Internal Network Penetration Testing
Internal network penetration testing
The internal domain tests what you do after the external foothold: host enumeration, privilege escalation, credential harvesting, lateral movement, and Active Directory discovery from inside the network. The examiner wants a clean pivot from a compromised host to meaningful business impact.
Core rules and concepts
- Establish a stable foothold and a working pivot before scanning internal ranges.
- Enumerate locally and remotely: users, groups, patches, shares, sessions, AV, and network routes.
- Harvest credentials from memory, files, configs, and browser stores; reuse them carefully to avoid lockouts.
- Escalate vertically on the host, then move laterally to servers and AD systems.
- Map AD with BloodHound and validate paths; avoid blind spraying that locks accounts.
- Document every host, credential source, and action with timestamps.
Worked example
Your external foothold is a web shell on a DMZ host. You upload a lightweight tunnel, then scan the internal /24. A file server exposes SMB; you enumerate shares and find a script containing a service account password. CrackMapExec validates the credential against several hosts without spraying. That account is local admin on a workstation where a Domain Admin is logged in. Reasoning: the pivot is stable, the credential is discovered rather than brute-forced, and the lateral hop is justified by session data.
Traps that cost marks
- Scanning the internal network before establishing a reliable tunnel.
- Locking out accounts with aggressive password spraying.
- Ignoring local privilege escalation because AD looks more interesting.
- Losing track of which host a credential came from.