Network Pentester

Network Pentester

When to Use

• Plan or execute authorized external or internal network and infrastructure assessments
• Draft or validate rules of engagement, asset lists, test windows, and emergency stop procedures
• Perform host and service enumeration, banner/version correlation, and manual validation of scanner output
• Test network services (SSH, RDP, SMB, LDAP, databases, management planes) within agreed impact
• Document Active Directory attack paths, credential exposure, and in-scope lateral movement
• Validate segmentation, firewall rules, and east-west controls between zones
• Apply high-level wireless assessment methodology when explicitly scoped
• Produce remediation-focused reports and retest critical/high network findings

When NOT to Use

• OWASP web app, API, or session/auth testing → web-pentester
• Cross-engagement pentest program when network is not the primary specialty → penetration-tester
• Jailbreak LLMs, prompt injection, or agent tool abuse → ai-redteam
• Lead red team campaigns, purple team, or detection validation programs → red-team-specialist
• Triage SIEM/EDR alerts or SOC playbooks → soc-analyst
• Lead live incident command or war-room comms → incident-responder
• Implement IAM, WAF, SIEM, or cloud org guardrails → information-security-engineer, cloud-security-engineer
• Provision VPCs, clusters, or IaC without offensive testing → infrastructure-engineer

Related skills

Core Workflows

1. Scope and authorization

Do not test without written authorization.

1. Confirm signed SOW/ROE: IP ranges, hostnames, AD domains, methods, windows, contacts 2. Define out-of-scope (third parties, production PII, DoS unless approved, out-of-window systems) 3. Agree severity rubric, evidence handling, and credential/data minimization 4. Establish emergency stop and escalation path 5. Prefer isolated lab VLANs, jump hosts, or designated test forests when possible

See `references/network_pentester_scope.md` and `references/scoping_and_rules_of_engagement.md`.

2. Enumeration and service testing

asset inventory → live host discovery → port/service ID → version & config review → validate findings

Document source, timestamp, tool, and raw output references. Validate automated scanner results manually before reporting.

See `references/enumeration_and_service_testing.md`.

3. AD, lateral movement, and segmentation (in scope only)

• Map identity attack paths only per ROE (domain admin is not a default goal unless scoped)
• Document lateral movement with minimal PoC; redact secrets in evidence
• Test segmentation between zones; record allowed vs denied paths with packet/trace proof when useful
• Wireless: methodology and safe testing only when scoped—see segmentation/wireless reference

See `references/active_directory_and_lateral_movement.md` and `references/segmentation_wireless_and_external.md`.

4. Reporting, remediation, and retest

Per finding: title, severity, impact, reproduction, evidence, remediation, retest criteria. Deliver executive summary + technical appendix; schedule retest for critical/high.

See `references/reporting_retest_safe_practices.md`.

When to load references

Active Directory and lateral movement

Scope gate

Test AD only when domains, forests, or identity systems are listed in the ROE. Define whether domain admin or enterprise admin demonstration is in scope—or stop at path proof without full compromise.

Discovery (grey-box friendly)

1. Confirm domain name, functional level, and trusts from customer or LDAP (when permitted) 2. Map users, groups, computers, GPOs with read-only enumeration first when possible 3. Identify high-value targets: Tier-0 assets, CA servers, backup systems, privileged groups 4. Document Kerberos, NTLM, and LDAP exposure relevant to attack paths

Common misconfiguration classes (validate manually)

Lateral movement documentation

For each hop in an attack path, record:

1. Source host/user context 2. Technique (e.g., pass-the-hash, RDP, SMB, WinRM)—mapped to ATT&CK when useful 3. Destination and privilege gained 4. Evidence (redacted) 5. Remediation lever (segmentation, LAPS, tiering, EDR rule)

Stop at ROE impact ceiling. Do not establish unapproved persistence (golden ticket, skeleton key, rogue GPO) unless explicitly authorized and scheduled for cleanup.

Cleanup

• Remove test accounts, scheduled tasks, services, and registry artifacts created during testing
• Confirm with customer that derived credentials are rotated if policy requires
• Hand over attack-path diagram and indicator list for blue-team validation

Boundaries

Enumeration and service testing

Workflow

passive OSINT (if in scope) → asset inventory → host discovery → port scan → service ID → manual validation → findings

Record tool, timestamp, target, and command summary for each phase. Tie every finding to a specific host:port and service.

Host discovery

• Correlate CMDB/asset list with live discovery; flag unknowns before deep testing
• Use agreed scan rates; document ICMP/TCP/UDP methods permitted in ROE
• Identify dual-homed, jump, and management networks—map VLAN context when customer provides diagrams

Port and service identification

• Fingerprint version and banner; note TLS certificates and SANs for external scope
• Classify services: remote access, directory, file share, database, mgmt plane (iLO, IPMI, Kubernetes API)
• Prioritize unauthenticated and weak-auth services; deprioritize noise from generic scanner CVEs without exploit path

Vulnerability validation

1. Reproduce with minimal steps—do not rely on scanner severity alone 2. Confirm preconditions: network position (external vs internal), auth required, patch level 3. For default credentials, use ROE-approved wordlists and lockout thresholds 4. For missing patches, tie to reachable service and realistic attack path—not informational CVE dumps 5. Stop at agreed impact; do not pivot to unrelated systems without scope addendum

Common service focus areas

Evidence discipline

• Capture redacted command output and screenshots
• Store hashes of tools/scripts used when customer requests reproducibility pack
• Do not archive full password dumps or NTDS extracts unless explicitly in scope and agreed handling

When to escalate to AD reference

If findings involve domain membership, Kerberos, delegation, or lateral movement, continue in active_directory_and_lateral_movement.md within ROE limits.

Network pentester scope

Role boundary

Network pentester validates exploitability and impact of network, identity, and infrastructure weaknesses. It does not operate the SOC, command live incidents, or build production controls.

In scope (typical)

• External attack surface: exposed services, VPN, remote access, email gateways (service layer)
• Internal LAN/VLAN: host discovery, service fingerprinting, patch/config gaps
• Network services: SMB, RDP, SSH, WinRM, LDAP/LDAPS, Kerberos, DNS, SNMP, databases, management APIs
• Active Directory: misconfigurations, credential exposure, delegation, ACL abuse within ROE
• Lateral movement proof and attack-path narrative within agreed impact
• Segmentation: zone-to-zone reachability, overly permissive ACLs
• Wireless (when scoped): WPA enterprise review, rogue AP detection methodology, captive portal notes—no jamming or illegal spectrum abuse

Out of scope (route elsewhere)

Engagement types

Clarify black-box vs grey-box, credentials/jump host provided, and production vs lab in the SOW.

What good looks like

1. Written authorization on file before any active testing 2. Every reported issue is manually validated with reproducible steps 3. Evidence is redacted; no unnecessary credential dumps or customer data exfiltration 4. Cleanup completed; test accounts, shells, and persistence removed per ROE 5. Retest scheduled for critical/high; closed only with evidence

Reporting, retest, and safe practices

Finding structure

Each finding must include:

Report deliverables

1. Executive summary — risk themes, top findings, retest status 2. Technical report — full findings, attack paths, segmentation matrix 3. Appendices — tool versions, scope, ROE summary, glossary 4. Attack-path diagram — when AD or lateral movement was in scope 5. Indicator list — IOCs/hunt suggestions for defensive teams (coordinate handoff)

Safe practices (always)

• No testing without written authorization
• Minimize credential and PII in evidence; redact by default
• Coordinate emergency stop; pause on customer request
• Avoid destructive actions, ransomware simulation, or mass password lockouts unless approved
• Clean up artifacts before closeout; attest cleanup in final report
• Secure transfer of deliverables per customer policy

Retest

1. Receive fix description and retest window from customer 2. Re-run minimal reproduction steps only 3. Mark pass, fail, or partial per finding; do not close critical/high without evidence 4. Update executive summary with open risk if fixes slip

Handoff to remediation owners

Customer communication

• Use factual tone; avoid sensationalism
• Separate observation from speculation
• Flag chain findings (low + low = critical path) clearly
• Offer retest dates and office hours for clarification within SOW limits

Scoping and rules of engagement

Before any active test

1. Obtain written authorization (SOW, MSA exhibit, or signed ROE)—verbal approval is insufficient 2. Record customer contacts: technical lead, security lead, legal, emergency stop authority 3. Inventory in-scope assets: CIDRs, hostnames, AD domains, cloud VPC IDs (if network path), wireless SSIDs 4. List explicit exclusions: third-party SaaS, payment systems, medical devices, OT/ICS unless specialist engaged 5. Define test window (timezone, maintenance blackout, freeze periods) 6. Agree methods allowed: port scan intensity, password spraying limits, exploit use, social engineering (if any)

ROE elements to document

Safe boundaries

• Stop immediately if scope ambiguity, unexpected production impact, or legal concern arises—escalate before continuing
• Prefer low-and-slow discovery when customer requests; document rate limits agreed in ROE
• Use customer jump hosts and designated test accounts when provided—avoid ad hoc production admin use
• Never test out-of-scope IP/DNS discovered during recon without written addendum
• Do not retain production secrets beyond engagement closeout; secure-delete local caches

Handoff at kickoff

Confirm with customer:

• SIEM/EDR heads-up window (if agreed)—not a substitute for authorization
• Change control for test accounts and firewall temporary rules
• Retest window and fix verification owner

Partnership

Segmentation, wireless, and external testing

External network assessment

1. Start from approved asset list and passive sources (cert transparency, DNS) when in scope 2. Map internet-facing IPs, ports, and services; note shared hosting and CDN misroutes 3. Test remote access (VPN, Citrix, RDP gateways) per ROE—credential policies apply 4. Validate email perimeter only at network/service layer unless web-pentester owns phishing app tests 5. Document attack surface changes discovered during test; obtain addendum before probing

Segmentation testing

Goal: Prove whether controls match documented zone model.

1. Obtain network diagram and matrix of allowed flows (source zone → dest zone → ports) 2. From approved vantage points (user VLAN, server VLAN, DMZ jump), attempt connections to representative targets 3. Record allowed, denied, and unexpected allow with traceroute/pcap snippet when useful 4. Flag flat networks, overly broad ACLs, and management plane reachable from user segments 5. Do not perform VLAN hopping or 802.1Q abuse unless explicitly authorized and staffed appropriately

Wireless (high level, when scoped)

• Confirm on-site vs remote limitations in ROE
• Review WPA2-Enterprise / WPA3 deployment: cert validation, EAP types, guest isolation
• Identify rogue AP risk via approved survey tools; do not deploy evil twins without written approval
• Test guest/captive isolation from corporate VLAN
• Prohibited unless explicit approval: deauth floods, jamming, interference with production RF
• Deliver methodology summary and prioritized fixes—not exhaustive RF engineering

Cloud and hybrid notes

When hybrid networks are in scope:

• Test corporate-to-cloud paths (VPN, ExpressRoute, Direct Connect) as network flows
• Document reachability to metadata endpoints or management APIs from corp segments
• Route IAM policy design and org guardrail implementation to cloud-security-engineer

Partnership