Internal Network Penetration Testing
Comprehensive testing from inside your network: Active Directory, credential exposure, lateral movement, segmentation, and the realistic paths from a network jack to domain or data compromise.
Service 04
External network penetration testing
Attackers do not start with your asset list. They start with what they can find. We map your real internet-facing footprint, then test it the way an opportunistic or targeted attacker would.
Overview
The problem we are solving
Most organizations know their main website and VPN. Fewer know about the staging server from three years ago, the vendor-managed appliance, the old subdomain still pointing at a cloud resource, or the management interface someone exposed for a weekend. External testing starts by finding all of it.
From there, testing focuses on what actually leads to access: exploitable services, weak or default credentials, password spraying against remote access and identity providers, and misconfigurations in VPNs, firewalls, and edge devices that ransomware groups target first.
The result is a clear answer to the question your board will eventually ask: can someone on the internet get in, and if so, how?
Coverage
What we test
Scope is agreed up front; these are the areas an engagement typically covers.
- Attack-surface discovery
- DNS, certificate transparency, cloud ranges, and open-source intelligence to find every host and service you expose, known or not.
- Remote access & edge devices
- VPNs, firewalls, gateways, and remote desktop services: known vulnerabilities, misconfiguration, and authentication weaknesses.
- Identity & credential attacks
- Password spraying and credential stuffing against Microsoft 365, SSO portals, and VPNs, within safe lockout thresholds, plus MFA coverage gaps.
- Exposed services
- Databases, management interfaces, file transfer services, and anything else answering from the internet that should not be.
- Web-facing applications
- Discovery and baseline testing of web applications found on the perimeter. In-depth testing is scoped as a web application test.
- Email & DNS posture
- SPF, DKIM, and DMARC configuration, subdomain takeover exposure, and DNS misconfiguration that enables spoofing or interception.
Methodology
How the engagement runs
-
01
Scoping & authorization
Agree IP ranges, domains, and cloud assets in scope, confirm ownership, and set testing windows and lockout thresholds.
-
02
Reconnaissance
Passive and active discovery of your internet-facing footprint, compared against the inventory you provided.
-
03
Enumeration & identification
Service fingerprinting and vulnerability identification, with every candidate finding verified manually.
-
04
Exploitation
Safely exploiting confirmed issues to establish real impact, including whether a foothold leads into the internal network.
-
05
Reporting
Ranked findings, an attack-surface inventory including assets you did not know about, and remediation guidance.
-
06
Debrief & validation handoff
A live walkthrough with your infrastructure team, with validation steps for every finding. Retesting is available if you would rather we confirm the fixes.
Deliverables
What you receive
- Full technical report with ranked findings, evidence, and reproduction steps
- Discovered attack-surface inventory, including unknown assets
- Executive summary with overall perimeter risk
- Remediation guidance specific to your devices and services
- Validation steps for every finding, so your team can confirm and close out each fix on its own
- Live debrief with technical teams and leadership
Aligned to
- Penetration Testing Execution Standard (PTES)
- NIST SP 800-115
- MITRE ATT&CK (Reconnaissance & Initial Access)
Questions
Frequently asked
Will password spraying lock out our users?
No. Spraying is paced to stay well under your lockout policy, which we confirm with you before testing starts.
Do you test assets hosted in the cloud?
Yes, internet-facing cloud assets you own are in scope. A deeper review of cloud configuration and identity is available as a cloud security assessment.
Is an external test enough for compliance?
Many frameworks, including PCI DSS, require both external and internal testing. We will help you scope what your auditor expects.
Related
Often scoped together
Social Engineering Assessments
Authorized phishing, vishing, smishing, and pretexting campaigns that measure how your people and processes respond to the attacks most breaches actually start with.
Get started
Ready to scope external network?
Scoping conversations are free and usually take twenty minutes. You will speak directly with the consultant who would do the work.
Request an assessment
or reach out directly, (608) 520-0719 sales@infocus-security.com