Internal Network Penetration Test
Testing internal networks from an initial foothold to identify vulnerabilities, capture credentials, move laterally, and demonstrate business impact. Covers host discovery, service enumeration, vulnerability exploitation, credential attacks, and lateral movement through segmented networks.
Host Discovery and Network Mapping
Map the internal network to identify all live hosts, subnets, and network boundaries. Use multiple discovery techniques including ARP scanning for the local subnet, ICMP sweeps, and TCP/UDP probes for hosts that block pings. Identify network devices (routers, switches, firewalls) and determine the network topology. Understanding the network layout is essential before targeted scanning.
Nmap
RustScan
MasscanTip: Start with ARP scanning on the local subnet - it's fast, reliable, and works even when ICMP is blocked. Use Nmap's -sn flag for ping sweeps across known ranges. Masscan can sweep large ranges quickly but is noisy. Check for VLAN hopping opportunities if you're on a trunk port. Document the network topology as you discover it.
Port Scanning and Service Enumeration
Scan discovered hosts for open ports and identify running services with version information. Start with the most common ports, then do a full 65535-port scan on high-value targets. Service version detection helps identify vulnerable software, and Nmap's scripting engine can automatically check for common vulnerabilities and extract additional information from services.
fscanTip: RustScan finds open ports in seconds, then hands off to Nmap for service detection. fscan is excellent for rapid internal scanning with built-in vulnerability checks. Use Nmap's -sV for version detection and -sC for default scripts. Don't skip UDP scanning (-sU) - SNMP (161), TFTP (69), and NTP (123) are frequently overlooked attack vectors.
Vulnerability Assessment
Identify exploitable vulnerabilities across discovered services. Check for known CVEs against detected software versions, test for default credentials on management interfaces, and look for misconfigurations in common services. Prioritize vulnerabilities that provide code execution or credential access over information disclosure.
Tools for this step
Metasploit Framework
THC HydraTip: Nmap's NSE vulnerability scripts (--script vuln) catch common issues quickly. Metasploit's auxiliary scanners test for specific vulnerabilities across multiple hosts. Hydra tests for default and weak credentials on services like SSH, FTP, SMB, and web interfaces. Check for eternal blue (MS17-010) on SMB services - it's still surprisingly common on internal networks.
Credential Attacks and Hash Harvesting
Attack authentication services to capture credentials. Poison LLMNR/NBT-NS/mDNS to capture NTLMv2 hashes from the network. Spray commonly used passwords against discovered services. Attempt relay attacks to forward captured authentication to other services. Credentials are the keys to lateral movement, so invest time here.
Tools for this step
Responder
CrackMapExec
HashcatTip: Responder captures NTLMv2 hashes passively by poisoning name resolution requests - run it and wait. CrackMapExec can spray passwords across SMB, WinRM, LDAP, and MSSQL simultaneously. Crack captured hashes with Hashcat using GPU acceleration. Start password spraying with seasonal patterns (Summer2024!, Company123) before moving to large wordlists.
Lateral Movement
Use captured credentials and exploited vulnerabilities to move through the network. Execute commands on remote systems via SMB, WinRM, WMI, or SSH. Pivot through compromised hosts to reach network segments you couldn't access from your initial position. Each new host you compromise gives you access to new credentials and new network segments.
Tools for this step
Impacket
Chisel
Ligolo-ngTip: CrackMapExec tests credentials across the network in seconds and can execute commands on accessible hosts. Impacket's wmiexec, smbexec, and psexec provide different execution methods with different forensic footprints. Chisel and Ligolo-ng create tunnels for pivoting through compromised hosts. Keep a credentials spreadsheet mapping which creds work on which hosts.
Privilege Escalation
Escalate privileges on compromised hosts from standard user to local administrator or root. Check for kernel vulnerabilities, misconfigured services, unquoted service paths, weak file permissions, stored credentials, and scheduled task abuse. On Linux, check for SUID binaries, sudo misconfigurations, and writable cron jobs.
Tools for this step
MimikatzTip: Mimikatz extracts plaintext passwords, hashes, and Kerberos tickets from Windows memory. Check for AlwaysInstallElevated registry keys on Windows. On Linux, LinPEAS automates privilege escalation enumeration. Look for credentials in configuration files, environment variables, and command history. Service accounts often have higher privileges than expected.
Data Access and Impact Demonstration
Demonstrate the business impact of the vulnerabilities you've exploited. Access sensitive file shares, databases, and applications using the privileges you've gained. Show what an attacker could do with this level of access - read customer data, modify financial records, access source code, or pivot to additional environments. The goal is to make the risk concrete for decision-makers.
Tools for this step
Tip: CrackMapExec can enumerate and access shares across the network. Use Impacket's mssqlclient to access database servers with captured credentials. Document everything you access with screenshots and timestamps. Focus on data that resonates with business leadership - customer PII, financial data, and intellectual property.
Report and Attack Narrative
Write a report that tells the story of the attack from initial foothold to final impact. Include every step with evidence: how you discovered each vulnerability, how you exploited it, what access it gave you, and how you used that access to move further. Provide a prioritized remediation plan that addresses the root causes, not just individual findings.
Tip: Structure the report as an attack narrative that non-technical executives can follow. Include a one-page executive summary with the worst-case business impact. Map each finding to a remediation action with effort estimates. Group remediations by effectiveness - fixing credential reuse and LLMNR poisoning eliminates more attack paths than patching individual CVEs.
Other Workflows
OSINT Investigation Workflow
A structured approach to open-source intelligence gathering, from target identification through to reporting. Covers passive reconnaissance, social media analysis, email and phone lookups, and data correlation.
Web Application Penetration Test
A systematic approach to testing web applications for security vulnerabilities. Covers reconnaissance, mapping, vulnerability discovery, exploitation, and reporting.
Active Directory Attack Path
From initial foothold to domain admin. A step-by-step approach to enumerating and attacking Active Directory environments during authorized penetration tests.