Network penetration testing
We test your network from the internet, against your public IP ranges, VPN gateways and exposed services, and from inside, where segmentation, lateral movement and stored credentials decide how far one compromised laptop can go. Based in Hyderabad, testing networks for companies across India.
- Engagements
- External, internal, assumed breach
- 3 to 5 external IPs
- from INR 9,000 + 18% GST
- Internal and larger
- from INR 27,000 + 18% GST
- Typical duration
- 5 to 10 working days
Last reviewed
Pathinternet → F-01 → DMZ → F-02 → server network → F-03 → admin network
Also mappeduser network
- F-01A monitoring dashboard on a public IP address still accepts its default administrator passwordHigh
- F-02A firewall rule lets hosts in the DMZ open connections into the server networkMedium
- F-03A file share on the server network holds a deployment script with an administrator passwordHigh
- ChainThree separate weaknesses join into one route from the internet to the admin networkCritical
01 / Who needs it
Who needs network penetration testing
Networks tend to fail at their boundaries: between cloud and on-premises systems, between a parent company and its subsidiaries, and between a firewall rule written years ago and the way the network is used today. A penetration test finds the route across those boundaries before someone else does.
A network test is for any organization whose systems can be reached from the internet, or whose staff, servers and devices share an internal network. That covers most businesses, so the more useful question is which situation you are in, because that decides whether the test should look from outside, from inside, or both.
Your public footprint has grown
A new VPN gateway, a remote-access portal, a monitoring tool opened up for a vendor, a test server nobody switched off. Each one is an address that anyone on the internet can find and probe, and an external test shows which of them answer and what they give away.
Staff work on a shared office network
A phishing email, a stolen laptop or a contractor's device plugged into a spare port puts an attacker inside. An internal test measures how far that foothold reaches: which servers it can talk to, which credentials it can pick up and how close it gets to the systems the business runs on.
You rely on segmentation to keep things apart
Guest Wi-Fi, development, production, payment systems and building devices are meant to sit in separate zones. Segmentation testing checks that the walls between those zones hold in practice, and not only on the network diagram.
A small business with a few public addresses
If your exposure is a handful of addresses, such as a firewall, a mail server and a VPN endpoint, the starter scope fits: a defined external check of 3 to 5 IP addresses with a written report, at the starter price.
Plant networks next to office IT
In manufacturing, the line between the corporate network and the operational technology (OT) that runs production is a segmentation question. We review the separation between corporate IT and plant systems, and the partner connections that cross it.
An assessor, auditor or customer has asked
Card-payment assessments, ISO 27001 audits, SOC 2 reports and enterprise security questionnaires often come with a request for recent, independent evidence that the network was tested. A network report is that evidence.
Sectors we cover
- Healthcare
- Pharma
- Education
- Manufacturing
- Media and VFX
- Enterprise IT
02 / What we test
What a network penetration test covers
A network test can look at your systems from two sides, from the internet and from inside, and can add segmentation, cloud network settings and wireless to the same engagement. The scope is agreed before work starts, so you choose which of these apply.
External perimeter
Your public IP ranges and everything that answers on them: VPN gateways, firewalls and other edge devices, mail and file-transfer servers, remote-access portals, and any management or monitoring interface reachable from the internet. We look for exposed services, software versions with known vulnerabilities, and default or weak credentials.
Internal network
Starting from an ordinary connection inside the network, we map the hosts and services that answer, look for credentials that are stored or sent where they can be read, and test how far an attacker can move laterally, from machine to machine and from one zone into the next.
Assumed breach
Rather than spend the budget on breaking in, the test begins as if an attacker already holds a low-privilege seed, such as a regular employee's account and a connection to the office network, and measures what that seed can grow into.
Segmentation
Whether each zone can reach only what it should: guest to corporate, development to production, building and IoT devices to file servers, and any segment that holds card or other regulated data. The result is a view of what is reachable from where.
Cloud network settings
The network layer of AWS, Azure and GCP environments: virtual private clouds (VPCs), peering between them, security groups and the IAM boundaries that decide who may change them. Hybrid links between cloud and on-premises networks can be part of the same test.
Wireless
Wireless networks and rogue device detection. Wireless testing needs someone within radio range of your access points, so it is carried out on-site by arrangement.
Windows domains have a service of their own. If your internal network runs Active Directory, the directory is usually where an intruder heads once inside, and our Active Directory penetration testing service examines it in depth; it can run alongside a network test in the same engagement.
03 / External or internal
External and internal network tests compared
The two tests answer different questions, so they surface different problems. Many organizations run both, at different points in the year.
Show details for External and internal network tests compared
| Aspect | External test | Internal test |
|---|---|---|
| The question it answers | What can someone on the internet reach, and what can they do with it? | If an attacker is already inside, how far can they get? |
| Starting point | Your public IP addresses, with no access granted | A connection inside your network with the access of a regular employee |
| What gets tested | VPN gateways, firewalls, remote-access portals, mail servers and exposed management interfaces | Servers, workstations, file shares, internal applications, network devices and the boundaries between zones |
| Access you provide | The address ranges in scope and written authorization to test them | A VPN credential, a jump host or an on-site connection, plus the ranges in scope |
| Findings it tends to surface | Exposed admin interfaces, outdated services with known vulnerabilities, default credentials | Segmentation gaps between zones that should be separate, credentials on open shares |
| Starting price | From INR 9,000 + 18% GST for 3 to 5 IP addressesLarger external ranges start from INR 27,000 + 18% GST | From INR 27,000 + 18% GST |
Neither test replaces the other. A clean external result tells you nothing about the inside once a phishing email has done its work, and a well-segmented inside does not help if a management console is open to the internet. Running both gives a fuller picture than either alone.
04 / Method
How a network penetration test runs
Every network engagement moves through the same five phases. We do not stop at listing what is exposed: we exploit what we find, pivot from it and document the route an attacker would take.
Show details for How a network penetration test runs
Phase 1
Scope and rules of engagement
Before a single packet reaches your network, both sides sign a document listing the IP ranges and hosts in scope, the testing windows, the intensity of active scanning, the emergency contacts on each side and the conditions under which testing stops. Fragile systems can be excluded or given quiet-hour windows, and any hard stop is agreed in writing at this point.
OutputSigned rules of engagement
Phase 2
External enumeration
Passive reconnaissance comes first: certificate transparency logs, DNS records and search engines show which names and addresses belong to you, sometimes including ones your team had forgotten. Active work follows: port scanning, identifying the service and version behind each open port, and fingerprinting edge devices such as firewalls and VPN gateways.
OutputMap of exposed hosts and services
Phase 3
Internal pivot and lateral movement
From the assumed-breach foothold we work out what the network will let us do: which hosts answer, which shares and services accept the access we hold, and whether the network hands out other users' authentication through legacy name-resolution protocols or relay attacks. Each zone we can reach is compared with the segmentation you intended.
OutputReachability map and the most efficient route
Phase 4
Privilege escalation and impact
We pursue the route that looks most promising toward the systems that matter to you, such as finance servers, backups or the admin network, and prove each step before taking the next. Impact is shown by demonstrating the access an attacker would have; anything beyond that is agreed in writing first.
OutputThe route proven step by step, or where it stopped
Phase 5
Reporting
A topology diagram of the path we took, findings written up host by host with reproduction steps and the fix, the techniques used mapped to MITRE ATT&CK, and a remediation roadmap your team can schedule.
OutputExecutive and engineering reports
An external-only test spends most of its effort in phase 2 and then tries to exploit what it found. The VAPT methodology page describes the approach we take on every kind of test.
05 / Common findings
Findings that come up in network tests
The examples below describe the kinds of issue network tests commonly turn up. They are generic, not taken from any client, and several of them are configuration that drifted over time rather than a missing patch.
Show details for Findings that come up in network tests
| Finding | What it looks like | What the report gives your team |
|---|---|---|
| Admin interfaces exposed on the external perimeter | Build servers, code repositories, log search tools and monitoring dashboards (Jenkins, GitLab, Kibana, Grafana and the like) reachable on a public IP address, with default credentials or a known CVE in the installed version. | The address, port and version, how access was gained, and the fix: take the interface off the internet, update it and change the credentials. |
| A guest network that reaches the corporate network | A visitor network meant to offer internet access only can open connections to internal systems. | The exact path, and the rule or setting that allows it. |
| A development network that reaches production | Test and development systems, often run with looser controls, can connect to production servers and databases. | Which development hosts reach which production services, and the filtering change that closes the gap. |
| Devices in an IoT segment that file servers trust | Cameras, printers, badge readers and similar devices sit in a segment that file servers accept connections from, so a weak device becomes a way in. | The devices and servers involved, and how to restrict what the segment may reach. |
| File shares leaking credentials | Shares open to every user that hold deployment scripts, web.config files or password databases (KeePass files, for example) with credentials that work elsewhere on the network. | Each share and file, what the credentials opened, and the clean-up and password changes needed. |
Segmentation gaps are often discovered as a side effect of lateral movement testing rather than by reading firewall rules: the gap shows up when a host we should not be able to reach answers. Individually, several of these seem minor. The report shows how they join up, so your team can see which single change cuts a route closest to its start.
06 / What you get
What the network report gives you
Two readers get what they need from the same engagement: the people who decide on budget and risk, and the administrators who change firewall rules and patch hosts.
Show details for What the network report gives you
- An executive report in plain language: what was tested, how far an attacker got and what to fix first.
- Per-host findings with reproduction and remediation: each finding tied to an address and port, with a proof of concept your team can use to confirm it before changing anything.
- Severity scored with CVSS 3.1 and weighed against what the host does in your network.
- A topology diagram of the path we took through your zones, readable by someone who never saw the test.
- A per-boundary segmentation view showing what is reachable from where, when segmentation is in scope.
- MITRE ATT&CK technique coverage, so a detection team can check what their monitoring saw.
- A remediation matrix tied to the controls your audit framework asks about.
Our sample VAPT report shows the full structure of a BERRY9 report. The address in the example report comes from a range reserved for documentation, not from any real network.
Finding F-01 · External network
Monitoring dashboard on a public IP address accepts the default administrator password
- Severity
- High
- CVSS 3.1
- 8.2
- Affected
- 203.0.113.24, TCP 3000
- Tested as
- Unauthenticated, from the internet
Steps to reproduce
- A port scan of the agreed public range finds a dashboard login page on 203.0.113.24, port 3000.
- The vendor's default administrator credentials are accepted.
- The admin panel shows stored connection settings for internal systems, which turns one exposed dashboard into a map of the internal network.
Fix
Remove the dashboard from the internet or restrict it to the VPN, change the default credentials, update the software and review who has signed in.
Example layout, not client dataCVSS 3.1 · ATT&CK T1078.001
07 / Price
Network penetration testing price
A small external scope of 3 to 5 IP addresses starts from INR 9,000 + 18% GST. Internal tests and larger networks start from INR 27,000 + 18% GST, and larger scopes cost more.
External starter scope
Starts fromINR 9,000 + 18% GST
The starter scope is priced from INR 9,000 + 18% GST for small scopes such as 3 to 5 external IP addresses or a simple WordPress website, including a vulnerability scan, manual checks, a written report and one free retest.
Internal testing, and external ranges larger than the starter scope, start from INR 27,000 + 18% GST.
- 3 to 5 external IP addresses
- Vulnerability scan and manual checks
- A written report
Internal and larger network tests
Starts fromINR 27,000 + 18% GST
The starting point for internal, assumed-breach and segmentation tests, and for external ranges beyond the starter scope. The figure for your network is set once the scope is known, and four things drive it:
- IP addresses and hosts. Each live address and each host is something to enumerate, probe and write up.
- Segments. Every zone, and every boundary where two zones meet, adds reachability checks.
- Environments. Production, staging and disaster-recovery networks, or on-premises and cloud, are separate pieces of work.
- Locations. Several offices, plants or data centers mean more networks to reach and, for on-site work, more visits.
Cloud network reviews and wireless testing are advanced scopes: the final price is set in a written proposal after scoping.
The VAPT cost guide for India explains how scope becomes price for every kind of test.
08 / Before testing
What we need from you, and where we test from
A network test touches infrastructure that several teams may own, so it needs a little more preparation on your side than most application tests. Most of it is settled in the scoping call.
Show details for What we need from you, and where we test from
Over the internet
External tests run remotely from our Hyderabad office against your public addresses, so nothing needs to be installed on your side.
Remotely, inside your network
Internal and assumed-breach tests run from our office through a VPN credential or a jump host you provide, wherever the network is.
On-site, by arrangement
Where remote access is not possible, or for wireless testing, the work can be done at your premises by arrangement.
What we need from you
- IP ranges and hostnames in scope, and anything that is explicitly out of scope.
- Confirmation that you may authorize testing of every address, including addresses hosted by a third party or a cloud provider.
- A network diagram, even a rough one, so the network you intended can be compared with the one we find.
- Signed rules of engagement: testing windows, scanning intensity, stop conditions and emergency contacts.
- For internal tests, a way in: a VPN credential or a jump host with the access of a regular employee, or an on-site connection by arrangement.
- A word to whoever watches your alerts, so your monitoring team or provider knows the test is planned. External tests run from fixed source IP addresses that you can allow-list or watch for.
BERRY9 has one office, in Hyderabad. A network in Bangalore, Chennai, Kochi or anywhere else in India is tested from there in the same way: external work over the internet, internal work through the access you provide, and a visit only when the test needs one.
City pages
09 / Turnaround and retest
How long a network test takes
Most network tests take 5 to 10 working days. Where yours falls depends on the number of addresses and hosts, how many segments there are to check and whether internal access is ready on the first day.
Show details for How long a network test takes
- Working days for most network tests
- 5 to 10
- Scope, enumeration, lateral movement, escalation and reporting
- 5 phases
A VPN account or jump host that takes days to set up delays the start of an internal test, so it helps to request that access as soon as the dates are fixed.
The starting price for small scopes includes one free retest. For larger scopes, the retest terms are written into the proposal before work starts.
10 / Compliance
Network testing for PCI DSS, ISO 27001 and SOC 2
Network tests are often commissioned to produce evidence for a standard. The report shows what was tested and what was found; what the standard asks of you, and whether the evidence is enough, is for your assessor or auditor to confirm.
Show details for Network testing for PCI DSS, ISO 27001 and SOC 2
PCI DSS
PCI DSS 4.x requirement 11.4 calls for internal and external penetration testing and, where segmentation is used to isolate the cardholder data environment from other networks, for tests that confirm the segmentation controls work. Ask your assessor for their requirement and share it when we scope the test.
ISO 27001
Annex A of ISO/IEC 27001:2022 includes controls for managing technical vulnerabilities (8.8) and for network security and the segregation of networks (8.20 and 8.22). Network findings, tracked to closure, feed those controls. BERRY9 holds ISO/IEC 27001:2022 certificate 26MEQVU27.
SOC 2
SOC 2 does not require a penetration test. Its criteria ask for controls that find and manage vulnerabilities, penetration testing is one common way to show that, and your auditor decides what evidence is enough. A network report covering your production environment is one piece of that evidence.
We test and report. Certification, attestation and the result of an assessment belong to your auditor or assessor, not to BERRY9.
11 / Inquiry
Send us your network scope
Tell us roughly how many public IP addresses you have, whether the test is external, internal or both, how many sites and segments are involved, and when it needs to be done. We will come back with a scope and timeline.
To talk it through first, call +91 86868 92922 or write to contact@berry9.com. For the application side of your estate, see our web application, mobile application and API security testing.
12 / FAQ
Frequently asked questions
Short answers about scope, price and how testing works. For anything else, call +91 86868 92922.
What is the difference between an external and an internal network penetration test?
An external test looks at your network the way someone on the internet sees it: your public IP addresses, VPN gateways, firewalls and any service exposed to the outside. An internal test starts from inside, with the access of a regular employee, and measures how far an attacker could move from there. They find different problems, and many organizations run both at different points in the year.
How many IP addresses does the starter scope cover?
The starter scope covers 3 to 5 external IP addresses. More addresses, or any internal testing, start from INR 27,000 + 18% GST. See the section on Network penetration testing price above.
How much does network penetration testing cost?
A small external scope of 3 to 5 IP addresses starts from INR 9,000 + 18% GST. Internal, assumed-breach and segmentation tests, and larger external ranges, start from INR 27,000 + 18% GST. The final figure depends on the number of addresses and hosts, segments, environments and locations in scope. See the section on Network penetration testing price above.
Can you test our internal network remotely, or do you need to be on-site?
Internal tests can be run remotely from our Hyderabad office, through a VPN credential or a jump host placed in your network, holding the access a regular employee has. Where remote access is not possible, or for wireless testing, the work is done on-site by arrangement.
What is the difference between a network penetration test and an Active Directory penetration test?
A network test covers the perimeter, the internal network, segmentation between zones and, where agreed, cloud networks and wireless. An Active Directory test focuses on the Windows domain itself: its accounts, groups, permissions and trusts, and whether an ordinary account can climb to control of the domain. On an internal network that runs Active Directory, the two can be scoped together.
Do you test wireless networks?
Yes. Wireless networks and rogue device detection can be added to a network test. Wireless testing needs someone within radio range of your access points, so it is done on-site by arrangement, and as an advanced scope its final price is set in a written proposal after scoping.
Does a network test include our cloud infrastructure?
It can. The cloud network fabric, meaning VPCs, peering, security groups and IAM boundaries, can be tested on AWS, GCP and Azure, along with hybrid links between cloud and on-premises networks. Cloud work is an advanced scope, so its final price is set in a written proposal after scoping.
Do you do network segmentation testing for PCI DSS?
Yes. It can be booked as a test in its own right or folded into an internal test. For each boundary, the report shows which zones can reach which, backed by a topology diagram. Your PCI assessor decides what scope and frequency apply to you, so it helps to share their requirement when the test is scoped.
How long does a network penetration test take?
Most network tests take 5 to 10 working days. See the section on How long a network test takes above.
What does a network VAPT report contain?
An executive report for management and an engineering report for your administrators: per-host findings with reproduction steps, a proof of concept and the fix, severity scored with CVSS 3.1, a topology diagram of the path taken, MITRE ATT&CK technique coverage and a remediation matrix.
Will a network penetration test disrupt our systems?
Testing is designed to be safe. Scanning intensity and testing windows are set in the rules of engagement, fragile systems can be excluded or tested at quiet hours, and every hard stop is put in writing before any testing starts. Emergency contacts on both sides are named in the same document in case anything unexpected happens.
Do you test networks for companies outside Hyderabad?
Yes. BERRY9 has one office, in Hyderabad. External tests run over the internet and internal tests through a VPN or a jump host, so a company in Bangalore, Chennai or any other Indian city is tested the same way, with on-site work by arrangement.