Lab 02 — Enterprise Pentesting

Welcome to Lab 02 — Enterprise Pentesting.

In the previous lab, you focused primarily on Active Directory identities, permissions, groups, authentication, and privilege relationships.

Now the scope becomes larger.

An enterprise environment is rarely:

One Server
+
One Vulnerability

A realistic organization may contain:

Internet-Facing Systems

Internal Networks

Windows Servers

Linux Servers

Active Directory

Web Applications

Databases

File Servers

Administrative Systems

User Workstations

Security Controls

Network Segmentation

Your objective is to understand how these components interact and determine whether weaknesses can combine into meaningful enterprise risk.

The professional workflow becomes:

SCOPE
  ↓
DISCOVERY
  ↓
ASSET CLASSIFICATION
  ↓
SERVICE ENUMERATION
  ↓
VULNERABILITY ANALYSIS
  ↓
IDENTITY ANALYSIS
  ↓
WINDOWS / LINUX ASSESSMENT
  ↓
ACTIVE DIRECTORY
  ↓
SEGMENTATION
  ↓
ATTACK-PATH MAPPING
  ↓
CONTROLLED VALIDATION
  ↓
EVIDENCE
  ↓
BUSINESS IMPACT
  ↓
REMEDIATION
  ↓
RETEST

Perform this lab only inside an isolated GoHackersCloud lab, systems you own, intentionally vulnerable training environments, or systems for which you have explicit authorization.

Mission Information

Lab: 02 — Enterprise Pentesting
Track: OffSec Labs
Difficulty: Intermediate → Advanced
Estimated Time: 5–8 Hours
Environment: Isolated Enterprise Security Lab
Primary Role: Penetration Tester / Security Consultant
Focus: Enterprise Attack Surface and Attack-Path Assessment
Deliverable: Enterprise Penetration Testing Report

Mission Scenario

You have been engaged to conduct an authorized internal penetration test for the fictional organization:

NovaTech Industries

The organization operates:

Windows Domain

Linux Servers

Windows Servers

Internal Web Applications

File Services

Database Services

Employee Workstations

Multiple Network Segments

The security team is concerned that individual weaknesses may combine into larger attack paths.

Your mission is to determine:

What Assets Exist?

Which Services Are Exposed?

Which Systems Are Important?

Where Are Weak Configurations?

Where Are Excessive Permissions?

Can Network Segmentation Be Bypassed?

Can Identity Relationships Expand Access?

Can Multiple Weaknesses Be Chained?

What Is the Potential Business Impact?

Enterprise Lab Architecture

Use an isolated environment similar to:

                    PENTEST VM
                         |
                         |
                10.10.10.0/24
                         |
        +----------------+----------------+
        |                |                |
        v                v                v
     +------+          +------+         +------+
     | WEB01|          | WS01 |         | DC01 |
     | Linux|          | Win  |         | AD   |
     +------+          +------+         +------+
        |                                  |
        |                                  |
        +---------------+------------------+
                        |
                  10.10.20.0/24
                        |
              +---------+---------+
              |                   |
              v                   v
           +------+            +------+
           |APP01 |            |FILE01|
           |Linux |            | Win  |
           +------+            +------+
              |
              |
         10.10.30.0/24
              |
              v
           +------+
           | DB01 |
           | DB   |
           +------+

Example systems:

System	Role	Example Network
Pentest VM	Authorized assessment system	10.10.10.0/24
DC01	Domain Controller	10.10.10.0/24
WS01	Employee workstation	10.10.10.0/24
WEB01	Web server	10.10.10.0/24
APP01	Application server	10.10.20.0/24
FILE01	File server	10.10.20.0/24
DB01	Database server	10.10.30.0/24

Replace these addresses with your own authorized lab values.

Learning Objectives

By completing this lab, you should be able to:

Establish penetration-test scope
Create rules of engagement
Discover enterprise assets
Classify assets by business importance
Enumerate network services
Analyze exposed applications
Assess Windows systems
Assess Linux systems
Review enterprise identities
Analyze Active Directory relationships
Evaluate file and data exposure
Review network segmentation
Identify trust relationships
Build multi-system attack paths
Validate findings safely
Collect evidence
Prioritize vulnerabilities
Recommend remediation
Produce a professional penetration-testing report

Prerequisites

You should understand:

TCP/IP

DNS

Routing

Network Segmentation

Linux Administration

Windows Administration

Active Directory

HTTP / HTTPS

SMB

SSH

LDAP

Kerberos

Authentication

Authorization

Basic Scripting

Vulnerability Management

Penetration Testing Methodology

The Enterprise Pentesting Mindset

Do not approach the environment as:

Find Open Port
      ↓
Find Exploit
      ↓
Repeat

Instead:

UNDERSTAND
THE ENVIRONMENT
      ↓
UNDERSTAND
THE ASSETS
      ↓
UNDERSTAND
THE TRUST
      ↓
UNDERSTAND
THE IDENTITIES
      ↓
UNDERSTAND
THE CONTROLS
      ↓
FIND
WEAK RELATIONSHIPS
      ↓
BUILD
ATTACK PATHS

Phase 01 — Authorization

Before beginning, confirm:

Who Authorized the Test?

Which Networks Are Included?

Which Systems Are Included?

Which Systems Are Excluded?

Which Techniques Are Allowed?

Which Techniques Are Restricted?

What Is the Testing Window?

Who Is the Emergency Contact?

What Are the Cleanup Requirements?

Scope Template

Assessment:
Enterprise Penetration Test

Organization:
NovaTech Industries

Environment:
Isolated Training Lab

Authorized Networks:
10.10.10.0/24
10.10.20.0/24
10.10.30.0/24

Excluded:
Anything outside the lab environment

Objective:
Identify enterprise security weaknesses
and attack paths.

Testing Window:
Lab session only

Evidence:
Synthetic lab data only

Phase 02 — Rules of Engagement

Define:

Allowed:

Asset Discovery

Service Enumeration

Configuration Review

Authorized Vulnerability Validation

Identity Assessment

Attack-Path Analysis

Controlled Privilege Validation

Restricted unless specifically part of your lab:

Destructive Testing

Denial of Service

Persistence

Production Credential Collection

Uncontrolled Data Extraction

Malware Deployment

Security-Control Evasion

Phase 03 — Build the Evidence Workspace

Create:

Enterprise-Pentest/
|
+-- 01-Scope/
|
+-- 02-Discovery/
|
+-- 03-Network/
|
+-- 04-Windows/
|
+-- 05-Linux/
|
+-- 06-Web/
|
+-- 07-Identity/
|
+-- 08-AD/
|
+-- 09-Segmentation/
|
+-- 10-Attack-Paths/
|
+-- 11-Evidence/
|
+-- 12-Findings/
|
+-- 13-Report/
|
+-- 14-Cleanup/

Evidence Standard

For every important action record:

Timestamp:

Source System:

Target:

Command / Method:

Purpose:

Result:

Security Significance:

Evidence:

Next Step:

Phase 04 — Establish Your Position

On the authorized assessment system:

ip addr

Review routing:

ip route

Identify:

Assessment IP

Network

Gateway

Reachable Subnets

DNS Configuration

Why This Matters

You need to understand:

WHERE AM I?

before asking:

WHAT CAN I REACH?

Phase 05 — Discover Authorized Hosts

Against your lab subnet:

nmap -sn 10.10.10.0/24

Repeat only for authorized networks.

Document:

IP Address

Hostname

Status

Possible Role

Asset Inventory

Create:

IP	Hostname	Role	OS	Priority
10.10.10.10	DC01	Domain Controller	Windows	Critical
10.10.10.20	WEB01	Web Server	Linux	High
10.10.10.30	WS01	Workstation	Windows	Medium

Phase 06 — Perform Port Discovery

For an individual authorized target:

nmap -p- <LAB_IP>

This identifies TCP ports exposed by the training system.

Do not immediately assume:

Open Port
=
Vulnerability

An open port means:

A Service Is Reachable

Your next task is to understand that service.

Phase 07 — Perform Targeted Service Enumeration

After identifying interesting ports:

nmap -sV -sC -p <PORTS> <LAB_IP>

Example lab workflow:

FULL PORT DISCOVERY
        ↓
IDENTIFY PORTS
        ↓
TARGETED SERVICE ENUMERATION
        ↓
MANUAL VALIDATION

Service Inventory

Build:

Host	Port	Service	Version	Purpose	Priority
WEB01	22	SSH	Lab version	Administration	Medium
WEB01	80	HTTP	Lab application	Web	High
DC01	53	DNS	Domain DNS	AD	High
DC01	88	Kerberos	Authentication	AD	Critical
FILE01	445	SMB	File services	Storage	High

Phase 08 — Identify the Asset Role

Ask:

Is This a:

Domain Controller?

Web Server?

Application Server?

Database Server?

File Server?

Workstation?

Management Server?

Security Appliance?

Asset role determines testing priority.

Phase 09 — Classify Business Criticality

Use:

CRITICAL

HIGH

MEDIUM

LOW

Example:

Domain Controller
=
Critical

Database
=
Critical

Application Server
=
High

Employee Workstation
=
Medium

Technical severity alone is not enough.

Phase 10 — Build the Attack Surface

For each system document:

Host

Operating System

Services

Applications

Authentication

Administrative Interfaces

Network Relationships

Identity Relationships

Data

Business Function

Attack Surface Example

WEB01
 |
 +-- HTTP
 |
 +-- HTTPS
 |
 +-- SSH
 |
 +-- Web Application
 |
 +-- Application Configuration
 |
 +-- Connection to APP01

Phase 11 — Enumerate DNS

DNS can reveal enterprise structure.

For known lab records:

nslookup <HOSTNAME>

or:

dig <HOSTNAME>

Record:

Hostnames

Domains

Server Names

Application Names

Infrastructure Patterns

Phase 12 — Build a Network Diagram

Your first diagram may look like:

Pentest VM
    |
    +---- DC01
    |
    +---- WEB01
    |
    +---- WS01

As you discover relationships, expand it:

Pentest VM
    |
    +---- WEB01
             |
             +---- APP01
                      |
                      +---- DB01

Now you are beginning to understand architecture.

Phase 13 — Enumerate HTTP

For an authorized web service:

curl -I http://<LAB_IP>

You can inspect the response:

curl -v http://<LAB_IP>

Review:

HTTP Status

Headers

Cookies

Redirects

Server Information

Authentication

Application Behavior

Phase 14 — Web Application Mapping

Document:

Pages

Authentication

Roles

Forms

Parameters

API Endpoints

Uploads

Downloads

Administrative Functions

Do not begin with payloads.

Begin with:

How Does the Application Work?

Phase 15 — Authentication Review

Assess:

Login Process

Account Lockout

Session Handling

Role Separation

Password Policy

Logout

Password Reset

Use only lab accounts provided for the exercise.

Phase 16 — Authorization Review

Ask:

Can User A Access
User B's Resources?

Can a Normal User Reach
Administrative Functions?

Are Server-Side Authorization
Checks Present?

Authorization flaws can be more important than complex technical vulnerabilities.

Phase 17 — Review Application Configuration

In a purpose-built lab where local access has legitimately been provided, review application configuration for:

Database Connections

Service Endpoints

File Paths

Environment Settings

Authentication Configuration

Logging Configuration

Never copy more sensitive data than necessary.

Phase 18 — Map Application Dependencies

Example:

USER
 ↓
WEB01
 ↓
APP01
 ↓
DB01

Now ask:

What Trust Exists
Between Each Layer?

Phase 19 — Linux Assessment

For an authorized Linux host where your lab provides shell access, begin with:

whoami

id

hostname

uname -a

Phase 20 — Understand the Linux Security Context

Document:

Current User

Groups

Hostname

Operating System

Kernel

System Role

Phase 21 — Review Linux Privileges

In the lab:

sudo -l

Ask:

What Commands Are Allowed?

Why Are They Allowed?

Does the User Need Them?

Could the Permission Violate
Least Privilege?

Phase 22 — Review Linux Processes

Use:

ps aux

Identify:

Applications

Services

Administrative Processes

Unexpected Processes

Phase 23 — Review Listening Services

Use:

ss -lntup

Compare:

Externally Discovered Services

with:

Locally Listening Services

A service listening only locally may reveal an internal application dependency.

Phase 24 — Review Linux Services

Where available:

systemctl --type=service --state=running

Ask:

Which Services Are Necessary?

Which Identity Runs Them?

Which Files Configure Them?

Which Network Interfaces
Do They Listen On?

Phase 25 — Review Scheduled Tasks

Inspect authorized training-system scheduling configuration.

For the current account:

crontab -l

Where permitted, review system scheduling locations.

Focus on:

Command

Owner

Permissions

Writable Dependencies

Phase 26 — Review SUID Files

In your training VM:

find / -perm -4000 -type f 2>/dev/null

Do not assume every SUID file is vulnerable.

Ask:

Is It Expected?

Who Owns It?

Is It Standard?

Does Its Configuration
Create Excessive Privilege?

Phase 27 — Review Linux Capabilities

In the authorized lab:

getcap -r / 2>/dev/null

Understand why capabilities exist.

A capability is not automatically a vulnerability.

The question is:

Does This Capability
Grant More Power Than
the Application Requires?

Phase 28 — Review File Permissions

Focus on security-sensitive files related to the lab application.

Ask:

Who Owns the File?

Who Can Modify It?

Which Service Uses It?

Could a Lower-Privilege Identity
Modify Security-Sensitive Configuration?

Phase 29 — Linux Privilege Escalation Mental Model

Use:

IDENTITY
   ↓
GROUPS
   ↓
SUDO
   ↓
FILES
   ↓
SERVICES
   ↓
SCHEDULED TASKS
   ↓
CAPABILITIES
   ↓
APPLICATION CONFIGURATION
   ↓
SECURITY IMPACT

Avoid:

Run Random Exploit Script
and Hope

Phase 30 — Windows Assessment

On an authorized Windows host:

whoami

Then:

whoami /all

Record:

User

Groups

Privileges

Integrity

Domain

Phase 31 — Review Windows System Information

Use:

systeminfo

Document:

Operating System

Build

Architecture

Domain

System Type

Phase 32 — Review Local Users

Where available:

Get-LocalUser

Look for:

Unexpected Accounts

Dormant Accounts

Administrative Accounts

Service Accounts

Phase 33 — Review Local Administrators

Use:

Get-LocalGroupMember Administrators

or:

net localgroup administrators

Document:

Local Admins

Domain Admin Groups

Support Groups

Service Accounts

Phase 34 — Review Windows Services

Use:

Get-Service

Focus on:

Service Purpose

Service Identity

Startup Type

Business Requirement

Phase 35 — Review Scheduled Tasks

Use:

Get-ScheduledTask

Investigate:

Task Owner

Executable

Trigger

Privilege Context

Business Purpose

Phase 36 — Review Windows Network Exposure

Use:

netstat -ano

Compare the results with your external enumeration.

Ask:

Which Processes
Own the Listening Ports?

Phase 37 — Windows Privilege Assessment Model

Use:

CURRENT IDENTITY
      ↓
GROUPS
      ↓
PRIVILEGES
      ↓
LOCAL ADMINS
      ↓
SERVICES
      ↓
SCHEDULED TASKS
      ↓
FILES / REGISTRY
      ↓
DOMAIN RELATIONSHIPS

Phase 38 — Identify Active Directory Membership

From an authorized domain-connected system:

$env:USERDOMAIN

whoami /groups

Determine whether the system participates in:

Workgroup

Domain

Administrative Tier

Phase 39 — Enumerate Domain Context

Where permitted:

net user /domain

net group /domain

Your objective is to understand:

Users

Groups

Roles

Administrative Structure

Phase 40 — Identify Privileged Groups

Review:

net group "Domain Admins" /domain

Also investigate other privileged or delegated groups relevant to your lab.

Remember:

Privilege
Does Not Equal
Domain Admins Only

Phase 41 — Map Identity Relationships

Build:

USER
 ↓
GROUP
 ↓
COMPUTER
 ↓
APPLICATION
 ↓
DATA

Example:

support01
    ↓
ITSupport
    ↓
Local Admin on APP01
    ↓
Application Administration
    ↓
Sensitive Service

Phase 42 — Review Service Accounts

Document:

Account

Purpose

Host

Service

Privilege

Group Membership

Password Governance

Ask:

Does the Account
Have More Access
Than the Service Needs?

Phase 43 — Review File Shares

For a known authorized Windows server:

net view \\FILE01

Review:

Share Name

Purpose

Access

Data Classification

Business Owner

Ask:

Who Can Read?

Who Can Write?

Who Can Modify?

Who Owns the Data?

Is Access Necessary?

Phase 45 — Sensitive Information Exposure

In the training environment, intentionally planted files may include:

Configuration Files

Deployment Notes

Backup Files

Operational Documentation

Scripts

Your objective is not:

Collect Everything

It is:

Prove Exposure
Using Minimum Evidence

Phase 46 — Understand Credential Exposure

Enterprise environments may accidentally expose authentication material through:

Configuration

Scripts

Backups

Documentation

Overly Permissive Shares

For this lab, use only synthetic credentials intentionally created for the training environment.

If discovered, document:

Location

Affected Service

Access Required

Potential Scope

Recommended Remediation

Do not reuse credentials outside the authorized lab.

Phase 47 — Map Trust Relationships

Enterprise compromise often follows trust.

Example:

WEB01
  |
  | Application Connection
  v
APP01
  |
  | Database Connection
  v
DB01

Another:

USER
 ↓
SUPPORT GROUP
 ↓
SERVER ADMINISTRATION
 ↓
APP01

Phase 48 — Review Network Segmentation

Suppose the architecture intends:

USER NETWORK
     |
     X
     |
DATABASE NETWORK

But application servers require:

APP NETWORK
     |
     v
DATABASE NETWORK

Your assessment should verify whether the actual access matches the design.

Phase 49 — Test Segmentation Safely

From each authorized position, record which lab services are reachable.

You may use targeted connectivity checks.

For example:

nc -nv <LAB_IP> <PORT>

or targeted Nmap enumeration against the authorized destination.

Do not broadly scan networks outside scope.

Segmentation Matrix

Create:

Source	Destination	Service	Expected	Observed
User	DB	Database	Denied	Denied
Web	App	Application	Allowed	Allowed
App	DB	Database	Allowed	Allowed
User	Admin	RDP	Denied	Review

Phase 50 — Identify Segmentation Weaknesses

A finding may exist when:

Expected:

USER
  X
DATABASE

but:

Observed:

USER
  ↓
DATABASE

Document the exact:

Source

Destination

Service

Expected Rule

Observed Behavior

Phase 51 — Understand Pivoting Conceptually

A multi-network environment may require traffic to pass through an authorized intermediary.

Conceptually:

PENTEST VM
    ↓
WEB01
    ↓
APP NETWORK
    ↓
APP01

For this lab, focus on understanding:

Routing

Reachability

Trust

Segmentation

Attack Paths

rather than stealth or uncontrolled tunneling.

Phase 52 — Identify Multi-Stage Attack Paths

Individual weaknesses become more serious when chained.

Example:

WEB APPLICATION
      ↓
LOW-PRIVILEGE APP ACCESS
      ↓
EXCESSIVE SERVER PERMISSION
      ↓
APPLICATION CONFIGURATION
      ↓
SERVICE IDENTITY
      ↓
INTERNAL APPLICATION
      ↓
SENSITIVE DATA

Phase 53 — Build an Enterprise Attack Graph

Example:

External / User Network
          |
          v
        WEB01
          |
          | Application Trust
          v
        APP01
          |
          | Service Relationship
          v
        DB01

Identity path:

user01
  |
  v
ITSupport
  |
  v
APP01 Admin
  |
  v
Application Service

Combine the graphs.

Phase 54 — Think in Relationships

Instead of:

Finding 1

Finding 2

Finding 3

ask:

Can Finding 1
Enable Finding 2?

Can Finding 2
Reach Finding 3?

What Is the Final Asset?

Phase 55 — Create Attack Path AP-01

Example:

Attack Path:
AP-01

Starting Position:
Standard domain user

Relationship:
User is member of ITSupport

Relationship:
ITSupport has unnecessary administration
of APP01

Relationship:
APP01 stores application configuration

Target:
Sensitive internal application

Impact:
A compromised support identity could
obtain unintended control over a
business-critical application.

Phase 56 — Create Attack Path AP-02

Example:

Attack Path:
AP-02

Starting Position:
WEB01

Relationship:
WEB01 can communicate with APP01

Relationship:
APP01 can communicate with DB01

Weakness:
Segmentation rules are broader than
business requirements.

Target:
Database environment

Impact:
Compromise of an upstream application
could increase exposure of downstream
systems.

Phase 57 — Create Attack Path AP-03

Example:

Attack Path:
AP-03

Starting Position:
Domain user

Relationship:
Broad file-share access

Weakness:
Operational configuration exposed

Relationship:
Configuration references privileged
service identity

Target:
Enterprise application

Impact:
Unnecessary information exposure could
support further unauthorized access.

Phase 58 — Validate the Path

For every attack path determine:

Is the Starting Position Realistic?

Does Relationship 1 Exist?

Does Relationship 2 Exist?

Is the Target Reachable?

Are Additional Conditions Required?

Which Security Controls Interrupt the Path?

Phase 59 — Do Not Over-Exploit

Your goal is to prove:

PATH EXISTS

not:

CAUSE MAXIMUM IMPACT

Stop when sufficient evidence demonstrates the security risk.

Phase 60 — Capture Evidence

Good evidence might include:

Command Output

Configuration Snippet

Permission Listing

Network Result

Application Screenshot

Group Membership

Access-Control Evidence

Redact unnecessary secrets.

Phase 61 — Build the Findings Register

ID	Finding	Asset	Severity	Attack Path
ENT-001	Excessive server administration	APP01	High	AP-01
ENT-002	Weak segmentation	Network	High	AP-02
ENT-003	Sensitive configuration exposure	FILE01	High	AP-03
ENT-004	Excessive service privilege	APP01	High	AP-01
ENT-005	Unnecessary exposed service	WEB01	Medium	—

Phase 62 — Prioritize Findings

Consider:

Exploitability

Required Access

Business Criticality

Privilege Gained

Data Exposure

Attack-Path Position

Existing Controls

Risk Model

RISK
=
LIKELIHOOD
×
IMPACT

But enterprise context matters.

A medium weakness on:

Critical Attack Path

may deserve higher remediation priority.

Phase 63 — Finding ENT-001

Title:
Excessive Administrative Access to
Application Server

Affected Asset:
APP01

Observation:
The ITSupport group has local
administrative access to a sensitive
application server despite the role not
requiring full system administration.

Impact:
Compromise of an ITSupport identity could
provide administrative control over the
application server.

Recommendation:
Remove unnecessary administrative access
and implement role-specific delegated
administration.

Phase 64 — Finding ENT-002

Title:
Insufficient Network Segmentation

Affected Environment:
Application and Database Networks

Observation:
Network access is broader than required
for documented application communication.

Impact:
Compromise of an upstream system could
increase access to higher-value internal
assets.

Recommendation:
Restrict network rules to explicitly
required source, destination, protocol,
and port combinations.

Phase 65 — Finding ENT-003

Title:
Sensitive Configuration Exposed Through
File Share

Affected Asset:
FILE01

Observation:
A broadly accessible share contains
operational configuration that should
only be available to application
administrators.

Impact:
The information could assist an attacker
in understanding internal services and
identity relationships.

Recommendation:
Restrict access and move sensitive
configuration to an appropriately
controlled repository.

Phase 66 — Finding ENT-004

Title:
Excessive Service Account Privilege

Observation:
An application service identity has
permissions beyond the requirements of
its documented function.

Impact:
Compromise of the application could
inherit unnecessary access to additional
enterprise resources.

Recommendation:
Apply least privilege and periodically
review service-account entitlements.

Phase 67 — Finding ENT-005

Title:
Unnecessary Network Service Exposure

Observation:
A management service is reachable from
a network segment that does not require
administrative access.

Impact:
The additional exposure increases the
attack surface of the system.

Recommendation:
Restrict management interfaces to
approved administrative networks.

Phase 68 — Root Cause Analysis

Do not stop at:

Weak Permission

Ask:

Why Was the Permission Created?

Who Owns It?

Is It Still Required?

Was It Temporary?

Is There a Review Process?

Why Did Security Monitoring
Not Detect It?

Phase 69 — Map Root Causes

Common enterprise root causes include:

Privilege Creep

Legacy Configuration

Poor Asset Inventory

Weak Segmentation

Shared Administration

Weak Service Account Governance

Missing Access Reviews

Configuration Drift

Insufficient Ownership

Consider:

Network Segmentation

Management Networks

Host Firewalls

Default-Deny Rules

Service Restriction

Administrative Access Control

Consider:

Least Privilege

Dedicated Admin Accounts

Administrative Tiering

MFA

Privileged Access Management

Managed Service Accounts

Access Reviews

Consider:

Windows LAPS

Endpoint Protection

Host Firewall

Secure Baselines

Restricted Administration

Patch Governance

PowerShell Logging

Consider:

Least Privilege

Restricted sudo

Secure File Permissions

Service Hardening

SSH Hardening

Patch Governance

Centralized Logging

Consider:

Server-Side Authorization

Strong Session Management

Secret Management

Secure Configuration

Input Validation

Logging

Dependency Management

Consider:

Access Classification

Share Permissions

Encryption

Secret Management

Database Access Control

Backup Protection

Monitor:

Authentication

Privilege Changes

Administrative Access

Network Connections

Sensitive File Access

Application Events

Security Configuration Changes

Phase 77 — Build Detection Opportunities

For every attack path ask:

Where Could This
Have Been Detected?

Example:

User
 ↓
Admin Group Change
 ↓
Server Logon
 ↓
Sensitive Application Access

Potential monitoring points:

Directory

Endpoint

Network

Application

Phase 78 — Cleanup

At the end of the lab:

Remove Temporary Files

Remove Temporary Accounts

Revert Permission Changes

Remove Test Group Memberships

Terminate Sessions

Restore Configurations

Secure Evidence

Revert VM Snapshots If Required

Phase 79 — Retesting

After remediation:

ORIGINAL FINDING
      ↓
REPEAT VALIDATION
      ↓
VERIFY CONTROL
      ↓
VERIFY ATTACK PATH
      ↓
CLOSE / REOPEN

Do not only check:

Was the Configuration Changed?

Check:

Was the Attack Path Actually Broken?

Phase 80 — Final Enterprise Report

Structure:

01 Executive Summary

02 Scope

03 Rules of Engagement

04 Methodology

05 Environment Overview

06 Asset Inventory

07 Attack Surface

08 Findings

09 Attack Paths

10 Business Impact

11 Risk Priorities

12 Remediation Roadmap

13 Retest Guidance

14 Cleanup Confirmation

15 Technical Appendix

Executive Summary Example

The enterprise penetration test identified
multiple weaknesses across network,
identity, server, and application layers.

While several findings had moderate
individual impact, combinations of
excessive administrative access, weak
segmentation, service-account privilege,
and information exposure created higher
risk attack paths toward sensitive
enterprise systems.

The primary remediation priority is to
break these paths through least privilege,
network segmentation, service-account
hardening, stronger access governance,
and improved monitoring.

Attack-Path Report

For each path include:

Attack Path ID:

Starting Position:

Required Access:

Step 01:

Step 02:

Step 03:

Target Asset:

Business Importance:

Security Controls:

Security Gaps:

Potential Impact:

Evidence:

Recommended Path Break:

Retest:

Finding Template

Finding ID:

Title:

Affected Asset:

Severity:

Description:

Evidence:

Required Access:

Security Impact:

Attack Path:

Root Cause:

Recommendation:

Retest Procedure:

Student Deliverables

Complete:

Enterprise Attack-Path Worksheet

Path ID:

Starting Asset / Identity:

Initial Access:

Relationship 01:

Relationship 02:

Relationship 03:

Security Control:

Control Weakness:

Final Target:

Target Classification:

Potential Business Impact:

Evidence:

Recommended Path Break:

Retest Method:

Three-Pass Enterprise Testing Method

Use this method throughout the lab.

Pass 01 — Understand

Hosts

Ports

Services

Users

Applications

Networks

Trust

Do not rush.

Pass 02 — Analyze

Permissions

Configurations

Authentication

Authorization

Segmentation

Dependencies

Security Controls

Pass 03 — Connect

WEAKNESS
   +
RELATIONSHIP
   +
TRUST
   =
ATTACK PATH

This third pass is where enterprise penetration testing becomes especially valuable.

Common Student Mistakes

Avoid:

Scanning Without Scope

Running Every Tool Available

Ignoring Business Context

Ignoring Asset Criticality

Only Looking for CVEs

Ignoring Identity

Ignoring Service Accounts

Ignoring Internal Applications

Ignoring Network Segmentation

Ignoring File Shares

Ignoring Trust Relationships

Treating Findings Independently

Over-Exploiting Systems

Collecting Excessive Data

Poor Evidence Collection

No Cleanup

No Remediation Guidance

Enterprise Pentesting Interview Questions

What is enterprise penetration testing?
How is it different from vulnerability scanning?
Why is scoping important?
What are rules of engagement?
What is an attack surface?
Why should assets be classified?
What is service enumeration?
Why should manual validation follow automated discovery?
What is network segmentation?
How would you test segmentation safely?
What is lateral movement?
What is an attack path?
What is privilege escalation?
Why is Active Directory important in enterprise pentesting?
What is a service account?
Why can service accounts create enterprise risk?
Why are file shares important?
What is credential exposure?
Why should sensitive evidence be minimized?
What is least privilege?
What is privilege creep?
What is administrative tiering?
What is Windows LAPS?
What should you check during Linux privilege assessment?
What should you check during Windows privilege assessment?
Why are scheduled tasks security-sensitive?
Why are application dependencies important?
What is a trust relationship?
How can a medium-severity weakness become part of a critical attack path?
Why should testers map relationships between findings?
What is root-cause analysis?
How would you prioritize remediation?
Why should management services be restricted?
Why are dedicated administrative networks useful?
How does endpoint logging help?
How does network monitoring help?
How does identity monitoring help?
What is controlled validation?
Why is cleanup mandatory?
What should an enterprise penetration-test report contain?

Lab Completion Checklist

Scope

Discovery

Applications

Linux

Windows

Identity

Network

Attack Paths

Reporting

Final Lab Mental Model

Remember:

ENTERPRISE
    ↓
ASSETS
    ↓
SERVICES
    ↓
APPLICATIONS
    ↓
IDENTITIES
    ↓
PERMISSIONS
    ↓
NETWORKS
    ↓
TRUST
    ↓
SECURITY CONTROLS
    ↓
WEAK RELATIONSHIPS
    ↓
ATTACK PATHS
    ↓
BUSINESS IMPACT

A strong enterprise penetration tester does not simply report:

20 Open Ports

12 Vulnerabilities

5 Weak Password Policies

The tester explains:

Starting Position
       ↓
Weakness
       ↓
Trust Relationship
       ↓
Privilege
       ↓
Internal System
       ↓
Identity Relationship
       ↓
Critical Asset

and then answers the most important question:

Where Should the Organization
Break This Attack Path?

That is the difference between:

Vulnerability Hunting

and:

Enterprise Penetration Testing

What’s Next?

➡️ Lab 03 — Linux Privilege Escalation

In the next lab, you will focus deeply on the Linux post-access security assessment workflow.

You will work through:

INITIAL LAB ACCESS
      ↓
IDENTITY
      ↓
GROUP MEMBERSHIP
      ↓
SUDO
      ↓
FILESYSTEM PERMISSIONS
      ↓
SERVICES
      ↓
SCHEDULED TASKS
      ↓
SUID / SGID
      ↓
CAPABILITIES
      ↓
APPLICATION CONFIGURATION
      ↓
SECURITY MISCONFIGURATION
      ↓
CONTROLLED VALIDATION
      ↓
ROOT CAUSE
      ↓
REMEDIATION

The goal is to learn a repeatable methodology for determining why a lower-privileged Linux identity may have more authority than intended, rather than relying on random privilege-escalation scripts.

Lab 02 — Enterprise Pentesting

Mission Information

Mission Scenario

Enterprise Lab Architecture

Learning Objectives

Prerequisites

The Enterprise Pentesting Mindset

Phase 01 — Authorization

Scope Template

Phase 02 — Rules of Engagement

Phase 03 — Build the Evidence Workspace

Evidence Standard

Phase 04 — Establish Your Position

Why This Matters

Phase 05 — Discover Authorized Hosts

Asset Inventory

Phase 06 — Perform Port Discovery

Phase 07 — Perform Targeted Service Enumeration

Service Inventory

Phase 08 — Identify the Asset Role

Phase 09 — Classify Business Criticality

Phase 10 — Build the Attack Surface

Attack Surface Example

Phase 11 — Enumerate DNS

Phase 12 — Build a Network Diagram

Phase 13 — Enumerate HTTP

Phase 14 — Web Application Mapping

Phase 15 — Authentication Review

Phase 16 — Authorization Review

Phase 17 — Review Application Configuration

Phase 18 — Map Application Dependencies

Phase 19 — Linux Assessment

Phase 20 — Understand the Linux Security Context

Phase 21 — Review Linux Privileges

Phase 22 — Review Linux Processes

Phase 23 — Review Listening Services

Phase 24 — Review Linux Services

Phase 25 — Review Scheduled Tasks

Phase 26 — Review SUID Files

Phase 27 — Review Linux Capabilities

Phase 28 — Review File Permissions

Phase 29 — Linux Privilege Escalation Mental Model

Phase 30 — Windows Assessment

Phase 31 — Review Windows System Information

Phase 32 — Review Local Users

Phase 33 — Review Local Administrators

Phase 34 — Review Windows Services

Phase 35 — Review Scheduled Tasks

Phase 36 — Review Windows Network Exposure

Phase 37 — Windows Privilege Assessment Model

Phase 38 — Identify Active Directory Membership

Phase 39 — Enumerate Domain Context

Phase 40 — Identify Privileged Groups

Phase 41 — Map Identity Relationships

Phase 42 — Review Service Accounts

Phase 43 — Review File Shares

Phase 44 — Review Share Permissions

Phase 45 — Sensitive Information Exposure

Phase 46 — Understand Credential Exposure

Phase 47 — Map Trust Relationships

Phase 48 — Review Network Segmentation

Phase 49 — Test Segmentation Safely

Segmentation Matrix

Phase 50 — Identify Segmentation Weaknesses

Phase 51 — Understand Pivoting Conceptually

Phase 52 — Identify Multi-Stage Attack Paths

Phase 53 — Build an Enterprise Attack Graph

Phase 54 — Think in Relationships

Phase 55 — Create Attack Path AP-01

Phase 56 — Create Attack Path AP-02

Phase 57 — Create Attack Path AP-03

Phase 58 — Validate the Path

Phase 59 — Do Not Over-Exploit

Phase 60 — Capture Evidence

Phase 61 — Build the Findings Register

Phase 62 — Prioritize Findings

Risk Model

Phase 63 — Finding ENT-001

Phase 64 — Finding ENT-002

Phase 65 — Finding ENT-003