VPN Attacks

VPNs are the remote entry point to the corporate network, and therefore a priority target: compromising a VPN usually gives direct access to the internal network without going through the DMZ. Vectors range from weak credentials and missing MFA to critical CVEs in the appliances themselves (Fortinet, Pulse, Citrix, Cisco), which have been the entry point of countless breaches and ransomware intrusions.

Why they’re a priority target

A compromised VPN places you inside the network, with an internal IP, bypassing the perimeter. For an attacker it’s the dream shortcut: you don’t need pivoting if you enter as a remote employee already. That’s why ransomware groups constantly sweep exposed VPNs for unpatched CVEs and reused credentials.

Red Team — recon and identification

# identify the appliance/VPN
nmap -sV -p 443,500,1194,4500,10443 target
# web fingerprint of the portal (Fortinet, Pulse, Citrix, GlobalProtect...)
curl -sI https://vpn.target.com ; whatweb https://vpn.target.com
# IKE (IPsec) on UDP 500
ike-scan target

Attack vectors

Credentials (the most common)

# password spraying against the VPN portal (see ad-spray)
# reused credentials from leaks (see recon-personas/HIBP)
# no MFA -> a single valid password = internal access

Missing MFA on the VPN is probably the most exploited misconfiguration for initial access.

Appliance CVEs (critical, heavily exploited)

Fortinet FortiOS SSL-VPN  CVE-2018-13379 (path traversal -> credentials),
                          CVE-2022-42475, CVE-2023-27997 (preauth RCE)
Pulse Secure / Ivanti     CVE-2019-11510 (file read),
                          CVE-2023-46805 / CVE-2024-21887 (RCE)
Citrix ADC/Gateway        CVE-2019-19781, CVE-2023-4966 (Citrix Bleed, session theft)
Cisco ASA/AnyConnect      several (CVE-2020-3452, etc.)

These aren’t theoretical: they’ve been the initial vector of massive breaches and ransomware campaigns. Keep a list and cross-reference the identified version.

IPsec/IKE

# IKE aggressive mode -> capture of a crackable PSK hash
ike-scan --aggressive target ; then psk-crack

Impact

Direct access to the internal network as a remote user → from there, internal recon (see Network Service Enumeration), pivoting and, in Windows environments, straight to enumerating the domain (see Active Directory Enumeration). An RCE CVE on the appliance even gives access to the device itself (a privileged position on the perimeter).

For the defense

Mandatory MFA on every VPN — the highest-impact mitigation against credentials/spraying.
Urgent patching of VPN appliances (they’re target #1; CVEs are exploited within days).
Monitoring: logins from anomalous geographies/times, multiple failures (spraying), impossible concurrent sessions.
Least-access principle: the VPN shouldn’t give flat access to the whole internal network; segment and apply NAC/ZTNA.
Rotate credentials after any CVE allowing session/credential theft (e.g. Citrix Bleed).
Consider ZTNA (Zero Trust Network Access) as an evolution over the traditional flat-access VPN.

Testing checklist

Identify the VPN appliance/portal and its version
Cross-reference the version with known CVEs (Fortinet/Pulse/Citrix/Cisco)
Password spraying against the portal (with lockout policy)
Reused credentials from leaks
Is there MFA? (its absence is the key finding)
IKE aggressive mode (PSK capture)
After access: internal recon and path to the domain
Blue: patching, MFA, segmentation, monitoring?