Network Penetration Testing
Internal and external infrastructure to PTES and NIST SP 800-115 — unpatched services, weak credentials, lateral movement and Active Directory domain escalation.
Network penetration testing is an assessment of internal and external infrastructure — servers, services, endpoints and Active Directory — to PTES and NIST SP 800-115. Passeca finds the unpatched services, weak credentials, lateral-movement paths and Active Directory escalation routes that an attacker chains from initial access to sensitive systems or full domain compromise, and reports each with evidence and prioritised remediation.
What concrete vulnerabilities do we test for?
Internal networks are where lateral movement and domain escalation live. These are the classes that define network risk.
Unpatched & vulnerable services
Internet and intranet services running known-vulnerable versions — web servers, VPN gateways, remote-access services, and appliances with public exploits.
Weak & default credentials
Default and guessable passwords on services, administrative interfaces, databases and appliances, plus accounts with no lockout policy.
Lateral movement
Flat network segments that let an attacker pivot from an initial foothold to sensitive systems — pass-the-hash, credential dumping and service abuse.
Domain escalation (Active Directory)
AD misconfigurations — Kerberoasting, AS-REP roasting, BloodHound attack paths, group-policy abuse and DCSync — that yield domain or enterprise admin.
Misconfiguration & exposure
Open SMB, RDP, WinRM, SNMP and LDAP; exposed admin panels; services bound to all interfaces; and protocols using insecure negotiation.
Segmentation & VLAN weaknesses
Trunk-port misconfig, VLAN hopping, missing segmentation between user, server and OT zones, and insufficient isolation of the CDE.
Methodology for network infrastructure
PTES and NIST SP 800-115 structure the engagement. Internal testing extends deep into Active Directory attack-path analysis.
Each engagement covers discovery and enumeration, vulnerability identification, exploitation, post-exploitation and lateral movement. External testing starts from the internet; internal testing starts from a defined position on the network — unauthenticated, or with a low-privilege user to simulate a realistic insider or compromised endpoint.
In Windows estates the Active Directory assessment enumerates attack paths — Kerberoasting, AS-REP roasting, BloodHound edges, group-policy and delegation abuse, and credential-theft techniques like DCSync — to demonstrate how far an attacker can escalate toward domain or enterprise admin. Segmentation controls and VLAN boundaries are validated for PCI DSS where in scope.
Example findings from real (anonymised) network tests
Network findings are attack chains — the route from a single foothold to domain compromise or data.
Kerberoasting yielded a domain-admin service-account hash
A service account with a crackable Kerberos ticket gave up its password offline; the account held domain-admin privileges, enabling full domain takeover.
Unpatched VPN gateway had a public remote-code-execution exploit
An internet-facing VPN appliance was running a version with a public RCE exploit, offering unauthenticated entry directly into the internal network.
Flat internal network permitted unimpeded lateral movement
From a single compromised workstation, an attacker reached the database and backup servers with no segmentation, controls or detection in between.
Default credentials on a management interface gave root access
A network appliance's administrative interface was reachable on the internal network with vendor default credentials that had never been changed.
Findings are anonymised and paraphrased. Specific reproduction steps are reserved for the engagement report.
How long does a network pentest take, and what does it cost?
Driven by perimeter size, internal host count, Active Directory complexity, and whether the test is external-only or external plus internal.
| Engagement size | Typical duration | Price band |
|---|---|---|
| External only — defined perimeter | 3–5 days | Price on request |
| Internal — mid-size estate + AD | 1–2 weeks | Price on request |
| Large / segmented estate | 2+ weeks | Price on request |
Use the free pentest scoping tool for a precise estimate.
What's in the report?
- Executive summary — network risk in business terms.
- Attack-path narrative — the chain from foothold to impact.
- Graded findings — per-host, with CVSS and business impact.
- Remediation guidance — patching, AD hardening, segmentation, credential policy.
- Compliance mapping — PCI DSS, ISO 27001, SOC 2, DORA, NIS2.
- Remediation retest — fixes retested within the engagement window.
Which compliance requirements does this satisfy?
| Framework | Relevant requirement | How the pentest maps |
|---|---|---|
| PCI DSS | Req. 11.4 | Network penetration testing and segmentation validation |
| ISO 27001:2022 | A.8.8 / A.8.29 | Management of technical vulnerabilities & security testing in development and acceptance |
| SOC 2 | CC4.1 / CC6 | Monitoring & logical access |
| DORA | Art. 24–25 | Digital operational resilience testing |
| NIS2 | Art. 21 | Risk-based security measures, evidenced |
Network pentest, answered
Internal vs external, Active Directory, access models and compliance.
What is network penetration testing?
What is the difference between internal and external network testing?
Which methodology is used for network pentests?
How does network testing relate to Active Directory?
What access do you need for an internal network test?
Which compliance requirements does a network pentest satisfy?
How long does a network pentest take?
Will a network pentest affect production availability?
Give us your IP ranges and host count — get a day estimate
The free pentest scoping tool converts your network estate into a day estimate and price band, then hands to Passeca's offensive-security team for a precise quote.