Network Pentest

---
name: network-pentest
description: >-
  Run an authorized network penetration test: host discovery, port/service
  enumeration, vulnerability identification, exploitation, and lateral
  movement/pivoting — within an agreed scope and rules of engagement. Use to
  actively test internal/external network security you're authorized to assess.
---

# Goal

Evidence-backed network findings and demonstrated impact (where authorized), mapped
to a methodology and ranked — without straying outside scope or causing disruption.

# Prerequisites

- **Authorization and explicit scope**: in-scope ranges/hosts, exclusions, testing
  window, rules of engagement, and allowed techniques. Do not touch out-of-scope
  systems. Coordinate to avoid outages.

# Methodology (see `reference.md` for ports/services/checks)

1. **Host discovery** — identify live hosts within scope (respecting rate limits).
2. **Port & service enumeration** — open ports, service/version fingerprinting,
   default/again-exposed admin services.
3. **Vulnerability identification** — map services to known weaknesses and
   misconfigurations; validate, don't just trust a scanner.
4. **Exploitation** (only if authorized, to the depth agreed) — confirm exploitable
   issues with controlled, non-destructive proof.
5. **Post-exploitation / lateral movement** — assess what the foothold reaches:
   credential exposure, trust relationships, pivoting — within RoE.
6. **Document** — findings with evidence, impact, and remediation; log what you did
   for deconfliction.

# Output

A findings table: host/service · issue · evidence · impact · remediation, plus a
network attack-path view (`security-diagramming:attack-tree`) for notable chains.
Confirmed issues → `security-reporting:finding`.

# Notes

Validate before exploiting and keep proofs non-destructive — this is assessment, not
disruption. Stay strictly in scope and log activity for deconfliction. The
highest-impact network findings are usually exposed admin services, weak/again-used
credentials, and flat networks enabling lateral movement (see
`network-segmentation-review`).