VPN Services

Default Ports: 500/4500 UDP (IPsec/IKE), 1194 (OpenVPN), 51820 (WireGuard), 1723 (PPTP), 1701 (L2TP)

VPN services provide remote access into internal networks. In pentests, VPN testing focuses on exposed portals, weak pre-shared keys, user enumeration, MFA behavior, legacy protocols, and post-login network access.

Connect​

IPsec / IKE​

Start by checking IKE response, aggressive mode, and NAT-T.

ike-scan target.com  
ike-scan -A target.com  
nmap -sU -p 500,4500 target.com  

OpenVPN​

OpenVPN may use UDP, TCP, or TCP 443.

nmap -sU -p 1194 target.com  
nmap -sT -p 1194,443 target.com  
sudo openvpn --config client.ovpn  

WireGuard​

WireGuard may stay silent without valid keys.

nmap -sU -p 51820 target.com  
sudo wg show  

PPTP and L2TP​

PPTP and L2TP are legacy findings worth reporting when exposed.

nmap -p 1723 -sV target.com  
nmap -sU -p 1701 target.com  
nmap -sU -p 500,4500 target.com  

Recon​

Service Detection with Nmap​

Scan both UDP tunnel ports and TCP web portal ports.

nmap -sU -sT -p U:500,4500,1194,1701,51820,T:443,8443,9443,1194,1723 target.com  
nmap -p 443,8443,9443,10443 -sV --script ssl-cert,ssl-enum-ciphers target.com  
nmap -p 1723 --script pptp-version target.com  

Web Portal Discovery​

SSL VPN portals expose vendor, version, login, and MFA behavior.

httpx -u https://target.com -title -tech-detect -status-code -follow-redirects  
curl -I https://target.com/  
curl -I https://target.com/remote/login  
curl -I https://target.com/+CSCOE+/logon.html  

IKE Enumeration​

IKE enumeration identifies transform sets and aggressive mode.

ike-scan target.com  
ike-scan -A target.com  
ike-scan --showbackoff target.com  

Certificate Review​

VPN certificates reveal product names, hostnames, and expiry issues.

openssl s_client -connect target.com:443 -servername target.com </dev/null 2>/dev/null | openssl x509 -noout -subject -issuer -dates  

Enumeration​

Vendor Enumeration​

Identify the appliance before vulnerability or config testing.

httpx -u https://target.com -title -tech-detect -status-code  
curl -sk https://target.com/ | grep -Ei 'fortinet|fortigate|pulse|globalprotect|anyconnect|sonicwall|openvpn'  

User Enumeration​

Login flows may reveal valid users through messages, timing, or MFA prompts.

curl -sk -X POST https://target.com/login -d 'username=test&password=test'  

MFA Enumeration​

Compare behavior for invalid users, valid users, bad passwords, and MFA prompts.

curl -sk -X POST https://target.com/login -d 'username=validuser&password=wrong'  
curl -sk -X POST https://target.com/login -d 'username=invaliduser&password=wrong'  

Profile and Config Review​

Client profiles may expose internal routes, DNS, certificates, and scripts.

grep -Ei 'remote|route|dhcp-option|auth-user-pass|cert|key|script' client.ovpn  
grep -Ei 'AllowedIPs|Endpoint|PrivateKey|DNS' wg0.conf  

Attack Vectors​

IKE Aggressive Mode PSK Capture​

Aggressive mode may expose material for offline PSK cracking.

ike-scan -A target.com --id=groupname -M  
psk-crack -d wordlist.txt ike-scan-output.txt  

Weak Portal Credentials​

Credential attacks must be scoped and rate-limited.

hydra -L users.txt -P passwords.txt https-post-form "/login:username=^USER^&password=^PASS^:Invalid"  

MFA Bypass or Fail-Open​

Test alternate clients, portals, and legacy protocols for inconsistent MFA.

curl -sk https://target.com/  
nmap -p 443,8443,9443,10443 -sV target.com  

Legacy PPTP Exposure​

PPTP is weak compared with modern VPN protocols.

nmap -p 1723 --script pptp-version target.com  

OpenVPN Profile Leakage​

Profiles may embed credentials, private keys, or broad routes.

grep -Ei 'auth-user-pass|BEGIN PRIVATE KEY|redirect-gateway|route ' *.ovpn  

WireGuard Key and Route Issues​

Overbroad AllowedIPs and leaked keys can expose internal networks.

grep -Ei 'PrivateKey|AllowedIPs|Endpoint|DNS' wg*.conf  

Post-Exploitation​

Route Enumeration​

After authorized login, map assigned routes and DNS.

ip route  
ip addr  
cat /etc/resolv.conf  
netstat -rn  

Internal Access Review​

Validate which internal ranges and services are reachable.

nmap -sn 10.0.0.0/24  
nmap -p 22,80,443,445,3389,5985 10.0.0.0/24  

Split Tunnel Review​

Split tunnel configuration affects traffic exposure and monitoring.

ip route | grep -E 'default|tun|wg|ppp'  
traceroute 8.8.8.8  

Logging Check​

Generate controlled failed logins and confirm detection.

curl -sk -X POST https://target.com/login -d 'username=invalid&password=invalid'  

Useful Tools​

Tool| Purpose
---|---
ike-scan| IKE enumeration
psk-crack| IKE PSK cracking
openvpn| OpenVPN client testing
wg| WireGuard config review
nmap| Port and internal scans
httpx| Portal fingerprinting
openssl| Certificate review
hydra| Scoped credential testing

Security Misconfigurations​

Misconfiguration| Risk
---|---
IKE aggressive mode| Offline PSK cracking
Weak VPN credentials| Remote internal access
Missing or inconsistent MFA| Remote access bypass
Legacy PPTP exposed| Weak authentication model
Leaked VPN profiles| Key and route exposure
Broad VPN routes| Excessive internal access
Weak split-tunnel controls| Traffic and policy gaps
Outdated VPN appliance| Known vulnerability exposure