Internal Network Pen-Test: A Playbook
External attack surface is well-understood by most security teams. The internal network — what an attacker can do once they are inside, whether via phishing, a compromised laptop, or a malicious insider — is much less understood. Here is what an internal network penetration test looks like.
Network · By Thimmagurudu Bathini · Published · 7 min read · Last reviewed
Landing and reconnaissance
The tester is placed on the network with no credentials, the same position as an attacker who has just compromised a laptop. The first phase is passive: ARP scan to enumerate live hosts, mDNS and NBT-NS broadcasts, LLMNR poisoning to capture hashes from misconfigured Windows clients. Responder picks up plenty in most environments.
Credential capture and lateral movement
Captured NTLM hashes go to a relay attack first (the credentials are usable directly against SMB/HTTP) and to offline cracking second. We map the Active Directory with BloodHound, identifying kerberoastable accounts and unconstrained-delegation hosts. ASREPRoast picks up accounts with pre-auth disabled.
Privilege escalation and impact
From a domain user, testers work toward domain admin via the well-trodden paths: ACL abuse, GPO modification, ADCS misconfigurations (ESC1 through ESC8), legacy MSSQL servers with sysadmin, file shares with credentials in scripts. Impact demonstration is restricted to a non-destructive proof of access.
What the report covers
The report sets out the path from foothold to domain admin, each finding with its CVSS 3.1 score and remediation, and hygiene points for Active Directory such as LAPS, tier-zero separation, the AD recycle bin and KRBTGT rotation.
Written by Thimmagurudu Bathini, BERRY9 IT SERVICES PRIVATE LIMITED, Hyderabad. Questions about your own systems? Request a scoping call or call +91 86868 92922.
Plan your next security test
Tell us what needs testing and when you need it done, and we will propose a scope and timeline. We respond within 24 hours. If you would rather talk first, call or write to us.
- +91 86868 92922
- contact@berry9.com
- H.No: 8-3-945/A/12 & 13, Sri Venkata Sai Nest Apartments, Nagarjuna Nagar Colony, Yellareddyguda, Hyderabad 500073, Telangana