Network & Infrastructure Pentest
External and internal network perimeter mapping, wireless validation, and lateral movement assessments.
Last reviewed by Rhitik Kumar, Lead Offensive Security Engineer.
Scope of Assessment
This network pentest simulates external attackers targeting your internet-facing assets, or internal threat actors escalating privileges to reach Active Directory.
Engagement Details
How the engagement runs
- 01
Scoping and asset confirmation
We confirm the IP ranges, subnets and hosts in scope, and get written authorisation for each. Anything outside that list is never touched.
- 02
Discovery and enumeration
Live hosts, open ports, running services and their versions are mapped, along with domain structure and trust relationships where Active Directory is in scope.
- 03
Exploitation and lateral movement
Confirmed weaknesses are exploited under agreed limits — credential attacks, misconfigured services, unpatched software — then used to attempt privilege escalation and movement toward high-value assets.
- 04
Reporting and retest
You receive the full attack path, not just a vulnerability list, plus segmentation and hardening recommendations and one retest within 30 days.
What you receive
- Network map of hosts, services and exposed surface
- Documented attack paths from entry point to target
- Active Directory findings with privilege escalation routes
- Segmentation and hardening recommendations
- Retest report after remediation
Frequently Asked Questions
Can you perform internal testing remotely?
Yes. We deploy a secure, encrypted virtual drop-box inside your corporate infrastructure to execute active directory mapping.
What is the difference between external and internal testing?
External testing attacks your internet-facing perimeter with no prior access. Internal testing starts from a foothold inside the network and models an attacker who is already through the door, or a malicious insider.
Will you attempt password attacks?
Yes, within agreed limits. Lockout thresholds are respected and account lockouts are avoided by design, using password spraying rather than brute force.
How disruptive is this to daily operations?
Minimal. Denial-of-service checks are excluded unless you explicitly request them, and any test with disruption potential is scheduled with your team.
Related security services
Let's map out your testing strategy.
Have a custom compliance framework or specific targeting parameters? Schedule a scoping session with our senior offensive leads.