Bidhan Sthapit

Logging my devops journey

6 minute read

Analyzing Public Network Architecture, Device Fingerprinting, and Vulnerability Enumeration

This case study documents a real-world network reconnaissance and troubleshooting session conducted on a public fiber-optic network. It details the journey from initial network communication failures to comprehensive subnet mapping, service tracking, and security posture validation using industry-standard diagnostic methodologies.

1. Executive Summary

  • The Problem: A client workstation successfully associated with a public Wi-Fi access point (Kaiser Library 5G) but failed to achieve internet routing due to a missing default gateway assignment.
  • The Root Cause: The infrastructure utilized a consumer/residential-grade GPON Home Gateway supplied by Bell Canada. These devices frequently freeze, experience memory leaks, or exhaust their pool of 253 allocatable Dynamic Host Configuration Protocol (DHCP) addresses under heavy public congestion.
  • The Solution & Strategy: By transitioning into an adversarial/pentesting mindset, we mapped the active subnet layer using ARP requests, discovered the hidden gateway path, and manually bypassed the collapsed DHCP infrastructure with a statically provisioned routing configuration to establish network line-of-sight.

2. The Mindset: Transitioning from Troubleshooting to Penetration Testing

When a network behaves unpredictably, a standard user stops at resetting their network adapter. A security analyst or penetration tester uses the failure as an invitation to understand the network’s internal mechanics. The analytical thought process followed this progression:

[Isolate Local Faults] ➔ [Map Neighbors (ARP)] ➔ [Identify Core Infrastructure] ➔ [Enumerate Entry Points] ➔ [Validate Defenses]
  1. Hypothesis Generation: A self-assigned IP (169.254.x.x) means the physical Wi-Fi layer works, but the layer 3 configuration handler is dead.
  2. Environmental Assessment: Public libraries feature a high churn rate of random devices. The odds of IP pool exhaustion or an unauthenticated captive portal filtering traffic are high.
  3. Target Prioritization: Regular users are background noise. The primary target is always the infrastructure routing device. Control the router, and you control the downstream security context of the network.

3. Phase 1: Subnet Blueprinting & Live Host Discovery

To safely interact with the network, a fast ping scan using Address Resolution Protocol (ARP) was initiated. On local local subnets, standard ICMP (ping) traffic is often discarded by aggressive host firewalls. ARP queries cannot be ignored at layer 2, ensuring absolute discovery accuracy.

# Executing an un-intrusive ARP ping sweep across the 24-bit block
sudo nmap -sn -PR 192.168.1.0/24

The Subnet Architecture Map

Subnet audits over a brief chronological window showed active user endpoints swelling from 8 to 17 concurrent hosts. These hosts fell into three distinct architectural categories:

Target IP MAC Organization Registration (OUI) Implied Device Profile Security State
192.168.1.254 Taicang T&W Electronics Core Fiber GPON Router Gateway Open / Accessible
192.168.1.81 Intel Corporate Windows Developer Workstation Highly Hardened
192.168.1.188 Unknown (Randomized) Modern Android Smartphone Protected
192.168.1.85 Cloud Network Technology Integrated Consumer IoT / Tablet Closed
  • The Privacy Layer: The majority of mobile devices returned an Unknown hardware manufacturer flag. This confirms that contemporary mobile operating systems (iOS/Android) successfully enforce local MAC address randomization policies to defeat passive public Wi-Fi tracking.

4. Phase 2: Granular Service Enumeration & Target Triage

Once the network topography was mapped, attention turned to deep-dive version scanning (-sV), targeted scripting engine queries (--script), and full 65,535 TCP port verification (-p-) across three high-value targets.

Target A: The Strategic Target — GPON Home Gateway (192.168.1.254)

  • Thought Process: Embedded systems dictate the security baseline of the building. If the administrator left web configurations or command shells open, we can read the structural posture of the network.
  • Reconnaissance Execution: 
    sudo nmap -p 22,80,443 -sV --script=http-title,http-server-header dsldevice.lan
  • Discovered Intelligence:
    • Management Interfaces: Port 22 (SSH) and Ports 80/443 (HTTP/HTTPS) are fully open.
    • The Software Stack: Run by an outdated branch of Dropbear sshd 2020.81 and a lightweight unmaintained web wrapper called thttpd.
    • Source Code Leak Analysis: Querying the raw HTTP headers using curl -i -k exposed embedded JavaScript mechanics. The router attempts defense-in-depth by rendering an explicit RSA Public Key into the global webpage DOM to perform client-side encryption on login inputs before posting to /login.cgi.

Target B: The Developer Target — Windows Workstation (192.168.1.81)

  • Thought Process: This workstation stood out during basic sweeps due to open high-profile database management services, indicating it likely belongs to a software developer.
  • Reconnaissance Execution: 
    sudo nmap -p- -v --script=vuln 192.168.1.81
  • Discovered Intelligence:
    • A comprehensive full-port sweep uncovered two hidden open ports omitted by standard scans: Port 7680 (Windows Update Delivery Optimization) and Port 33060 (MySQL X-Protocol).
    • Attempting direct connection vectors using native database utilities (mysql -h 192.168.1.81 -u root -p) returned a hard access block: ERROR 1130 (HY000): Host is not allowed to connect.
    • Pentester Assessment: Looking at the results, while the node exposes dangerous listening sockets, it relies on strict Access Control Lists (ACLs) built into the MySQL software stack that completely isolates root capabilities from external subnet segments.

5. Critical Vulnerability Mapping & Exploration Paths

For an active penetration tester, version footprints are transformed into an exploitation path by matching profiles against active CVE (Common Vulnerabilities and Exposures) registries.

[Exposed Services Discovered]│┌─────────────────────┴─────────────────────┐▼                                           ▼[Dropbear 2020.81]                           [thttpd Server]│                                           │▼                                           ▼Audit authentication handshakes             Fuzz for Buffer Overflowsand look for info-disclosure bugs           via malformed HTTP request headers
  1. The Infrastructure Threat: The legacy thttpd runtime environment lacks modern thread security controls. A typical pentesting avenue involves fuzzing HTTP inputs to cause buffer overflow constraints, potentially crashing the library’s router or triggering Remote Code Execution (RCE).
  2. Broken Function Access Screening: The gateway source code exposed unlinked application assets like reg.cgi. Pentesters prioritize testing these individual CGI scripts to determine if they can bypass the public login gate entirely due to broken session token validations.

6. Key Takeaways for Network Defenders

  1. Never Deploy Consumer Tech at Scale: Utilizing a basic residential GPON firmware gateway in high-density environments causes immediate availability failures (collapsed DHCP distribution) even if its internal firewall remains uncompromised.
  2. Local Authorization Trumps Firewalls: As proved by the Windows workstation (.81), exposing service ports (like MySQL) to an untrusted public Wi-Fi network creates a broader target footprint, but application-level host blocking and strong user constraints effectively neutralize external breach attempts.
  3. Reconnaissance Speed: Combining silent ARP polling with explicit script definitions delivers near-instant network visibility, validating that an attacker can cleanly blueprint an unfamiliar network topology in less than five minutes.

7. Strategic Remediation & Hardening Guide

To secure a public access environment like a library network against unauthorized reconnaissance and potential exploitation, network administrators must transition away from default consumer configurations. Implementing the following defensive controls will mitigate the vulnerabilities uncovered during this assessment:

1. Hardening the Gateway Infrastructure

  • Isolate Management Planes: Enforce strict firewall rules on the GPON gateway to block all access to Port 22 (SSH) and Ports 80/443 (HTTP/HTTPS) from the Wi-Fi client network interface. Management dashboards should only be accessible via a dedicated, physically wired management VLAN or a secure administrative VPN.
  • Decommission Outdated Daemons: Replace legacy, unmaintained web servers like thttpd and update older SSH environments (such as Dropbear 2020.81). If the ISP firmware restricts software upgrades, the hardware should be bridged to a dedicated enterprise security router that receives modern patch cycles.
  • Implement Client Isolation: Enable Access Point (AP) Isolation on the wireless controller. This layer 2 security feature prevents connected Wi-Fi clients from communicating with or scanning one another, immediately neutralizing subnet discovery sweeps (like Nmap ARP sweeps).

2. Resolving Resource Depletion (DHCP Exhaustion)

  • Shorten Lease Times: Public networks experience high client turnover. Reduce the DHCP lease duration from the default 24 hours down to 30 or 60 minutes. This ensures that IP addresses from disconnected users are aggressively reclaimed and recycled back into the pool.
  • Expand the Subnet Scope: Move away from a restrictive 24-bit subnet (192.168.1.0/24, which maxes out at 254 addresses). Transitioning to a 22-bit subnet mask (e.g., 255.255.252.0) instantly expands the available address pool to 1,022 concurrent slots, preventing gateway exhaustion during peak hours.

3. Endpoint Best Practices for Users

  • Bind Services to Localhost: Software developers running database engines (like MySQL/MariaDB) or web frameworks on their local machines should explicitly configure services to listen on the loopback address (bind-address = 127.0.0.1). This ensures that even if local host firewalls fail, the services remain invisible to public network neighbors.
  • Maintain Host Firewalls: Keep public network profiles active on operating systems (e.g., Public Network mode in Windows Defender). This ensures that unshared ports drop incoming connection probes silently, effectively mitigating scanning scripts.

You May Also Enjoy