Internal Network Penetration Testing

We don’t spend your budget trying to pick the front-door lock again. If someone determined wants in, sooner or later they get a foothold. Starting from that assumption is more honest and far more useful, because it tells you what the breach actually costs once it happens. If a single compromised workstation leads to domain admin in an afternoon, you need to know that before an attacker demonstrates it for you.

You decide the boundaries. Some clients want the whole estate in play, others carve out a sensitive production segment or a specific data store as the objective. We agree targets, out-of-scope systems and any fragile hosts in writing before a single packet moves. Everything happens under NDA.

We map live hosts, services and trust relationships using nmap, targeted service probing, and passive traffic capture with Responder listening for the noisy broadcast protocols most Windows networks still leak. This phase builds the picture: what talks to what, where the domain controllers sit, which segments are supposed to be isolated and whether they really are.

Internal networks leak secrets constantly. Poisoning LLMNR and NBT-NS responses often yields NetNTLM hashes within minutes on a typical Windows estate. We test for SMB signing so we know where relay attacks land, crack what we capture offline, and check for the reused local administrator password that lets one machine’s hash open a hundred others.

Where credentials usually come from

In practice the richest sources are rarely exotic. Cleartext passwords in scripts and scheduled tasks, service accounts with weak passwords and Kerberoastable service principal names, GPP passwords still sitting in SYSVOL, and shares that let any authenticated user read a backup of the last engineer’s notes. None of it needs a zero-day.

With a foothold and a set of credentials, we move. Pass-the-hash, pass-the-ticket, and legitimate remote-management protocols let us hop between hosts the way a real intruder does, staying inside normal admin behaviour so we can also gauge whether your monitoring would catch it. On each host we hunt for local privilege escalation: unquoted service paths, writable service binaries, vulnerable drivers, and misconfigured sudo rules on Linux.

The engagement is only worth something if it ends in a clear story. We document the full path from initial foothold to the crown jewels, with screenshots and command output at each step, then write it up so both your board and your engineers can act. Critical findings reach you the same day we confirm them, not weeks later in a PDF.

LLMNR and NBT-NS remain enabled on a large share of the networks we test. They let us impersonate any host a client fails to resolve, capturing authentication attempts and, on unsigned SMB, relaying them straight into a session on another machine. Disabling these protocols and enforcing SMB signing closes an entire attack class in an afternoon.

A worrying number of “segmented” networks turn out to be flat where it counts. The guest Wi-Fi reaches the finance VLAN, developer laptops can hit the backup server, a VoIP subnet has an unfiltered route to domain controllers. We test these boundaries directly and tell you which segmentation rules exist on paper only.

Service accounts that are also domain admins, personal accounts with rights nobody remembers granting, and shared local administrator passwords across the fleet are the difference between a contained incident and a company-wide one. Weak account hygiene is the single most common escalation path we exploit.

Every large network hides a few machines no one owns: a legacy application server on an end-of-life operating system, a test box that quietly went to production, a management interface exposed with default credentials. These are the hosts an attacker loves, and the ones your asset inventory rarely lists.

A plain-language overview for leadership: what we achieved, what it would mean if a real attacker did the same, and the handful of changes that cut the most risk. No jargon, no scare tactics, a clear read on where you stand.

Every finding with an impact statement, a CVSS score, the exact reproduction steps, and a prioritized, specific fix. Where findings chain, we show the chain, because a set of “medium” issues that together yield domain admin is not a set of mediums. Your engineers can reproduce and verify each one.

An attestation letter suitable for clients, auditors and insurers confirming the test took place and its scope. After you remediate, we retest the findings at no extra cost to confirm the fixes actually hold under attack, not just in theory.

PCI DSS 4.0 requirement 11.4 calls for internal and external penetration testing, including segmentation testing where you rely on it to reduce scope. ISO 27001 Annex A control 8.8 covers technical vulnerability management, and SOC 2 auditors routinely expect independent testing as evidence. Our reports carry the detail and the attestation these reviews ask for.

For financial entities, DORA’s threat-led testing expectations and NIS2’s risk-management obligations both push regular, evidence-based testing of internal systems. Where personal data sits on the network, GDPR Article 32 expects appropriate technical measures, and a documented internal test is strong evidence you took them seriously.

Testing follows recognised methodology drawn from the PTES and the OWASP and NIST guidance, with lateral-movement and escalation techniques mapped to MITRE ATT&CK so your blue team can trace exactly which tactics we used and whether they were detected.

We would rather hand you eight real, exploitable issues ranked by business impact than four hundred “informational” lines you’ll never read. Everything in the report is something we confirmed by hand.