Internal Network Security
Internal assessments assume a starting foothold or on-network position and focus on lateral movement, credential abuse, and segmentation. Candidates should understand Active Directory fundamentals: Kerberos ticket behavior (including ticket-granting-ticket exposure and service-ticket cracking), NTLM relay preconditions, and why signing and channel binding matter. Know the difference between credential dumping from memory, cached-credential theft, and offline cracking of captured hashes. Understand service and protocol weaknesses: SMB, LDAP, RDP, WinRM, SNMP community strings, and unauthenticated discovery protocols.
Segmentation is a recurring theme: a flat network lets one compromised host reach everything. Questions often probe whether a finding is exploitable given network position, or whether a control (host firewall, VLAN, jump host) actually blocks the path. Expect traps around pass-the-hash versus pass-the-ticket, treating a null session as full compromise, and assuming domain admin is required for meaningful impact when delegated rights or local admin reuse already suffice.
Worked example: a host exposes SMB but signing is not required, and a privileged account authenticates to it. The risk is NTLM relay to that host, enabling impersonation of the privileged account. The fix is requiring SMB signing (and disabling legacy protocols), not merely rotating passwords. Rule of thumb: on internal tests, trace reachability and privilege paths together-an unpatched host is only critical if an attacker can reach it and the credentials or tokens they hold are accepted there.