Internal Network Security
What this domain tests
Internal Network Security assumes an attacker already has a foothold and tests discovery, credential abuse, segmentation, Active Directory, and lateral movement. The exam rewards attack-path reasoning over raw port counts.
Core rules
- Treat the internal network as hostile. Verify VLAN ACLs, firewall rules, and routes instead of trusting diagrams.
- Active Directory is the main privilege plane: Kerberos service tickets (Kerberoasting), AS-REP roasting for accounts without preauthentication, ACL abuse, and tiered admin accounts.
- Name-resolution poisoning with LLMNR, NBT-NS, and mDNS can capture NetNTLMv2 hashes. Relay is different: it needs a service that accepts NTLM and lacks protections such as SMB signing or LDAP signing and channel binding.
- Credential hygiene means unique local admin passwords (LAPS), managed service accounts, no password reuse, and protected privileged groups.
- Segmentation must be tested from the attacker's position, not inferred from documentation.
Worked example
A low-privileged workstation account runs Responder on the user VLAN. A mistyped share name triggers LLMNR, and the tool captures a NetNTLMv2 challenge-response for svc_file. Offline cracking recovers a weak password. You authenticate to a file server and read a share, but you do not become domain admin. The reasoning: capture only proves the protocol weakness; cracking depends on password strength; access depends on the account's existing rights. Remediation is disabling LLMNR and NBT-NS, enforcing SMB signing, and rotating the service credential.
Traps
- Reporting every open port instead of an attack path.
- Confusing pass-the-hash with NTLM relay.
- Forgetting IPv6 and legacy protocols.
- Assuming a domain admin token is needed before proving impact.