Internal network pentest methodology

Overview

Internal testing starts from a foothold (assumed breach) and loops: host discovery → service enumeration → validate misconfigs → gather credentials → lateral movement → escalate to the domain. Most internal engagements become Active Directory engagements.

Why it matters

Internal/AD work is what most real jobs involve. A repeatable loop keeps the engagement thorough and in-scope, and recognising that AD ties Windows networks together focuses effort on the highest-impact target.

Core concepts

Assumed breach. Start inside, show impact. The loop. Discover → enumerate → validate → credentials → move → escalate. AD-centric. Internal Windows networks revolve around Active Directory. Care. Gentle scanning, segmentation testing, scope/time awareness.

Lesson

An internal engagement assumes the attacker is already inside the perimeter (a foothold, a rogue device, or an "assumed breach" start). The goal is to show how far that turns into domain compromise.

The loop from a foothold

1. Host discovery — find live hosts on the local subnets (ping sweep, ARP, careful scanning).
2. Service enumeration — per host, identify services (SMB 445, RDP 3389, LDAP 389, Kerberos 88, databases).
3. Vulnerability & misconfig validation — confirm issues by hand (open shares, default creds, missing patches), not just scanner output.
4. Credential gathering — from shares, configs, memory, and the attacks in this track.
5. Lateral movement — reuse credentials to reach new hosts.
6. Escalation to the domain — convert local access into Domain Admin. Repeat as each new host/credential opens more network.

Internal vs external

Internally you'll see far more: file shares, printers, legacy protocols, and Active Directory, which ties every Windows host together. Most internal engagements become AD engagements.

Discipline

Internal scanning can disrupt fragile devices (printers, ICS) — scan gently and within scope. Note the time of noisy actions for the client's blue team. Segmentation testing (can subnet A reach subnet B?) is often an explicit objective.

Summary

Internal pentesting works a discover-enumerate-validate-credential-move-escalate loop from a foothold, almost always converging on Active Directory as the path to full compromise — conducted carefully and within scope.

Practice with these exercises

• Find open ports on localhost
• Classify an ARP frame