Internal Network and Active Directory Penetration Testing
An internal network penetration test measures how far an attacker who has got inside, or a malicious insider, could go. Nokta Guard tests Active Directory configuration, privilege escalation paths, lateral movement and access to critical servers under controlled conditions. The result is a map of the concrete paths an attacker could follow from a standard user to domain admin.
A phishing email, a compromised laptop or a supplier connection can open the door to your internal network. From there, the damage depends on how well network segmentation, Active Directory configuration and privilege management hold up.
We do not just list findings; we show how they chain together into a path to domain admin.
Control Scope
areas · PTES · MITRE ATT&CK
Network discovery and segmentation
Access between segments, VLAN separation and paths to critical servers.
Active Directory configuration
Misassigned permissions, accounts exposed to Kerberoasting and AS-REP roasting, group policies.
Active Directory Certificate Services
Certificate template and configuration flaws that allow privilege escalation.
Credential attacks
Credentials exposed on the network, NTLM relay and password reuse.
Privilege escalation
Paths to local admin on servers and workstations.
Lateral movement
Ways to move from one compromised system to others.
Patching and configuration
Unpatched software and insecure services on internal systems.
Critical assets
Access to databases, file servers and management systems.
Testing usually starts with a standard user account and runs on site, over a VPN you provide or from a test machine you set up inside your network. Attack paths are mapped with analysis tools and each step is verified under controlled conditions. Steps that could affect services are approved in advance.
Duration depends on the number of segments, users and servers and on whether testing is on site or remote. Critical results, such as reaching domain admin, are reported immediately.
Executive summary and attack chain narrative. Visual map of the paths to domain admin. Technical findings with evidence and CVSS score. Active Directory hardening advice and a retest report.
Any organisation that uses a central directory service (Active Directory). Recommended at least once a year and after mergers, new sites or major infrastructure changes.