| name | network-pentest |
| description | Run an authorized network penetration test: host discovery, port/service enumeration, vulnerability identification, exploitation, and lateral movement/pivoting — within an agreed scope and rules of engagement. Use to actively test internal/external network security you're authorized to assess. |
Goal
Evidence-backed network findings and demonstrated impact (where authorized), mapped
to a methodology and ranked — without straying outside scope or causing disruption.
Prerequisites
- Authorization and explicit scope: in-scope ranges/hosts, exclusions, testing
window, rules of engagement, and allowed techniques. Do not touch out-of-scope
systems. Coordinate to avoid outages.
Methodology (see reference.md for ports/services/checks)
- Host discovery — identify live hosts within scope (respecting rate limits).
- Port & service enumeration — open ports, service/version fingerprinting,
default/again-exposed admin services.
- Vulnerability identification — map services to known weaknesses and
misconfigurations; validate, don't just trust a scanner.
- Exploitation (only if authorized, to the depth agreed) — confirm exploitable
issues with controlled, non-destructive proof.
- Post-exploitation / lateral movement — assess what the foothold reaches:
credential exposure, trust relationships, pivoting — within RoE.
- Document — findings with evidence, impact, and remediation; log what you did
for deconfliction.
Output
A findings table: host/service · issue · evidence · impact · remediation, plus a
network attack-path view (security-diagramming:attack-tree) for notable chains.
Confirmed issues → security-reporting:finding.
Notes
Validate before exploiting and keep proofs non-destructive — this is assessment, not
disruption. Stay strictly in scope and log activity for deconfliction. The
highest-impact network findings are usually exposed admin services, weak/again-used
credentials, and flat networks enabling lateral movement (see
network-segmentation-review).
