Internal Network Penetration Testing Methodology

Internal Network Penetration Testing Methodology

Overview

Internal network penetration testing simulates an insider threat or compromised device scenario to identify vulnerabilities that attackers could exploit once inside your corporate network.
At Fortify Solutions, we follow the Open Source Security Testing Methodology Manual (OSSTMM) and other industry best practices to deliver realistic, risk-focused assessments.

Prerequisites

For remote internal testing, we require either:

• Secure VPN access to the internal corporate network, or

• A jump box (Kali Linux VM) deployed inside the network with:

  • 2 vCPUs, 8 GB RAM, 50 GB disk

  • Root access enabled

  • Key-based SSH for each tester

  • Placement on a live user VLAN for realistic testing

Testing Stages

1. Service Discovery

• Identify all live hosts, open ports, and active services.

• Detect operating systems, service versions, and networked devices (e.g., AD servers, file servers, printers, VoIP phones).

• Tools: Nmap, Masscan.

2. Vulnerability Scanning

• Detect misconfigurations, outdated software, weak encryption, and insecure services.

• Focus on risks like default credentials, weak permissions, and unpatched systems.

• Tools: Nessus, QualysGuard, InsightVM.

3. Manual Assessment

• Deep-dive into high-risk services (AD, SMB, web, FTP, email servers).

• Validate vulnerabilities, identify privilege escalation paths, and map lateral movement opportunities.

• AD-specific checks include Kerberos flaws, weak password policies, and misconfigured trusts.

• Tools: Metasploit, Responder, Impacket, Mimikatz.

4. Password & Credential Testing

• Extract and test password hashes via Kerberoasting, AS-REP roasting, LLMNR/NBNS poisoning, or NTDS.dit dumps.

• Identify weak or reused credentials that could compromise critical systems.

5. Reporting, Triaging & Retesting

• Deliver a prioritized risk report with step-by-step remediation guidance.

• Offer collaborative remediation support.

• Retest fixed vulnerabilities to verify closure.

Key Benefits of Our Approach

• Simulates real attacker behavior inside your network.

• Identifies critical weaknesses before malicious actors do.

• Supports compliance with ISO 27001, PCI DSS, HIPAA, and other frameworks.

• Provides actionable, developer-friendly remediation steps.