SXGuard — Swiss Security
...
Network Penetration Testing
Methodology

Network Penetration Testing

External and internal testing of your perimeter and Active Directory — lateral movement and privilege escalation.

A security analyst reviewing network intrusion dashboards

I) Introduction

Definition

A Network Penetration Test is a goal-oriented security assessment that simulates a real-world attack on an organization's network infrastructure (both external and internal). Unlike a vulnerability assessment, a penetration test involves the active exploitation of identified vulnerabilities to determine the level of risk and the potential impact of a breach.

Primary Goal

The primary goal is to identify and exploit weaknesses in a controlled manner to demonstrate the actual business risk of an attack. This is achieved by attempting to gain unauthorized access, move laterally through the network, and exfiltrate data or achieve other defined objectives, culminating in an actionable report on how to fix the root-cause vulnerabilities.

Penetration Test vs. Vulnerability Assessment

  • Vulnerability Assessment: Finds vulnerabilities. Asks, "What are our weaknesses?"
  • Penetration Test: Exploits vulnerabilities. Asks, "Can our weaknesses be used to cause a breach, and if so, how bad would it be?"

II) Penetration Test Phases

Phase 1: Planning and Scoping

This phase establishes the "rules of the game" and is critical for a safe and successful test.

1.1. Define Objectives and "Flags"

  • Objectives: Clearly define the goals. Is it to gain Domain Administrator rights? Access a specific database? Steal a file from a specific server?
  • "Flags": Define what constitutes success (e.g., "Capture the flag" by retrieving a proof.txt file from the Domain Controller).

1.2. Define Scope

  • In-Scope Assets: Explicitly list all target IP ranges, subnets, domains, and applications.
  • Out-of-Scope Assets: Define what must not be tested (e.g., production systems, third-party assets, Industrial Control Systems).
  • Test Type:
    • Black Box: No prior knowledge given. Simulates an external attacker.
    • Grey Box: Partial knowledge given (e.g., user-level credentials, network diagrams). Simulates an insider or an attacker who has breached the perimeter.
    • White Box: Full knowledge given (e.g., source code, admin credentials). Often used for deep application testing.

1.3. Establish Rules of Engagement (ROE)

  • Authorization: Obtain explicit, written permission in a signed contract or "Get Out of Jail Free" card.
  • Testing Window: Define precise dates and times when testing (especially disruptive exploitation) is permitted.
  • Communication Channels: Establish a dedicated 24/7 point of contact and communication channel (e.g., for reporting critical findings immediately or stopping the test if an issue arises).
  • Data Handling: Define how sensitive data found during the test will be handled, stored, and ultimately purged.

Phase 2: Reconnaissance

2.1. Passive Reconnaissance and OSINT

  • Gather information without directly interacting with the target's network.
  • Examples: DNS record enumeration (e.g., dig, nslookup), identifying public IP blocks owned by the organization, finding employee names and emails from public sources (e.g., LinkedIn, social media), and searching for leaked credentials or code (e.g., GitHub).

2.2. Active Reconnaissance

  • Directly interacting with the target's network to gather data.
  • Host Discovery: Use nmap ping sweeps, arp-scan, and other tools to find live hosts within the in-scope IP ranges.
  • Port Scanning: Perform comprehensive TCP and UDP port scans (nmap -sS -sU -p-) on live hosts to identify all open ports.
  • Service Enumeration & Versioning: Fingerprint the services and their exact versions running on open ports (e.g., nmap -sV). This is critical for matching services to known exploits.
  • OS Fingerprinting: Attempt to identify the operating system of the target hosts.

Phase 3: Vulnerability Analysis

3.1. Vulnerability Mapping

  • Correlate the enumerated services and versions with public vulnerability databases (e.g., CVE, Exploit-DB).
  • Run a vulnerability scanner (e.g., Nessus, OpenVAS) in a non-intrusive mode to get a baseline, then manually verify the findings.

3.2. Attack Vector Identification

  • Prioritize potential entry points based on exploitability and potential impact.
  • Examples:
    • "Host 10.1.1.5 is running an old version of Apache Struts (CVE-XXXX), which is known to be vulnerable to Remote Code Execution (RCE)."
    • "Host 10.1.1.10 has SMB open with anonymous login enabled."
    • "The VPN login page is vulnerable to password spraying."

Phase 4: Exploitation

These are the primary methods used to gain the foothold:

4.1. Service Exploitation

  • Attempt to exploit known vulnerabilities in public-facing services (e.g., RCE on a web server, using metasploit to exploit a known bug in an FTP server).

4.2. Password Attacks

  • Password Spraying: Use a small list of common passwords (e.g., "Winter2025!", "Password123") against a large list of usernames (found during recon) for services like VPN, OWA, or SSH.
  • Brute Forcing: Attempt to brute-force weak credentials on login portals (if not rate-limited).

4.3. Man-in-the-Middle (MITM) Attacks (if allowed)

  • On an internal test, attempt to intercept and relay network traffic using tools like Responder or mitm6 to capture password hashes.

4.4. Post-Exploitation

  • This phase simulates the actions an attacker takes after successfully gaining an initial foothold within a system or network. The primary objectives are to:
    • Escalate Privileges: Gain higher-level permissions (e.g., from a standard user to an administrator).
    • Move Laterally: Traverse deeper into the network infrastructure.
  • Note: This sophisticated level of testing will only be executed with explicit, documented authorization.

4.4.1. Internal Reconnaissance

  • Once on a compromised host, repeat the reconnaissance phase from this new internal vantage point.
  • Identify high-value targets (e.g., Domain Controllers, file servers, databases) and map the internal network topology.

4.4.2. Privilege Escalatio

  • Attempt to escalate privileges on the compromised machine.
  • Windows: Look for weak service permissions, unquoted service paths, stored credentials, or missing patches (e.g., ms16-032).
  • Linux: Look for SUID binaries, weak file permissions on /etc/shadow, sudo misconfigurations, or kernel exploits.

4.4.3. Lateral Movement

  • Use the compromised host (and escalated privileges) to pivot and attack other systems on the internal network.
  • Techniques include:
    • Pass-the-Hash/Ticket: Use captured NTLM hashes or Kerberos tickets to authenticate to other machines without needing the plaintext password.
    • Using credentials (plaintext or hashes) to access other machines via SMB, SSH, or RDP.
  • The ultimate goal is often to gain Domain Administrator-level access, which constitutes a "total compromise" of the Windows environment.

4.4.4. Persistence

  • Establish a "backdoor" to maintain access to the compromised system or network, simulating how an attacker would survive a reboot or credential change.
  • Examples: Creating a new user account, planting a webshell, or creating a scheduled task that runs a reverse shell.

Phase 5: Reporting

5.1. Reporting

  • Executive Summary: A high-level, non-technical summary for management. It focuses on the business impact, risk, and a high-level overview of the findings.
  • Technical Report: A detailed report for technical staff.
  • Attack Narrative: A step-by-step walkthrough of the entire attack, from recon to post-exploitation. This is the most valuable part of the report.
  • Vulnerability Details: For each vulnerability exploited (or found), provide a detailed description, evidence (screenshots, logs), and a risk rating (e.g., Critical, High, Medium, Low).
  • Remediation: Provide clear, prioritized, and step-by-step instructions to fix each vulnerability. The focus should be on fixing the root cause (e.g., "implement a patch management program," not just "apply this one patch").

Phase 6: Remediation

Remediation and Re-testing

  • Present the findings to the client in a debrief meeting.
  • After the client has implemented the fixes, perform a targeted re-test to validate that the vulnerabilities have been successfully remediated.
Back to all services

Ready to scope this engagement?

Tell us about your environment and objectives — we'll return a tailored scope, timeline, and quote within 24 hours.

Request a Free Scoping Call