Assumed Breach Assessment
Testing that starts from the inside: a compromised user or workstation, and the question of how far an attacker can get from there before anyone notices.
Service 05
Internal network penetration testing
Once someone is inside, the questions change. How far can they get? How fast? And which single fix would stop most of it? An internal penetration test answers all three.
Overview
The problem we are solving
Internal testing starts from a device on your network, either on site or through a small appliance or virtual machine we ship to you. Unlike an assumed breach assessment, which begins from a compromised user account, an internal test usually starts with no credentials at all, the position of an intruder who plugged in or a device that was compromised before anyone logged in.
From there, testing covers both breadth and depth: a comprehensive look at vulnerable hosts and services across in-scope segments, and focused exploitation of the Active Directory and credential paths that lead to domain compromise.
For a faster, fixed-scope look at the most common Active Directory weaknesses, see the five-day Rapid Assessment.
Coverage
What we test
Scope is agreed up front; these are the areas an engagement typically covers.
- Network discovery & vulnerable services
- Host and service discovery across in-scope segments, and verified exploitation of vulnerable, unpatched, or misconfigured systems.
- Name resolution & relay attacks
- LLMNR, NBT-NS, mDNS, and WPAD poisoning, IPv6 attacks, NTLM relay, and SMB and LDAP signing enforcement.
- Active Directory
- Kerberoasting and AS-REP roasting, ACL and delegation abuse, certificate services (AD CS) misconfiguration, and paths to domain admin.
- Credentials & secrets
- Credentials in shares, scripts, Group Policy, and configuration files; local admin password reuse; and default credentials on infrastructure.
- Segmentation
- Whether sensitive zones (cardholder data, OT, server, and management networks) are actually isolated from user networks.
- Infrastructure & management interfaces
- Printers, hypervisors, storage, backup systems, and out-of-band management controllers that are often overlooked and rarely hardened.
Methodology
How the engagement runs
-
01
Scoping & access
Agree segments, exclusions, testing windows, and the starting position: on site, a shipped appliance, or a virtual machine on your network.
-
02
Discovery & enumeration
Mapping hosts, services, and Active Directory relationships from the starting position, without credentials unless agreed otherwise.
-
03
Vulnerability identification
Automated coverage across the environment, with manual verification of every finding and analysis of AD attack paths.
-
04
Exploitation & escalation
Controlled exploitation, credential access, and lateral movement to demonstrate real impact against the agreed objectives.
-
05
Reporting
Ranked findings, attack path narratives, and remediation guidance that names the specific setting or change to make.
-
06
Debrief & validation handoff
A live walkthrough with your infrastructure and identity teams, with validation steps for every finding. Retesting is available if you would rather we confirm the fixes.
Deliverables
What you receive
- Full technical report with ranked findings, evidence, and reproduction steps
- Attack path narratives from starting position to domain or data compromise
- Segmentation test results for each sensitive zone in scope
- Remediation guidance specific to your environment
- Validation steps for every finding, so your team can confirm and close out each fix on its own
- Live debrief with technical teams and leadership
Aligned to
- Penetration Testing Execution Standard (PTES)
- NIST SP 800-115
- MITRE ATT&CK
- PCI DSS segmentation testing requirements
Questions
Frequently asked
Do you need to be on site?
No. Most internal tests run remotely through a small appliance or virtual machine placed on your network. On-site testing is available when it makes sense, for example alongside wireless or physical testing.
How is this different from an assumed breach assessment?
An internal test usually starts without credentials and covers the environment broadly. An assumed breach assessment starts from a compromised user account and focuses on how far that access goes toward specific objectives.
Will testing disrupt production?
Testing is designed to be safe for production. Anything with a risk of disruption is discussed and agreed before it happens, and fragile systems can be excluded or tested in a window you choose.
Related
Often scoped together
Rapid Assessment
A fixed-price, five-day internal network assessment focused on the quick wins and heavy hitters (the handful of issues that give real attackers their first foothold) at a fraction of what the larger firms charge for the same depth.
Get started
Ready to scope internal network?
Scoping conversations are free and usually take twenty minutes. You will speak directly with the consultant who would do the work.
Request an assessment
or reach out directly, (608) 520-0719 sales@infocus-security.com