Network Penetration Testing
External perimeter and internal Active Directory, tested the way it's attacked
Unlike a vulnerability assessment, this actively exploits what it finds — because a CVE list tells you what's theoretically wrong, not whether someone can get from a phished laptop to domain admin. We test the external perimeter, then the internal network and Active Directory, working toward an agreed objective the way an intruder would.
What we cover.
- External perimeter — public-facing systems, firewalls, VPNs, DNS
- Internal network assessment from an assumed-breach position
- Active Directory: delegation, credential exposure, escalation paths
- Lateral movement and pivoting toward a defined objective
- Black box, grey box, or white box depending on what you need to prove
How the engagement runs.
Introduction
A network penetration test is a goal-oriented assessment simulating a real attack on your network infrastructure, external and internal. Unlike a vulnerability assessment, it actively exploits what it finds in order to establish the true level of risk.
The objective is to gain unauthorized access, move laterally, and reach a defined objective — then report on how to fix the root causes rather than the symptoms.
Penetration test
Exploits vulnerabilities. Asks: can our weaknesses be used to cause a breach, and how bad would it be?
Vulnerability assessment
Finds vulnerabilities. Asks: what are our weaknesses?
Test phases
Planning and scoping
Establishing the rules of the game — critical for a test that is both safe and useful.
- Objectives and flags — what counts as success? Domain administrator rights, access to a specific database, or retrieving a marker file from a domain controller.
- Scope — every in-scope IP range, subnet, domain, and application listed explicitly, and anything off-limits named just as clearly: production systems, third-party assets, industrial control systems.
- Test type.
- Black box — no prior knowledge, simulating an external attacker
- Grey box — user-level credentials or network diagrams, simulating an insider or someone already past the perimeter
- White box — full knowledge including administrative credentials
- Rules of engagement — signed written authorization, a precise testing window for anything potentially disruptive, a round-the-clock contact channel for critical findings or an emergency stop, and an agreed procedure for handling and purging sensitive data.
Reconnaissance
- Passive reconnaissance — DNS enumeration, identifying the public IP blocks you own, harvesting staff names and email formats from public sources, and searching for leaked credentials or code.
- Active reconnaissance.
- Host discovery — sweeping in-scope ranges to find live hosts
- Port scanning — comprehensive TCP and UDP scans across the full port range
- Service enumeration and versioning — fingerprinting exact service versions, which is what makes matching to known exploits possible
- Operating system fingerprinting
Vulnerability analysis
- Vulnerability mapping — correlating enumerated services and versions against public vulnerability databases, running a scanner non-intrusively for a baseline, then manually verifying every finding.
- Attack vector identification — prioritising entry points by exploitability and impact. For example: a host running a version with known remote code execution; a host with anonymous file-sharing login enabled; a VPN portal exposed to password spraying.
Exploitation
- Service exploitation — exploiting known vulnerabilities in reachable services to obtain the initial foothold.
- Password attacks.
- Password spraying — a small set of likely passwords tried across many usernames, against VPN, webmail, or SSH
- Brute forcing — where a login portal lacks rate limiting
- Man-in-the-middle — on internal tests and where permitted, intercepting and relaying traffic to capture authentication hashes.
- Post-exploitation — only with explicit documented authorization.
- Internal reconnaissance — repeating discovery from the new internal vantage point, mapping topology and identifying high-value targets such as domain controllers, file servers, and databases
- Privilege escalation — on Windows: weak service permissions, unquoted service paths, stored credentials, missing patches. On Linux: SUID binaries, weak permissions on credential files, sudo misconfiguration, kernel exploits
- Lateral movement — pass-the-hash and pass-the-ticket to authenticate without plaintext passwords, and reuse of credentials across file sharing, SSH, and remote desktop. The usual end goal is domain administrator, which constitutes total compromise
- Persistence — a backdoor that survives reboot or credential rotation: a new account, a planted webshell, or a scheduled task calling back out
Reporting
- Executive summary for management, focused on business impact and risk.
- Attack narrative — a step-by-step walkthrough of the whole attack from reconnaissance to post-exploitation. Usually the most valuable part of the report.
- Vulnerability details — description, evidence, and risk rating for every issue exploited or found.
- Remediation aimed at root cause: a patch management programme, not just this one patch.
Remediation and re-testing
- Debrief meeting to present the findings.
- Targeted re-test after fixes to validate each issue is genuinely closed.
What you get at the end.
Who it's for
Organizations with meaningful on-premise or hybrid infrastructure, especially Active Directory estates.
Need a scope for this engagement?
Tell us what's in your environment and we'll come back with a scoped plan.