External Perimeter Breach
The first objective is gaining a foothold from the outside. We map your entire internet-facing attack surface — public IPs, DNS records, exposed services, SSL/TLS configurations, and externally reachable management interfaces. Port scanning across the full TCP and UDP range identifies services that should not be publicly accessible: forgotten development instances, database ports, RDP endpoints, and administrative consoles left open after a cloud migration or infrastructure change.
How we test it
Full-range Nmap and Masscan sweeps, banner grabbing, service fingerprinting, SSL/TLS analysis, and targeted exploitation of identified vulnerabilities on perimeter hosts. We validate every finding manually before reporting it.
Service Exploitation & Initial Access
Once exposed services are identified, we attempt exploitation of known vulnerabilities (CVEs in unpatched services), default or weak credentials on network devices, SNMP community strings, and misconfigured services like FTP, SMB, or IPMI. The goal is to convert a network-level finding into an actual shell or authenticated session that demonstrates real access, not just a theoretical vulnerability.
How we test it
Targeted exploitation using Metasploit, manual exploit scripts, credential spraying against identified services, SNMP enumeration, and default credential testing against routers, switches, firewalls, and out-of-band management interfaces (iLO, iDRAC, IPMI).
Active Directory Privilege Escalation
Active Directory is the backbone of most enterprise networks, and the most common path to full domain compromise. We enumerate SPNs for Kerberoasting, identify accounts without pre-authentication for AS-REP roasting, map ACL misconfigurations that allow low-privilege users to modify privileged groups, and test for unconstrained delegation, certificate template abuse (ESC1-ESC8), and GPO permission weaknesses that lead to Domain Admin.
How we test it
BloodHound path analysis, Rubeus for Kerberos attacks, Certify for AD CS abuse, PowerView for ACL enumeration, and manual exploitation of identified privilege escalation paths through the domain trust hierarchy.
Lateral Movement & Pivoting
With initial access established, we test how far an attacker can move through the network. This means pivoting between subnets, exploiting trust relationships between systems, testing whether network segmentation actually blocks cross-VLAN traffic, and identifying hosts where credentials or sessions can be reused. Flat networks with no segmentation typically allow an attacker to reach every system from any initial foothold.
How we test it
SMB relay attacks, WMI and PSExec execution across hosts, SSH key reuse, RDP session hijacking, VLAN hop testing, and systematic verification of firewall rules between each trust zone in the network architecture.
Credential Harvesting & Pass-the-Hash
Credentials are the most reused asset in enterprise networks. We extract NTLM hashes from compromised hosts, test for pass-the-hash and pass-the-ticket attacks, enumerate credentials stored in Group Policy Preferences, LSASS memory, registry hives, and configuration files. Service accounts with weak passwords set years ago and never rotated are consistently the most reliable path to privilege escalation in real engagements.
How we test it
Mimikatz for credential extraction, Hashcat for offline cracking of Kerberos and NTLM hashes, Impacket for relay attacks, and systematic enumeration of stored credentials in GPP, SYSVOL, and local credential stores.
Data Exfiltration & Impact
The final stage demonstrates real business impact. We test whether sensitive data (database exports, file shares containing PII, source code repositories, backup files) can be accessed and exfiltrated through the network without triggering detection. This includes testing egress filtering controls, DNS tunnelling, HTTP/S exfiltration channels, and whether DLP controls actually detect outbound data movement from compromised hosts.
How we test it
Controlled data exfiltration attempts over DNS, HTTPS and ICMP channels, egress port testing, file share enumeration, database access validation, and assessment of whether SIEM and DLP controls detect the activity.
Frequently Asked Questions About Network Security Testing
What is the difference between external and internal network penetration testing?
External testing targets your internet-facing perimeter — public IPs, DNS, firewalls, VPN gateways, and exposed services — simulating an attacker with no internal access. Internal testing starts from inside the corporate network (or a VPN-connected position) and evaluates what an attacker who has bypassed perimeter controls, or a malicious insider, can reach. Both are required for a complete picture because external hardening alone does not prevent lateral movement once an attacker gains initial access through phishing, supply-chain compromise, or a compromised endpoint.
Will network penetration testing disrupt production systems?
We agree on rules of engagement, testing windows, and excluded actions before testing begins. Exploitation is controlled and non-destructive — we avoid denial-of-service conditions, do not modify production data, and coordinate timing with your operations team. In critical environments such as OT/ICS networks, we limit testing to passive reconnaissance and configuration review unless active testing is explicitly authorised by the asset owner.
How long does a network security test take?
A focused external perimeter test typically completes in one to two weeks. A combined external and internal assessment with Active Directory testing runs two to four weeks depending on the number of subnets, hosts, and domains in scope. Timelines are agreed during the scoping phase so your team can plan maintenance windows and access provisioning accordingly.
Do you test Active Directory environments specifically?
Yes. Active Directory assessment is a core component of our internal network testing, not an optional add-on. We test for Kerberoasting, AS-REP roasting, unconstrained and constrained delegation abuse, ACL misconfigurations (WriteDACL, GenericAll, GenericWrite), Group Policy weaknesses, AD Certificate Services template abuse (ESC1 through ESC8), password policy enforcement, privileged group membership, and trust relationship exploitation across forests and domains.
What standards and frameworks does your network testing follow?
Our testing methodology aligns to PTES (Penetration Testing Execution Standard), NIST SP 800-115 (Technical Guide to Information Security Testing and Assessment), CIS Controls for network hardening benchmarks, and the MITRE ATT&CK; framework for mapping techniques to real-world adversary behaviour. Findings are scored using CVSS 4.0 and mapped to the relevant control families for ISO 27001, SOC 2, PCI DSS, and NIST CSF compliance evidence.