External Network Penetration Testing
External network penetration testing
The external domain tests your ability to assess the internet-facing perimeter: discovery, scanning, service enumeration, web application testing, exploitation, and initial access. The exam expects a methodical outside-in approach that mirrors a real attacker without damaging production.
Core rules and concepts
- Confirm scope: external IPs, domains, cloud assets, and any excluded hosts.
- Enumerate broadly, then deeply: DNS, subdomains, certificate transparency, and port scanning with Nmap; validate non-standard ports.
- Fingerprint services and web stacks; check default credentials, exposed admin panels, known CVEs, and misconfigurations.
- Exploit only what you can reproduce; capture request/response evidence and a clean proof of access.
- Respect rules of engagement: no destructive payloads, no data exfiltration beyond proof, and no testing outside scope.
Worked example
An Nmap scan of 203.0.113.10 shows 22, 443, and 8080. Port 443 hosts a login page; port 8080 exposes Jenkins with anonymous read access. You enumerate the Jenkins version and find a known remote code execution path, but first you test a safer script console command that returns whoami. Reasoning: the Jenkins instance is the weakest exposed service, and a non-destructive command proves code execution before you attempt a shell. You document the URL, version, and command output.
Traps that cost marks
- Scanning a whole /16 when scope is a single IP.
- Missing services on high ports because you only scanned top 1,000.
- Reporting a vulnerability without a working proof or reproduction steps.
- Using loud exploitation that takes down a service.