Network Penetration Testing

ENG-2026-019 · External + internal · assumed breachAttack path AP-02 · Internet to Domain Admin in 6 steps

Break the chain earliestEnforcing SMB signing domain-wide (step 3) removes this path and 2 others.

Hosts on the attack path
Host	Address	OS	Open services	Top issue	Severity
DC-01	10.20.0.10	Windows Server 2019	53, 88, 389, 445, 636	Unconstrained delegation on legacy service account	Critical
FS-02	10.20.4.22	Windows Server 2016	135, 139, 445, 3389	SMB signing not required	High
vpn.example.com	203.0.113.24	Appliance	443, 4433	No lockout or MFA on portal login	High
BKP-01	10.20.9.5	Ubuntu 20.04	22, 873, 9000	Unauthenticated rsync exposes backups	High
PRN-3F	10.20.12.40	Embedded	80, 443, 9100	Default admin credentials	Medium

Illustrative product view · sample data

Scope

Test from outside the wall, and from behind it.

Experts run the engagement. Between engagements, the Attack agent re-checks your external perimeter and every path a tester proved, every day.

Testing approach

Start with nothing, a standard domain user, or full network documentation.

Black box: IP ranges only. Shows exactly what an outsider can discover and exploit with no prior knowledge.
Grey box: A standard domain user or VPN account. The most realistic assumed-breach scenario for most organizations.
White box: Network diagrams, firewall rule sets and admin access, for a full configuration review alongside exploitation.

FAQ

How do you test internal networks remotely?: We ship a preconfigured testing appliance or provide a lightweight virtual machine you deploy inside the network. Access is encrypted, logged and removed when testing ends.
Will testing disrupt production?: Disruptive techniques are excluded unless you approve them. We agree testing windows, rate limits and an emergency contact before we start.
Do you cover segmentation for PCI DSS?: Yes. We validate that segmentation controls isolate the cardholder data environment and report against PCI DSS requirement 11.4.
How long does a network test take?: Typically 5–15 business days, depending on the number of ranges, sites and Active Directory domains in scope.
Does the SOC use what the test proves?: Yes. Once a path like NTLM relay to Domain Admin is proven exploitable, the Entra ID and Okta connectors let the SOC watch live telemetry for the same lateral-movement pattern.