exposes any SSL VPN appliance or remote-access gateway:these are the most common initial access points in 2024:2026 actor TTPs. sources: authorized-engagement, public-advisories, cisa-kev report_count: 1 --- ## When to use this skill Trigger when reconnaissance reveals: - *.<client>.example/+CSCOE+/logon.html or similar +CSCOE+ paths → Cisco ASA / AnyConnect - Subdomains such as intranet.*, vpn.*, connect.*, webvpn.*, wc.*, and remote.* - Port 443 returning login pages with Server: Apache or a banner such as "AnyConnect," "FortiGate," "NetScaler," "GlobalProtect," "Pulse," or "Ivanti" - TCP 8443 / 4443 / 10443 / 8888 (common VPN web management ports) - HTTP responses with Set-Cookie: webvpn= (Cisco) / SVPNCOOKIE= (Fortinet) / NSC_AAA= (Citrix) / DSAuthSession= (Pulse) / BIGipServer* (F5) DO NOT use for: - Internal lateral movement after gaining a foothold (outside the scope of the user’s boundary) - VPN client-side bugs (different attack class) - IPsec / L2TP / OpenVPN (different protocols; not the SSL VPN web stack) --- ## Vendor identification (fingerprinting) ### Cisco ASA / AnyConnect ``bash curl -skI 'https://target/+CSCOE+/logon.html' | head -10 # Look for: Set-Cookie: webvpn=; X-Frame-Options: SAMEORIGIN; CSP: ... block-all-mixed-content # Login page contains: "AnyConnect", "CSCOE", "logon.html" ` ASA version: not banner-disclosed in modern builds; need to derive from JS file paths or test specific paths. `bash # Path-based version hints (older builds leaked builds in URLs) curl -sk 'https://target/+CSCOE+/sdesktop/scan-finalize?path=test' curl -sk 'https://target/+CSCOE+/saml/sp/metadata' # 200 = SAML auth enabled curl -sk 'https://target/CSCOSSLC/config-auth' # AnyConnect handshake endpoint ` ### Fortinet FortiGate / FortiOS `bash curl -skI 'https://target/remote/login' | head -10 # Look for: Set-Cookie: SVPNCOOKIE=, Server header missing or "xxxxxxxx-xxxxx" # Login page contains: "FortiGate", "Fortinet", "SSL-VPN" ` Version: /remote/info sometimes leaks (older), or /login?username= 302 response ### Citrix NetScaler / ADC / Gateway `bash curl -skI 'https://target/' | head -10 # Look for: Set-Cookie: NSC_AAA=, Set-Cookie: NSC_USER=, Server: NetScaler # Login page contains: "NetScaler", "Citrix Gateway" # Version banner curl -sk 'https://target/vpn/index.html' | grep -oE 'NetScaler/[0-9.]+|NS[0-9.]+' curl -sk 'https://target/menu/neo' # 200 if vulnerable to CVE-2019-19781 era ` ### Palo Alto GlobalProtect `bash curl -skI 'https://target/global-protect/login.esp' | head -10 # Look for: Set-Cookie: PHPSESSID= (yes, GP uses PHP), Server: Apache (PA-VM internal) # Page contains: "GlobalProtect Portal", "PAN-OS" # Version banner via login page curl -sk 'https://target/global-protect/login.esp' | grep -oE 'GlobalProtect Portal[\s\S]{0,200}' # Or check meta tag curl -sk 'https://target/global-protect/login.esp' | grep -oE 'panui-[0-9.]+' ` ### Pulse Secure / Ivanti Connect Secure `bash curl -skI 'https://target/dana-na/auth/url_default/welcome.cgi' | head -10 # Look for: Set-Cookie: DSAuthSession=, DSPREAUTH= # Page contains: "Pulse Secure" or "Ivanti Connect Secure" # Version curl -sk 'https://target/dana-na/auth/url_default/welcome.cgi' | grep -oE 'Pulse Connect Secure[^<]*|ivanti[^<]*[0-9.]+' ` ### SonicWall NetExtender / SMA `bash curl -skI 'https://target/cgi-bin/welcome' | head -10 # Look for: Set-Cookie: swap=, swapauth= # Page contains: "SonicWall", "NetExtender", "SMA" ` ### F5 Big-IP / APM ``bash curl -skI 'https://target/my.policy' | head -10 # Look for: Set-Cookie: BIGipSer