LearnTrack
Network
A network test looks at what an organization exposes to the internet and what one foothold inside can reach: names, open services, edge devices, and the directory that ties the internal network together. It is not a vulnerability scan with a report on top, and the web applications, cloud accounts and people on that network have their own tracks.
3 pages
What am I looking at
- I have a domain name and nothing else Recon External recon and subdomain enumeration
- I have a list of public IP ranges Recon External recon and subdomain enumeration
- I have a laptop on the internal network and one domain account Recon Internal pentest: Active Directory recon
- I have a server that does not require SMB signing Escalation Not yet written
- I have local admin on one server Persistence Not yet written
- I have a privileged position and need to show what it reaches Impact Prove network impact without causing damage
Kill chain
-
Recon
- External recon and subdomain enumeration External recon answers one question before any testing starts: what does this organization expose to the internet, and who owns each piece of it? The asset list it produces is often the most used part of the whole report, because most clients have never seen theirs written down.
- Internal pentest: Active Directory recon Most internal tests start from an assumed breach: a laptop or a virtual machine on the corporate network and one ordinary domain account, the position an attacker has after one successful phish. The first hour decides where the rest of the week goes.
-
Access
Not yet written.
-
Escalation
Not yet written.
-
Persistence
Not yet written.
-
Impact
- Prove network impact without causing damage Impact on a network test is proven by showing what a position could reach, not by using it. A file count, a screenshot of a console and one marker file give a report what it needs, and they leave the client one file to remove instead of a copied share or a wiped server.
-
Report
Not yet written.