Execute an internal network penetration test simulating an insider threat or post-breach attacker to identify lateral movement paths, privilege escalation vectors, and sensitive data exposure within the corporate network. Use when working with conducting internal network penetration test.
Execute an internal network penetration test simulating an insider threat or post-breach attacker to identify lateral movement paths, privilege escalation vectors, and sensitive data exposure within the corporate network. Use when working with conducting internal network penetration test.
An internal network penetration test simulates an attacker who has already gained access to the internal network or a malicious insider. The tester operates from an "assumed breach" position — typically a standard domain workstation or network jack — and attempts lateral movement, privilege escalation, credential harvesting, and data exfiltration to determine the blast radius of a compromised endpoint.
When to Use
Trigger phrases:
"conducting internal network penetration test"
"Execute an internal network penetration test simulating an insider threat or pos"
When conducting security assessments that involve conducting internal network penetration test
When following incident response procedures for related security events
When performing scheduled security testing or auditing activities
When validating security controls through hands-on testing
Prerequisites
Signed Rules of Engagement with internal network scope
Network access: physical Ethernet drop or VPN connection to internal VLAN
Standard domain user credentials (assumed breach model) or unauthenticated access
Testing laptop with Kali Linux, Impacket, Responder, BloodHound
Coordination with IT/SOC for monitoring and emergency contacts
Legal Notice: This skill is for authorized security testing and educational purposes only. Unauthorized use against systems you do not own or have written permission to test is illegal and may violate computer fraud laws.
Phase 1 — Network Discovery and Enumeration
This section covers phase 1 — network discovery and enumeration for conducting internal network penetration test.
Ensure all prerequisites are met before proceeding
Follow the documented workflow steps in sequence
Record results and any anomalies encountered during this phase
Initial Network Reconnaissance
# Identify your own network position
ip addr show
ip route show
cat /etc/resolv.conf
# ARP scan for live hosts on local subnet
arp-scan --localnet --interface eth0
# Nmap host discovery across internal ranges
nmap -sn 10.0.0.0/8 --exclude 10.0.0.1 -oG internal_hosts.gnmap
nmap -sn 172.16.0.0/12 -oG internal_hosts_172.gnmap
nmap -sn 192.168.0.0/16 -oG internal_hosts_192.gnmap
grep internal_hosts.gnmap | awk > live_hosts.txt
nmap -sS -sV -T4 -iL live_hosts.txt -oA internal_tcp_scan
nmap -p 445 --open -iL live_hosts.txt -oG smb_hosts.gnmap
nmap -p 3389 --open -iL live_hosts.txt -oG rdp_hosts.gnmap
nmap -p 22 --open -iL live_hosts.txt -oG ssh_hosts.gnmap
nmap -p 1433,3306,5432,1521,27017 --open -iL live_hosts.txt -oG db_hosts.gnmap
