Network and Infrastructure Penetration Testing
Network and Infrastructure Penetration Testing
This domain tests host discovery, service enumeration, vulnerability validation, exploitation, and pivoting in network environments, including Active Directory. The exam expects methodical testing, not a single tool run.
Core rules and concepts
- Discovery: ARP on local segments, ICMP/TCP/UDP probes remotely. Choose scan type by stealth, speed, and reliability; TCP SYN is common, connect scans work without raw sockets, UDP is slow and sparse.
- Enumeration: identify versions, then query services for users, shares, groups, and policy. SMB, LDAP, Kerberos, SNMP, and RDP are high-value.
- Validate vulnerabilities before exploitation; a version banner is a clue, not proof.
- Active Directory: Kerberoasting, AS-REP roasting, password spraying within lockout policy, BloodHound path analysis, Pass-the-Hash where permitted.
- Pivoting: SSH tunnels, SOCKS proxies, and port forwarding extend reach; document each hop and keep traffic inside scope.
- Check segmentation and network devices; flat networks are a finding in themselves.
Worked example
A scan shows TCP 445 open on an in-scope server. enum4linux lists a readable share and domain users. Before spraying, the tester checks the domain lockout threshold (for example, 5 attempts in 30 minutes) and uses one password across accounts with delays, staying below the threshold. A single valid credential is used to enumerate further, not to dump all data. The report links the open share to excessive permissions and recommends least privilege, rather than reporting 'SMB open' as a vulnerability.
Traps that cost marks
- Running aggressive or full-range scans without approval and disrupting services.
- Ignoring lockout policy and locking out accounts.
- Reporting an open port or banner as a confirmed vulnerability.
- Pivoting into out-of-scope networks.
- Not documenting the path and evidence for each hop.