network-infrastructure-pentest

name	network-infrastructure-pentest
description	Network-layer security assessment covering segmentation validation, service enumeration, firewall rule analysis, protocol attacks, and infrastructure exposure testing.
applyTo	**/*.{conf,cfg,rules,acl,tf,hcl,yaml,yml,json,xml,nmap}

Network Infrastructure Pentest

Purpose

Assess network-layer security: validate segmentation, test firewall rules, enumerate exposed services, analyze routing and switching security, and identify infrastructure-level attack paths. Complements application-layer skills by testing the network foundation that applications depend on.

Triggers

• Network infrastructure authorized for testing
• Recon analysis identifies open ports or exposed services
• User requests network segmentation validation
• Firewall rules or network ACLs available for review
• VPN, remote access, or edge network in scope

Required Inputs

Input	Description	Required
governance_context	Active engagement governance record	Yes
target_ranges	IP ranges, subnets, VLANs in scope	Yes
network_diagrams	Network topology, firewall rule sets (if available)	Recommended
access_point	Where testing originates (external, internal, DMZ, VPN)	Yes
constraints	Rate limits, no-DoS rules, testing windows	Recommended

Workflow

1. Scope Verification — Confirm IP ranges, ports, and testing approach are authorized. Note testing windows and rate constraints.

2. Network Discovery & Service Enumeration

   • Host discovery (ICMP, TCP SYN, ARP on local segment)
   • Port scanning: TCP (SYN, connect), UDP (top 1000+)
   • Service version detection and banner grabbing
   • OS fingerprinting
   • Map: IP → hostname → service → version → state

3. Network Segmentation Validation

   Test	Method	Risk if Failing
   VLAN isolation	Attempt cross-VLAN communication	Lateral movement between zones
   DMZ → Internal	Test connectivity from DMZ to internal subnets	DMZ compromise reaches internal
   User → Server	Test access from workstation segment to server management	Unauthorized server access
   Guest → Corporate	Test guest network access to corporate resources	Untrusted device access
   Dev → Prod	Test access from development to production networks	Dev compromise reaches production
   Internet → Internal	Test for unfiltered inbound access	Direct external attack
   Internal → Internet	Test egress filtering (DNS, HTTP, ICMP, raw IP)	Data exfiltration channels

4. Firewall Rule Analysis

   • Review rule sets for overly permissive rules (any/any)
   • Check for shadowed rules (rules that never match)
   • Identify rules allowing management protocols from untrusted zones
   • Check default deny policy (implicit deny at bottom)
   • Review logging configuration on deny/drop rules
   • Test stateful vs stateless handling
   • Check for firewall bypass via fragmentation or protocol manipulation

5. Service-Specific Testing

   Service	Port(s)	Key Tests
   SSH	22	Auth methods, weak ciphers, key-based vs password, banner info
   RDP	3389	NLA enabled, encryption level, BlueKeep-class vulns
   SMB	445	Null session, guest access, signing, EternalBlue-class vulns
   SNMP	161/162	Community strings (public/private), SNMPv3 vs v1/v2c
   DNS	53	Zone transfer, cache poisoning, open resolver
   LDAP	389/636	Anonymous bind, unencrypted LDAP (389 vs 636)
   FTP	21	Anonymous access, cleartext credentials
   Telnet	23	Cleartext protocol, credential sniffing
   IPMI	623	Cipher zero, default credentials, hash disclosure
   Database	3306/5432/1433/27017	Default creds, unauthenticated access, public exposure
   VNC	5900+	No auth, weak auth, CVEs
   Redis	6379	No auth, command execution
   Elasticsearch	9200/9300	No auth, data exposure
   Kubernetes API	6443/8443	Anonymous access, misconfigured RBAC

6. Protocol-Level & IPv6 Attacks (within scope)

   Layer 2 / Broadcast Protocol Attacks:

   • ARP spoofing / poisoning (local segment only)
   • LLMNR/NBT-NS/mDNS poisoning (for credential capture)
   • DHCPv6 attacks (if IPv6 enabled)
   • VLAN hopping (switch spoofing, double tagging)
   • STP manipulation (topology change)
   • DNS spoofing/rebinding
   • WPAD abuse

   IPv6 Dual-Stack Bypass Testing:

   • Enumerate IPv6 addresses on all in-scope hosts (nmap -6 -sn, ip -6 neigh)
   • Test IPv6 reachability for services that restrict IPv4 access (firewall may only filter IPv4)
   • Link-local address discovery (fe80::/10) for lateral movement on the local segment
   • Check for rogue Router Advertisement injection (RA Guard bypass, radvd misconfig)
   • Test for dual-stack hosts where IPv6 traffic bypasses IPv4-only security controls (IDS/WAF)
   • DHCPv6 spoofing (mitm6) for network access or NetNTLM credential capture
   • Verify IPv6 egress is filtered at the perimeter if not intentionally routed externally

7. VPN & Remote Access

   • VPN endpoint enumeration and version fingerprinting
   • Test for known CVEs in VPN appliances (Pulse Secure, Fortinet, Cisco GlobalProtect, etc.)
   • Test VPN authentication mechanisms (certificate validation, MFA enforcement, pre-shared key strength)
   • Check for post-auth network access controls (least-privilege network segmentation post-VPN)
   • Review logging of VPN connections

   VPN Protocol Security Comparison:

   Protocol	Strengths	Known Risks	Test For
   WireGuard	Modern crypto (ChaCha20), minimal codebase	No obfuscation, UDP only	Peer authentication, exposed public keys, firewall bypass
   OpenVPN	Mature, TCP/UDP, flexible config	TLS misconfiguration, cipher downgrade	Cipher suites, certificate validation, auth-nocache
   IKEv2/IPsec	Native mobile support, fast reconnect	Complex config, aggressive mode vulns	Weak IKE proposals, auth bypass, certificate validation
   PPTP	Legacy, wide compatibility	MS-CHAPv2 crackable — deprecated	Should not be in active use
   L2TP/IPsec	Widely supported	PSK often weak or shared	PSK strength, lack of MFA, PSK in config files

   Split-Tunnel Misconfiguration:

   • Identify whether VPN is full-tunnel (all traffic) or split-tunnel (only corporate routes)
   • In split-tunnel mode: test which routes bypass the VPN — can an attacker reach corporate resources via un-tunneled paths?
   • Check for DNS leaks: does non-corporate DNS traffic bypass the VPN tunnel?
   • Test for SSRF from internal services to local network destinations reachable via split-tunnel endpoint
   • Verify security controls (DLP, monitoring, IDS) apply to all VPN-tunneled traffic, not just full-tunnel flows

8. Wireless Assessment (if in scope)

   • Enumerate SSIDs and encryption types
   • Test WPA2/WPA3 configuration strength
   • Check for WPA2-Enterprise certificate validation
   • Detect rogue access points
   • Test captive portal bypass
   • Check wireless network isolation from wired

9. Infrastructure Device Security

   • Router/switch management interface exposure
   • Default credentials on network devices
   • SNMP community string testing
   • Firmware version and known CVEs
   • Management protocol security (SSH vs Telnet, HTTPS vs HTTP)
   • Logging and monitoring configuration

10. Classify & Route — Per severity-matrix.md, route to bug-bounty-triage

Allowed Actions

• Scan authorized IP ranges and ports
• Enumerate services and versions
• Test network segmentation by attempting cross-zone communication
• Test firewall rules with crafted packets
• Attempt authentication to exposed services with default/known credentials
• Capture network traffic on authorized segments
• Test protocol-level attacks within authorized scope
• Analyze firewall rule sets provided by client
• Test VPN and remote access security

Forbidden Actions

• Scan or probe IP ranges outside authorized scope
• Perform sustained denial of service attacks
• Disrupt network infrastructure (routing changes, spanning tree attacks that cause outages)
• Intercept traffic of users not part of the assessment
• Deploy persistent network implants
• Attack upstream ISP or transit infrastructure
• Modify routing tables, VLAN configurations, or firewall rules without authorization

Output Format

### [FINDING-ID]: [Title]

| Field | Value |
|-------|-------|
| **Severity** | [S1-S5] |
| **Confidence** | [C1-C4] |
| **Status** | Suspected / Confirmed |
| **Category** | [CWE / Network] |
| **Affected Target** | [IP, hostname, subnet, device] |
| **Service** | [service:port] |

#### Issue Summary
[Description of network-level vulnerability or misconfiguration]

#### Evidence
\```
[Scan output, traffic capture, authentication result — IPs may be included per scope]
\```

**Reproduction Steps:**
1. [From testing position X]
2. [Run scan/test command]
3. [Observe result]

#### Impact
[Unauthorized access, lateral movement, data interception, infrastructure compromise]

#### Remediation
[Firewall rule change, service configuration, segmentation fix, patching]

#### Validation Notes
[Re-scan after fix, verify segmentation, test firewall rules]

References

• references/severity-matrix.md — Severity classification
• references/secrets-and-config-checklist.md — Service configuration
• references/tool-recommendations.md — Network testing tools