Network Penetration Testing: A Complete Technical Guide

Network penetration testing is a structured adversarial assessment where security professionals attempt to compromise a target network using the same techniques a real attacker would use — external perimeter testing, internal network compromise, Active Directory abuse, lateral movement, and privilege escalation. The goal is not to generate a CVE list from an automated scanner: it is to demonstrate realistic attack chains showing exactly how an unauthenticated external attacker reaches your most sensitive assets.

The scope spans both external perimeter testing (what an internet-based attacker can reach) and internal network testing (what an attacker who has crossed the perimeter can do), covering everything in between — credential theft, SMB relay, and data exfiltration paths.

External vs Internal Network Penetration Testing

These are two distinct scopes with different threat models, and both matter.

External network penetration testing simulates an attacker who has no credentials and no foothold inside your environment — only what is reachable from the public internet. The tester maps your exposed attack surface: internet-facing hosts, open ports, running services, VPN portals, web application login pages, and misconfigured firewall rules. The questions being answered are: can someone outside your organization gain initial access? Are there exposed services running vulnerable software versions? Does your VPN appliance have a known unauthenticated RCE? Can an attacker enumerate valid usernames from your email gateway or OWA login page to use in a password spray?

Internal network penetration testing starts from the assumption that the perimeter has already been breached — a phished employee clicked a link, a contractor's machine was compromised, or a malicious insider is on the network. The tester operates from inside the network with the access level of a standard domain user, or sometimes with no credentials at all, and attempts to escalate privileges, move laterally across systems, and reach high-value targets: domain controllers, databases, backup servers, finance systems. This is where Active Directory attacks, SMB relay, and credential theft become the primary techniques.

Most real-world breaches involve both stages. The external perimeter is the initial entry point; the internal network is where the actual damage is done. Assessing only one gives you an incomplete picture. For cloud-hosted infrastructure, cloud penetration testing extends these concepts to IAM, storage exposure, and metadata service attack paths that traditional network testing methodologies do not cover.

PTES Methodology: The Seven Phases

The Penetration Testing Execution Standard (PTES) provides a structured framework that distinguishes professional network pentesting from ad-hoc scanning. A rigorous engagement follows all seven phases.

1. Pre-engagement interactions. This is where scope, rules of engagement, and legal authorization are defined in writing before any testing begins. What IP ranges and hostnames are in scope? Is social engineering in or out of scope? What notification procedures apply if a critical vulnerability is found mid-test? What hours is testing permitted? These questions are not administrative formalities — they determine what the test actually measures.

2. Intelligence gathering. Passive and active reconnaissance on the target. For external tests, this includes OSINT on exposed assets (Shodan, Censys, certificate transparency logs, DNS enumeration), identification of email addresses for password spray targeting, and ASN/IP range mapping. Active scanning begins here — Nmap and Masscan to enumerate open ports and services across the defined scope.

3. Threat modeling. Given the attack surface discovered in phase two, what are the realistic attack paths? An exposed Citrix gateway running a version with a known authentication bypass changes the threat model significantly compared to a clean, minimal perimeter. This phase involves thinking like an attacker: what is the fastest path to the crown jewels, and what are the prerequisites?

4. Vulnerability analysis. Deeper enumeration and analysis of discovered services — service version fingerprinting, configuration review, manual verification of potential vulnerabilities beyond what automated scanners flag. Scanners produce false positives and miss logic issues; this phase separates signal from noise.

5. Exploitation. Gaining initial access or demonstrating impact through actual exploitation, not just identification. This is not running Metasploit modules blindly against everything that looks vulnerable. It is chaining vulnerabilities intelligently — for example, using an unauthenticated SSRF to reach an internal metadata endpoint, extracting credentials, and using those credentials to authenticate to a VPN. The exploit chain tells a story; individual CVEs without demonstrated impact tell very little.

6. Post-exploitation. Once initial access is established, the tester simulates what a real attacker would do next: establish persistence, enumerate the internal environment, escalate privileges, move laterally to additional systems, and simulate data exfiltration. In Active Directory environments, this phase often involves BloodHound analysis, Kerberos attacks, and eventual Domain Admin compromise if the attack path exists.

7. Reporting. Every finding is documented with full evidence — screenshots, command output, captured credentials (hashed or redacted per the rules of engagement), and the complete attack chain. Each finding carries a CVSS score, a description of business impact, and concrete remediation guidance. A good report is useful to both a technical implementer who needs to know exactly what to fix and an IT director who needs to understand the business risk.

Key Attack Vectors in Network Penetration Testing

Network Segmentation Failures

Flat networks — or networks where VLANs exist on paper but don't actually enforce isolation — are among the most common and most impactful findings. Guest WiFi that can reach internal subnets. A DMZ that allows outbound connections to the internal network. A segmentation boundary enforced only at layer 2 that is trivially bypassed. When segmentation fails, a single compromised endpoint becomes a pivot point into the entire network.

Credential Attacks

Password spraying against externally exposed authentication portals (OWA, VPN, Citrix, RDP) is one of the highest-yield techniques in external testing. A single valid credential — tried against a small number of common passwords to avoid lockouts — is frequently enough to establish an internal foothold. On the internal side, default credentials on network devices (managed switches, printers, out-of-band management interfaces) remain surprisingly common. In Active Directory environments, Kerberoasting extracts service account ticket hashes for offline cracking, often yielding privileged credentials because service accounts are frequently over-permissioned and have weak passwords set years ago.

Lateral Movement

Once inside, an attacker's goal is to move from a low-privileged workstation to high-value servers. Pass-the-hash allows authentication using captured NTLM hashes without cracking the underlying password. Pass-the-ticket abuses Kerberos TGTs and service tickets in the same way. SMB relay attacks — where Responder poisons LLMNR/NBT-NS requests and captures NTLMv2 challenge-response hashes — can authenticate to other systems in real time if SMB signing is not enforced. Each lateral movement step expands the attacker's reach and access level.

Active Directory Attacks

Active Directory is the backbone of most enterprise Windows environments and the primary target in internal network pentesting. BloodHound, combined with the SharpHound collector, ingests AD data and visually maps every path from a standard user to Domain Admin — through group memberships, ACL misconfigurations, delegation settings, and GPO permissions. AS-REP roasting targets accounts with Kerberos pre-authentication disabled, retrieving crackable hashes without any credentials. After sufficient privilege escalation, DCSync allows an attacker to replicate the entire domain's password hashes from a domain controller without ever logging into it directly — the same technique ransomware groups use to maintain persistence after initial compromise.

Unpatched Services

EternalBlue (MS17-010) should be a historical artifact by now. It is not. Unpatched internal Windows systems — file servers, old workstations, systems excluded from patch management because "they can't be rebooted" — continue to appear in internal network assessments. The same applies to outdated VPN appliances: Pulse Secure, Fortinet, and Citrix have each had critical unauthenticated RCE vulnerabilities in the last several years that many organizations were slow to patch. An exposed, unpatched VPN appliance is frequently the most direct path from the internet to the internal network.

Tools Used in Network Penetration Testing

Nmap is the foundation of network reconnaissance — port scanning, service version detection, OS fingerprinting, and script-based checks for specific vulnerabilities. It is not glamorous, but every engagement starts here.

Metasploit Framework provides a library of exploit modules, payload staging, and post-exploitation capabilities. Its value is not automation — it is reliability. When a tester needs to deliver a payload against a specific service version, Metasploit provides a tested, consistent implementation.

BloodHound and SharpHound are purpose-built for Active Directory attack path analysis. SharpHound collects AD data (users, groups, computers, ACLs, GPOs, sessions) and BloodHound visualizes it as a graph. The result is an immediately actionable map of the fastest path to Domain Admin, including paths that would take days to find manually.

Responder listens on the network for LLMNR and NBT-NS broadcast queries — name resolution protocols enabled by default on Windows that broadcast to the local subnet when DNS fails. Responder answers those broadcasts and captures NTLMv2 authentication attempts, yielding hashes for offline cracking or real-time relay.

CrackMapExec (now NetExec) is used for credential validation and enumeration at scale across SMB, WinRM, and LDAP. Once a set of credentials is obtained, NetExec quickly identifies which systems they work on across the network, what share access they grant, and whether they have local admin rights anywhere.

Impacket is a Python library and set of standalone scripts for low-level protocol interaction. secretsdump.py performs DCSync and dumps SAM/LSA secrets. ntlmrelayx.py performs NTLM relay attacks. GetUserSPNs.py performs Kerberoasting. These are the tools that operationalize the attacks BloodHound reveals.

What Good Findings Look Like

Critical finding — Unauthenticated Remote Code Execution via unpatched VPN appliance (CVSS 9.8). The external-facing VPN portal was running firmware version X.Y, affected by CVE-2024-XXXX. Exploiting this vulnerability required a single unauthenticated HTTP request to a specific endpoint. Evidence: shell access achieved on the VPN appliance, internal routing table confirming access to core infrastructure subnets, lateral movement to an internal Windows host demonstrated using credentials extracted from the VPN configuration files. Remediation: apply vendor patch immediately; implement network access controls to restrict management interfaces.

Low finding — SMB signing not enforced on domain workstations. With SMB signing disabled, captured NTLMv2 hashes can be relayed in real time to authenticate to other systems. By itself, this finding requires Responder poisoning to be viable and does not grant immediate access. In combination with other findings (for example, LLMNR not disabled on the domain), it becomes a medium-severity attack chain. Remediation: enforce SMB signing via Group Policy.

The difference between these findings illustrates a key principle: standalone CVE scores matter less than demonstrated impact and attack chain context.

Common Network Security Mistakes

• No internal segmentation. Every endpoint on the same flat subnet. A compromised workstation in accounting can reach the domain controller and the backup server directly.
• Admin credentials reused across systems. A local administrator password that is the same on every workstation means one compromised machine grants lateral movement everywhere. Microsoft's Local Administrator Password Solution (LAPS) exists specifically to address this.
• Legacy protocols still enabled. NTLM authentication is still active on many networks that have no operational need for it. SMBv1 is still enabled on systems that should have had it disabled years ago. Each is an unnecessary attack surface.
• No monitoring of LDAP enumeration or unusual authentication patterns. BloodHound's SharpHound collector makes thousands of LDAP queries against the domain controller. An attacker running it looks like noise in an environment with no detection. Organizations with mature monitoring catch it within minutes.

Frequently Asked Questions

What is the difference between internal and external network penetration testing?

External testing simulates an attacker with no credentials and no foothold — only what is reachable from the public internet. Internal testing assumes the perimeter has already been breached and assesses how far an attacker can move from inside the network. Both scopes are needed: external testing finds initial access vectors, while internal testing reveals the actual damage potential after a breach occurs.

How long does a network penetration test take?

A typical external network assessment runs one to two weeks. An internal network test in an Active Directory environment commonly takes two to three weeks. Red team engagements combining both external and internal phases with full lateral movement run three to six weeks. Post-engagement retesting of remediated findings adds one to two additional weeks to the total cycle.

How often should organizations conduct network penetration testing?

At minimum once per year for both external and internal scopes. Testing should also be triggered by significant infrastructure changes: new public-facing services, network architecture changes, VPN appliance replacements, or Active Directory topology changes. Organizations subject to PCI DSS must test at least annually and after every significant change to the CDE under Requirement 11.4.

What tools do network penetration testers use?

Core tools include Nmap for port scanning and service detection, Metasploit for exploitation, BloodHound and SharpHound for Active Directory attack path mapping, Responder for credential capture via LLMNR/NBT-NS poisoning, NetExec (formerly CrackMapExec) for credential validation across SMB and WinRM, and Impacket for protocol-level attacks including DCSync and NTLM relay.

What is the difference between a network penetration test and a vulnerability scan?

A vulnerability scan uses automated tools to identify known software weaknesses against a signature database and produces a list of potential issues. A network penetration test involves a human tester who actively exploits vulnerabilities, chains them together to demonstrate realistic attack paths, and tests for configuration and logic-level issues no scanner detects. The penetration test demonstrates actual impact; the scan lists potential exposure.

If your organization has not had an internal network penetration test in the last twelve months — or has never had one at all — the attack paths that BloodHound would find in your environment are almost certainly there. The question is whether a pentester finds them first.

A qualified provider should follow a documented methodology — PTES combined with OWASP and MITRE ATT&CK, the approach providers such as WhiteJaguars use. Testers should have hands-on Active Directory experience, and findings should flow through a platform that tracks remediation to verified closure. Unlimited retests are the standard worth insisting on: they ensure that findings are actually fixed, not just marked closed.

When the threat model includes sophisticated, persistent adversaries, the red team vs. penetration testing guide explains when a full adversary simulation delivers more value than a standard pentest.

See the checklist for evaluating penetration testing providers to scope and compare engagements for your environment.