Network Pentest

---
name: network-pentest
description: "Use when testing network infrastructure — external or internal — for security weaknesses: host/service discovery, vulnerability identification, common service misconfigurations (SMB, RDP, SSH, SNMP, LDAP, databases), network-level attacks (relay, poisoning), and pivoting. Follows PTES and NIST SP 800-115, mapped to MITRE ATT&CK, with detection and remediation. Authorized engagements only."
---

# Network / Infrastructure Penetration Testing

Assessment of network hosts and services following **PTES** and **NIST SP 800-115**, with techniques mapped to **MITRE ATT&CK**. Covers external perimeter and internal (assumed-breach) testing.

## 0. Authorization gate
- [ ] Written scope: IP ranges/CIDRs, external vs internal, excluded hosts.
- [ ] Fragile-system list (SCADA/OT, legacy) explicitly excluded unless cleared.
- [ ] Test window, allowed intensity, and emergency contact.
- [ ] Data-handling rules for anything accessed.

## 1. Methodology
```
Discovery ─► Service enum ─► Vuln identification ─► Validation/exploitation
    └─► (internal) credential access ─► lateral movement ─► document & report
```

## 2. Discovery & enumeration
- Host discovery across the scope; TCP/UDP port scans; service + version detection.
- Per-service enumeration:
  - **SMB:** shares, null/guest sessions, signing status, OS info.
  - **RDP:** exposure, NLA, weak/legacy config.
  - **SSH:** auth methods, weak algorithms, key exposure.
  - **SNMP:** default/community strings → device config leakage.
  - **LDAP/Kerberos:** directory info (hand AD specifics to `active-directory-pentest`).
  - **Databases (MSSQL/MySQL/Postgres/Mongo/Redis):** exposure, default/weak creds, unauthenticated access.
  - **Web services:** route to `web-app-pentest` / `api-security-audit`.

## 3. Vulnerability identification
- Map services/versions to known CVEs; validate real exploitability (don't ship raw scanner output).
- Check for common misconfigs: default creds, anonymous access, weak protocols, missing patches, exposed management interfaces.

## 4. Network-level attacks (internal, in-scope)
- **Name-resolution poisoning & relay** (LLMNR/NBT-NS/mDNS → credential capture; SMB relay where signing is off).
- **IPv6 misconfiguration abuse.**
- **Credential access & reuse** across hosts (spraying with lockout awareness).
- **Pivoting/tunneling** to reach segmented networks (document the path).
- **Detection signal for defenders:** these generate distinctive traffic — verify the SOC sees them.

## 5. Remediation themes
SMB signing enforced, disable LLMNR/NBT-NS, patch management, remove default/weak creds, segment and restrict management interfaces, strong protocols only, network monitoring/alerting for poisoning and lateral movement.

## 6. Tooling
nmap/masscan, netexec (cme successor), responder (capture), impacket suite, enum4linux-ng, snmpwalk, hydra (respect lockout), nuclei. Follow the RoE-approved set.

## 7. Reporting & handoff
Route AD to `active-directory-pentest`, cloud to `cloud-pentest`, network gear to `network-device-pentest`, priv-esc to `privilege-escalation`, and post-access work to `post-exploitation`. Checklist: `references/network-checklist.md`.

---
<sub>© 2026 noahfranklin · Part of the [Gideon](https://github.com/noahfranklin/gideon) security suite · MIT License · Original work.</sub>