02 — Network Penetration Testing

Networks connect almost every component of an enterprise environment.

Servers, workstations, applications, databases, identity systems, cloud workloads, management interfaces, security appliances, and operational services communicate through networks.

For an Ethical Hacker, the network answers one of the most important questions:

What can communicate with what?

Network Penetration Testing is the structured process of identifying reachable systems, understanding exposed services, validating security weaknesses, evaluating network trust relationships, and determining whether those weaknesses could create meaningful attack paths.

The objective is not simply to scan ports.

The objective is to understand:

Network
   ↓
Hosts
   ↓
Ports
   ↓
Services
   ↓
Configurations
   ↓
Identities
   ↓
Trust Relationships
   ↓
Weaknesses
   ↓
Attack Paths
   ↓
Business Impact

Module Mission

Your mission is to learn how to conduct a structured network penetration test inside an authorised environment.

The core methodology is:

Scope
  ↓
Network Understanding
  ↓
Host Discovery
  ↓
Port Scanning
  ↓
Service Enumeration
  ↓
Protocol Analysis
  ↓
Vulnerability Analysis
  ↓
Controlled Validation
  ↓
Credential / Privilege Analysis
  ↓
Segmentation Analysis
  ↓
Lateral Movement Analysis
  ↓
Attack Path Development
  ↓
Evidence
  ↓
Reporting

By the end of this module, you should be able to look at an unfamiliar authorised network and systematically determine:

• Which systems exist

• Which services are exposed

• What technologies are running

• Which security weaknesses exist

• Which trust relationships matter

• Whether segmentation is effective

• Where credentials could expand access

• How individual weaknesses could combine

• What the resulting business risk is

1. What Is Network Penetration Testing?

Network Penetration Testing evaluates the security of network-accessible infrastructure.

Typical targets may include:

• Servers

• Workstations

• Routers

• Switches

• Firewalls

• VPN gateways

• Directory services

• DNS servers

• File servers

• Databases

• Administrative interfaces

• Network appliances

• Cloud-connected infrastructure

Testing should always remain within explicitly authorised scope.

2. Network Penetration Testing vs Vulnerability Scanning

These are not identical activities.

Vulnerability Scanning

Typically follows:

Targets
   ↓
Scanner
   ↓
Potential Vulnerabilities
   ↓
Severity

Network Penetration Testing

Goes further:

Targets
   ↓
Discovery
   ↓
Enumeration
   ↓
Weakness
   ↓
Validation
   ↓
Access
   ↓
Attack Path
   ↓
Impact

A penetration tester needs to understand how weaknesses interact.

3. External vs Internal Network Testing

External Network Penetration Test

Evaluates services exposed outside the organisation.

Potential targets include:

Internet
   ↓
Firewall
   ↓
VPN
Web Services
Mail Services
Remote Access
Public Infrastructure

The attacker perspective begins outside the organisation.

Internal Network Penetration Test

Assumes some level of internal access.

For example:

Compromised Employee
        ↓
Corporate Network
        ↓
Internal Services
        ↓
Servers
        ↓
Identity Infrastructure

Internal testing often focuses heavily on trust relationships and lateral movement.

4. Understand the Network Before Testing

Do not immediately start scanning.

First understand:

• Network ranges

• Target ranges

• Excluded systems

• Testing source

• Network zones

• Routing

• Critical systems

• Restrictions

• Testing windows

A basic network may look like:

Internet
   ↓
Firewall
   ↓
DMZ
   ↓
Internal Network
   ├── Workstations
   ├── Application Servers
   ├── File Servers
   └── Identity Services

Network context helps you interpret results.

5. Network Segmentation

Enterprise networks may contain multiple security zones.

Example:

Internet
   ↓
DMZ
   ↓
User Network
   ↓
Application Network
   ↓
Database Network
   ↓
Management Network

The important question is:

Are the intended trust boundaries actually enforced?

6. Understand IP Addressing

IPv4 addresses contain four octets.

Example:

192.168.10.25

A subnet might be represented as:

192.168.10.0/24

A /24 commonly represents addresses within:

192.168.10.0
      ↓
192.168.10.255

Understanding subnetting is essential for network discovery.

7. Private IPv4 Address Space

Common private address ranges include:

10.0.0.0/8

172.16.0.0/12

192.168.0.0/16

These commonly appear inside enterprise networks and labs.

8. Understand the Default Gateway

Hosts commonly send traffic destined for other networks through a gateway.

Conceptually:

Workstation
    ↓
Default Gateway
    ↓
Other Network

Understanding routing helps explain which networks are reachable.

9. Understand ARP

Within a local IPv4 network, ARP helps map IP addresses to MAC addresses.

Conceptually:

IP Address
    ↓
ARP
    ↓
MAC Address

Local network discovery may therefore use ARP-based techniques.

10. Understand ICMP

ICMP supports network control and diagnostic functions.

A familiar example is:

Host A
  ↓
ICMP Echo Request
  ↓
Host B
  ↓
ICMP Echo Reply

However:

A host that does not respond to ICMP is not necessarily offline.

Firewalls may block ICMP while other services remain reachable.

11. Understand TCP

TCP is connection-oriented.

Simplified handshake:

Client
  │
  │ SYN
  ↓
Server
  │
  │ SYN/ACK
  ↓
Client
  │
  │ ACK
  ↓
Established

Understanding this handshake helps you understand TCP scanning.

12. Understand UDP

UDP is connectionless.

There is no TCP-style three-way handshake.

This makes UDP scanning more difficult to interpret.

A lack of response may mean:

Service Open

Traffic Filtered

Packet Lost

UDP services should not be ignored.

13. Common Network Services

Become familiar with common ports.

Port	Service
21	FTP
22	SSH
23	Telnet
25	SMTP
53	DNS
80	HTTP
88	Kerberos
110	POP3
135	RPC
139	NetBIOS
143	IMAP
161	SNMP
389	LDAP
443	HTTPS
445	SMB
636	LDAPS
1433	Microsoft SQL Server
3306	MySQL
3389	RDP
5432	PostgreSQL
5985	WinRM
5986	WinRM HTTPS

Do not blindly associate ports with services.

Always validate.

14. Build Your Network Penetration Testing Workspace

Create:

02 Network Penetration Testing/
│
├── 01 Scope
├── 02 Network Maps
├── 03 Host Discovery
├── 04 Port Scans
├── 05 Service Enumeration
├── 06 Vulnerability Analysis
├── 07 Validation
├── 08 Credentials
├── 09 Attack Paths
├── 10 Evidence
└── 11 Findings

Structured notes become increasingly important as the environment grows.

15. Step 1 — Confirm Scope

Before scanning:

[ ] Target network confirmed
[ ] Source system confirmed
[ ] Testing window confirmed
[ ] Exclusions identified
[ ] Restricted techniques identified
[ ] Emergency contact understood

Never assume an adjacent subnet is automatically in scope.

16. Step 2 — Identify Your Network Position

On your authorised lab system, determine:

Your IP

Subnet Mask

Gateway

DNS Server

Network Interfaces

Routes

This answers:

Where am I located within the network?

17. Linux Network Information

Common commands in your own lab include:

ip addr

Routing:

ip route

Interfaces:

ip link

DNS configuration may be inspected through the operating system’s resolver configuration.

The objective is understanding your network context.

18. Windows Network Information

On Windows lab systems:

ipconfig /all

Routing:

route print

These help identify:

• IP address

• Subnet

• Gateway

• DNS

• Network interfaces

19. Step 3 — Host Discovery

Once the authorised range is known, determine which hosts are reachable.

Conceptually:

192.168.10.0/24
       ↓
Host Discovery
       ↓
192.168.10.10
192.168.10.15
192.168.10.20
192.168.10.25

This becomes your initial asset list.

20. Host Discovery Techniques

Discovery may involve:

• ARP

• ICMP

• TCP probes

• UDP probes

No single discovery technique works everywhere.

Firewalls and host configurations affect responses.

21. Nmap

Nmap is a widely used network discovery and service enumeration tool.

In your authorised lab:

nmap 192.168.56.10

A simple scan may identify commonly accessible TCP ports.

For a lab subnet:

nmap -sn 192.168.56.0/24

This can help identify responding hosts without performing a traditional port scan.

22. Record Discovered Hosts

Create an inventory.

Host	IP	Initial Observation
LAB-DC01	192.168.56.10	Windows Server
LAB-WEB01	192.168.56.20	Web Server
LAB-LNX01	192.168.56.30	Linux Server

Do not rely entirely on tool output files.

Build an understandable map.

23. Step 4 — TCP Port Scanning

After identifying targets, determine accessible TCP ports.

Example lab command:

nmap -sT 192.168.56.20

A SYN scan may be used where appropriate privileges and lab conditions permit:

sudo nmap -sS 192.168.56.20

The important skill is understanding the result.

24. Port States

Nmap may report states such as:

open

closed

filtered

Open

A service appears to be accepting connections.

Closed

The host responds, but no service is listening on that port.

Filtered

A network control prevents reliable determination of the port state.

25. Scan All TCP Ports When Appropriate

Default scans do not necessarily test every TCP port.

In an authorised lab:

nmap -p- 192.168.56.20

This tests the full TCP port range.

Be mindful that broad scanning can create significant traffic.

26. Do Not Scan Faster Than Necessary

A common beginner mistake is attempting the fastest possible scan.

In professional environments, aggressive scanning may:

• Trigger alerts

• Overload fragile services

• Produce unreliable results

• Cause operational issues

Use an appropriate scanning strategy.

27. Step 5 — Service Detection

Once ports are identified, determine what services are running.

Example:

nmap -sV 192.168.56.20

Potential result:

22/tcp   open  ssh
80/tcp   open  http
443/tcp  open  https

Now begin service-specific enumeration.

28. Operating System Fingerprinting

Operating-system detection may help develop hypotheses about the target.

In an authorised lab:

sudo nmap -O 192.168.56.20

Treat OS fingerprinting as an estimate.

Validate using additional evidence.

29. Combined Enumeration

In labs, you may encounter:

sudo nmap -sV -O 192.168.56.20

Do not simply copy commands.

Understand what each option changes.

30. Save Scan Results

Good testers preserve relevant output.

Nmap supports multiple output formats.

Example:

nmap -sV -oA scans/web01 192.168.56.20

This creates reusable scan artifacts.

Your workflow becomes:

Scan
  ↓
Save
  ↓
Analyse
  ↓
Reference Evidence

31. Build a Service Matrix

Example:

IP	Port	Service	Version	Next Action
192.168.56.20	22	SSH	OpenSSH	SSH review
192.168.56.20	80	HTTP	Apache	Web enumeration
192.168.56.30	445	SMB	SMB	Share enumeration

This creates an assessment plan.

32. Enumeration by Service

Do not treat every open port identically.

Think:

Port
 ↓
Protocol
 ↓
Service
 ↓
Configuration
 ↓
Authentication
 ↓
Information
 ↓
Potential Weakness

Each protocol has its own enumeration methodology.

33. HTTP and HTTPS Enumeration

For a web service, investigate:

• Page title

• Server headers

• Redirects

• Authentication

• Technologies

• Virtual hosts

• Accessible paths

• TLS

Simple interaction:

curl -I http://192.168.56.20

The response may reveal useful headers.

34. HTTP Headers

You may observe:

Server

Content-Type

Location

Set-Cookie

Security Headers

Headers are clues, not conclusions.

Web testing will be covered deeply in the next module.

35. TLS Review

HTTPS services introduce additional questions:

• Which certificate is used?

• Is it expired?

• Which names are present?

• Which protocols are enabled?

• Are weak configurations present?

Certificates may also reveal useful hostnames.

36. SSH Enumeration

When SSH is exposed, determine:

Version

Authentication Methods

Configuration

Exposure

Access Restrictions

Questions include:

Is password authentication allowed?

Is direct privileged login permitted?

Is the service internet accessible?

Is the software obsolete?

Do not attempt credential guessing unless explicitly authorised.

37. FTP Enumeration

FTP services may require investigation of:

• Anonymous access

• Read permissions

• Write permissions

• Exposed files

• Sensitive information

• Encryption

A high-risk scenario might be:

Anonymous FTP
      ↓
Writable Directory
      ↓
Application-Consumed Content
      ↓
Potential Attack Path

The complete context determines risk.

38. Telnet

Telnet historically transmits communications without modern transport encryption.

If discovered, determine:

• Why it exists

• Where it is accessible

• What it manages

• Whether safer alternatives exist

Legacy protocols can create significant exposure.

39. DNS Enumeration

DNS can reveal network relationships.

Useful questions include:

Which Domain?

Which Name Servers?

Which Hosts?

Which Mail Servers?

Which Internal Naming Patterns?

DNS findings may feed other enumeration activities.

40. DNS Querying

Within an authorised lab, tools such as:

nslookup lab.local

or:

dig lab.local

can help inspect DNS information.

Specific record types can also be queried.

41. SMB

SMB is extremely important in Windows enterprise environments.

Common ports:

139

445

SMB may provide:

• File sharing

• Printer sharing

• Authentication

• Remote administration

• Domain-related information

42. SMB Enumeration Questions

Ask:

Which Host?

Which Domain?

Which Shares?

Anonymous Access?

Guest Access?

Which Users Have Access?

What Permissions Exist?

Do not jump immediately to exploitation.

43. SMB Share Enumeration

In an authorised lab, a command such as:

smbclient -L //192.168.56.10 -N

may test whether share listing is possible without supplied credentials.

If access is denied, record that result.

Do not treat a denied request as failure—it tells you something about the security control.

44. SMB Share Risk

Suppose you discover:

\\FILE01\Public

The share itself is not necessarily vulnerable.

Investigate:

• Who can read?

• Who can write?

• What information exists?

• Are credentials stored?

• Are scripts stored?

• Are backups present?

Context determines the finding.

45. Sensitive Files in Shares

Potentially sensitive artifacts include:

Configuration Files

Backups

Scripts

Deployment Files

Credentials

Private Keys

Database Connections

If sensitive information is encountered:

Collect the minimum evidence required.

46. RPC

Windows RPC services can expose information about system functionality.

RPC is frequently associated with:

135/tcp

and dynamic high ports.

Understanding RPC becomes increasingly important during Windows and Active Directory testing.

47. LDAP

LDAP commonly appears on:

389/tcp

Secure LDAP commonly appears on:

636/tcp

LDAP is particularly important in directory environments.

It may expose information relating to:

• Users

• Groups

• Computers

• Directory structure

Active Directory enumeration will be covered in Module 04.

48. Kerberos

Kerberos commonly uses:

88/tcp
88/udp

Its presence often suggests a directory-based authentication environment.

Conceptually:

User
  ↓
Authentication
  ↓
Kerberos
  ↓
Service Access

Kerberos security becomes central during Active Directory testing.

49. RDP

Remote Desktop commonly uses:

3389/tcp

Questions include:

• Who can reach it?

• Is Network Level Authentication used?

• Is MFA enforced through the access path?

• Is the service exposed externally?

• Which accounts can authenticate?

Remote administration exposure deserves careful review.

50. WinRM

Windows Remote Management commonly appears on:

5985
5986

It may provide remote administrative capabilities.

If credentials are obtained during an authorised lab, understanding whether they permit remote management can become part of attack-path analysis.

51. SNMP

SNMP commonly uses UDP port:

161

It may reveal:

• Hostnames

• Interfaces

• Routing

• System information

• Device details

Older or poorly configured SNMP deployments can expose significant information.

52. SMTP

SMTP commonly uses:

25
587
465

Security assessment questions may include:

• Server exposure

• Relay configuration

• Encryption

• Authentication

• Information disclosure

Avoid sending unsolicited messages during testing unless explicitly permitted.

53. Database Services

Common database ports include:

1433 → Microsoft SQL Server

3306 → MySQL

5432 → PostgreSQL

Database exposure raises questions such as:

Should this database be reachable from my network zone?

Is authentication required?

Is encryption used?

Which identities can connect?

Often the most important issue is inappropriate network exposure.

54. Management Interfaces

Look carefully for:

• Hypervisor management

• Firewall management

• Storage management

• Database administration

• Backup consoles

• Kubernetes management

• Server administration

Management-plane exposure can create high-impact attack paths.

55. UDP Enumeration

Do not focus only on TCP.

Important UDP services may include:

53   DNS

67/68 DHCP

123  NTP

161  SNMP

UDP scanning is slower and may require targeted techniques.

56. Targeted UDP Scanning

In an authorised lab:

sudo nmap -sU --top-ports 20 192.168.56.10

A targeted approach is often more practical than immediately scanning every UDP port.

57. Enumeration Depth

A useful principle:

Every open service creates a new enumeration branch.

Example:

445/tcp
   ↓
SMB
   ↓
Shares
   ↓
Files
   ↓
Configuration
   ↓
Credential
   ↓
New Service

This is how attack paths emerge.

58. Network Vulnerability Analysis

After enumeration, analyse:

• Service versions

• Configuration

• Authentication

• Access control

• Encryption

• Exposure

• Known vulnerabilities

Do not limit vulnerability analysis to software versions.

59. Configuration Weaknesses

Many important network findings are configuration issues.

Examples:

Anonymous Access

Weak Authentication

Unnecessary Services

Overly Permissive Firewall Rules

Exposed Management Interfaces

Weak Network Segmentation

Unencrypted Protocols

Default Credentials

These may be more important than individual CVEs.

60. Vulnerability Scanning

Automated vulnerability scanners can support:

Asset
  ↓
Service
  ↓
Potential Vulnerability

But scanner output is the beginning of analysis.

Not the final report.

61. Validate Scanner Findings

For important findings ask:

Is the Service Present?

Is the Version Correct?

Is the Vulnerable Feature Enabled?

Is the Target Reachable?

Is Exploitation Realistic?

Are Compensating Controls Present?

Then determine whether the issue is valid.

62. Known Vulnerability Research

When a vulnerable version is identified, research:

• Vendor advisory

• CVE

• Affected versions

• Required conditions

• Patch availability

• Exploitation prerequisites

Prefer authoritative vulnerability information when possible.

63. SearchSploit in a Lab

Where installed, SearchSploit can help search a local Exploit-DB archive.

Example:

searchsploit "product version"

Treat results as research leads.

Never execute exploit code without understanding what it does.

64. Read Exploit Code

Before using a proof of concept:

Read Code
   ↓
Understand Preconditions
   ↓
Understand Actions
   ↓
Understand Side Effects
   ↓
Validate Target
   ↓
Decide Whether Testing Is Safe

Public exploit code should not automatically be trusted.

65. Controlled Exploitation

If exploitation is permitted:

Potential Vulnerability
        ↓
Validate Preconditions
        ↓
Safe Proof
        ↓
Collect Evidence
        ↓
Stop

The objective is proving the risk.

66. Avoid Unnecessary Destructive Actions

Unless explicitly authorised, avoid actions such as:

• Deleting data

• Disabling services

• Modifying production configuration

• Rebooting systems

• Creating persistence

• Disrupting users

Use the minimum proof necessary.

67. Initial Access

Network exploitation may result in:

Remote Shell

Application Access

User Credential

Administrative Interface

Database Access

The next question is:

What does this access allow?

68. Local Enumeration After Access

On an authorised lab target, investigate:

Current User

Privileges

Operating System

Network Interfaces

Processes

Services

Connections

Accessible Files

This helps understand the compromised context.

69. Linux Local Context

Typical questions include:

Who am I?

Which groups?

Which interfaces?

Which routes?

Which services?

Which privileges?

The objective is to understand the system, not randomly modify it.

70. Windows Local Context

Similarly determine:

• Current identity

• Group membership

• Hostname

• Network interfaces

• Routes

• Domain membership

• Available privileges

This becomes especially important before Active Directory analysis.

71. Privilege Escalation

Once limited access is obtained, determine whether local weaknesses permit additional privilege.

Potential categories include:

Weak Permissions

Misconfigured Services

Exposed Credentials

Excessive Privileges

Vulnerable Software

Privilege escalation techniques should only be used within controlled, authorised environments.

72. Credential Discovery

Credentials may appear in:

• Configuration files

• Scripts

• Environment variables

• Backups

• Deployment files

• Password stores

Protect any discovered credentials.

They may create additional attack paths.

73. Credential Reuse

Suppose:

Server A
   ↓
Credential Found
   ↓
Server B

If testing credential reuse is permitted, the finding may demonstrate that compromise of one system expands to another.

This is more meaningful than the isolated credential exposure.

74. Network Trust Relationships

Attackers frequently exploit trust.

Examples:

User Network
     ↓
Server Network

Application Server
       ↓
Database

Management Host
      ↓
Entire Environment

Ask:

What does this system trust?

75. Segmentation Testing

Suppose the intended architecture is:

User Network
     X
Database Network

But testing reveals:

User Network
     ↓
Database Port
     ↓
Production Database

This may indicate ineffective segmentation.

76. Test Segmentation Systematically

Build a matrix.

Source Zone	Destination Zone	Service	Expected	Actual
User	Database	SQL	Blocked	Allowed
User	Management	RDP	Blocked	Blocked
App	Database	SQL	Allowed	Allowed

This turns network testing into evidence-based control validation.

77. Segmentation Is More Than Firewalls

Consider:

Network ACLs

Host Firewalls

Cloud Security Groups

Routing

Identity Controls

Application Controls

Multiple controls may contribute to segmentation.

78. Flat Networks

A flat network may allow broad communication.

Example:

Workstation
   ├──→ File Server
   ├──→ Database
   ├──→ Backup Server
   ├──→ Management
   └──→ Directory Services

A compromised workstation may therefore have a large blast radius.

79. Blast Radius

Ask:

If this host is compromised, what becomes reachable?

Example:

User Workstation
       ↓
Internal Network
       ↓
Management Services
       ↓
Critical Servers

Network architecture strongly influences blast radius.

80. Lateral Movement

Lateral movement occurs when an attacker moves from one compromised system to another.

Conceptually:

Host A
  ↓
Credential / Trust
  ↓
Host B
  ↓
Higher Privilege
  ↓
Host C

This becomes a major focus in enterprise penetration testing.

81. Lateral Movement Requirements

Movement usually requires some combination of:

Reachability
     +
Identity
     +
Permission
     +
Remote Service

Removing any one of these may break the attack path.

This is important when developing remediation.

82. Pivoting

A compromised system may have access to networks that your testing system cannot directly reach.

Conceptually:

Tester
  ↓
Compromised Host
  ↓
Restricted Network
  ↓
Internal Target

The compromised host becomes a pivot point.

83. Pivoting vs Lateral Movement

They are related but different.

Pivoting

Uses a system to reach another network or service.

Lateral Movement

Uses obtained access to compromise or access additional systems.

Example:

Tester
  ↓
Host A
  ↓
Pivot
  ↓
Network B
  ↓
Credential
  ↓
Host B

84. Tunnelling Concepts

Network tunnels may forward traffic through an intermediate system.

Conceptually:

Tester
   ↓
Tunnel
   ↓
Compromised Host
   ↓
Internal Service

You will practise these concepts only in isolated authorised environments.

85. Routing During Pivoting

Always understand:

Source
  ↓
Route
  ↓
Pivot
  ↓
Destination

Many pivoting problems are actually routing problems.

Strong networking fundamentals make these techniques easier to understand.

86. Network Attack Paths

A meaningful penetration test should connect findings.

Example:

User Network Access
        ↓
Open SMB Share
        ↓
Configuration Backup
        ↓
Service Credential
        ↓
Application Server
        ↓
Administrative Interface
        ↓
Privileged Access

This tells a much stronger security story than five isolated findings.

87. Attack Path Analysis

For each path identify:

Entry Point

Weakness

Credential / Identity

Trust Relationship

Privilege

Critical Asset

Business Impact

Then determine which control would most effectively break the path.

88. Attack Path Choke Points

Consider:

Initial Access
      ↓
Credential
      ↓
Server
      ↓
Admin
      ↓
Critical Asset

Potential choke points include:

• Better credential protection

• Network segmentation

• Least privilege

• Strong authentication

• Restricted remote management

Good remediation breaks attack paths.

89. Network Detection Awareness

While testing, ask:

Would the SOC detect this?

Activities may generate:

• Firewall logs

• IDS/IPS alerts

• Authentication events

• Endpoint alerts

• Network telemetry

Ethical hackers benefit from understanding defensive visibility.

90. Network Scanning Detection

Scanning may produce patterns such as:

One Source
    ↓
Many Destination Ports

or:

One Source
    ↓
Many Destination Hosts

These patterns may be detectable.

This becomes useful when learning red team operations.

91. Evidence Collection

For every meaningful result capture:

Target

Timestamp

Technique

Relevant Output

Evidence ID

Interpretation

Example:

Evidence: EV-NET-012

Target:
192.168.56.20

Observation:
SMB share accessible without authentication.

Impact:
Internal configuration files were exposed.

92. Avoid Evidence Overload

Do not capture hundreds of meaningless screenshots.

Collect evidence that proves:

Condition
   ↓
Security Weakness
   ↓
Impact

Quality matters more than quantity.

93. Build a Network Finding Register

Example:

ID	Finding	Asset	Severity	Evidence
NET-001	Anonymous SMB Access	FILE01	High	EV-012
NET-002	Legacy Telnet Service	SW01	Medium	EV-019
NET-003	Weak Segmentation	DB Zone	High	EV-026

This becomes your reporting source.

94. Example Finding — Anonymous SMB Access

NET-001 — Sensitive Network Share Accessible Without Authentication

Observation

The assessment identified an SMB share that permitted unauthenticated access and contained internal configuration information.

Attack Scenario

An attacker with network access could connect to the share without valid credentials and obtain configuration data that may support further compromise.

Impact

The exposed information could assist credential discovery, service enumeration, or lateral movement.

Recommendation

Disable anonymous access, enforce authenticated access, review share permissions, remove unnecessary sensitive files, and monitor access to sensitive network shares.

95. Example Finding — Weak Network Segmentation

NET-002 — User Network Can Directly Access Database Services

Observation

Testing demonstrated that systems within the standard user network could establish connections directly to database services within the production database network.

Attack Scenario

An attacker compromising a user workstation could directly interact with database services, increasing opportunities for credential attacks, vulnerability exploitation, or unauthorised data access.

Impact

Weak segmentation increases the blast radius of workstation compromise and reduces protection around critical data systems.

Recommendation

Restrict database connectivity to explicitly authorised application systems and administrative paths using network and host-level controls.

96. Example Finding — Exposed Management Interface

NET-003 — Administrative Management Service Accessible From User Network

Observation

A privileged administrative service was reachable from the standard employee network.

Risk

Compromise of an employee workstation could provide direct network access to a sensitive management interface.

Recommendation

Place management services within a dedicated administrative network and restrict access to authorised management systems and identities.

97. Network Risk Themes

Individual findings may combine into larger themes.

Example findings:

RDP broadly accessible

SSH broadly accessible

Management interface reachable

Database directly reachable

Instead of treating these only as four issues, identify the systemic theme:

Insufficient Network Segmentation and Management-Plane Isolation

This demonstrates more mature analysis.

98. Root Cause Analysis

Repeated network weaknesses may indicate:

No Segmentation Standard

Legacy Architecture

Overly Broad Firewall Rules

Weak Change Governance

Poor Asset Classification

No Management Network

Recommendations should address the root cause where possible.

99. Network Remediation Principles

Common improvements include:

Reduce Exposure

Remove Unnecessary Services

Segment Networks

Restrict Management Access

Use Strong Authentication

Protect Credentials

Patch Vulnerabilities

Encrypt Communications

Monitor Network Activity

Prioritise changes that break important attack paths.

100. Network Penetration Test Report

A useful report structure:

Executive Summary

Scope

Methodology

Network Overview

Attack Surface

Attack Paths

Risk Summary

Detailed Findings

Recommendations

Appendices

Include diagrams where they help explain complex paths.

101. Before-and-After Network Diagram

Current state:

User Network
   ├──→ Application
   ├──→ Database
   └──→ Management

Target state:

User Network
     ↓
Application
     ↓
Database

Admin Workstation
     ↓
Management Network
     ↓
Management Services

Architecture diagrams can make remediation easier to understand.

102. Network Penetration Testing Lab Workflow

Use this workflow for each lab:

Mission
  ↓
Scope
  ↓
Identify Network
  ↓
Discover Hosts
  ↓
Scan Ports
  ↓
Enumerate Services
  ↓
Research Weaknesses
  ↓
Validate Safely
  ↓
Analyse Privilege
  ↓
Test Trust / Segmentation
  ↓
Build Attack Path
  ↓
Collect Evidence
  ↓
Write Finding
  ↓
Cleanup

103. Practical Lab Scenario

Assume the following isolated lab:

Attacker
192.168.56.5
     │
     ├── 192.168.56.10 — Windows Server
     │
     ├── 192.168.56.20 — Linux Web Server
     │
     └── 192.168.56.30 — File Server

Your mission:

Identify the exposed services and determine whether any network weakness creates a path to unauthorised access.

104. Step 1 — Discover Hosts

Within the lab:

nmap -sn 192.168.56.0/24

Document discovered systems.

Do not immediately start exploitation.

105. Step 2 — Enumerate TCP Ports

For each target:

nmap -p- 192.168.56.20

Suppose you discover:

22/tcp
80/tcp
445/tcp

Build three enumeration branches.

106. Step 3 — Service Detection

nmap -sV -p22,80,445 192.168.56.20

Record:

Service

Version

Evidence

Next Action

107. Step 4 — Enumerate SMB

Suppose anonymous share listing is allowed.

You discover:

Backup

Inside:

app-config.old

The file contains a lab application credential.

Your attack path begins developing.

108. Step 5 — Validate Credential Use

Before using it ask:

Is the destination in scope?

Is credential reuse testing permitted?

Could login affect production?

What evidence is sufficient?

In your isolated training environment, safely validate the intended scenario.

109. Step 6 — Build the Attack Path

Suppose the credential provides access to the web application.

Network Access
     ↓
Anonymous SMB
     ↓
Backup File
     ↓
Application Credential
     ↓
Application Access

This is now more meaningful than simply reporting an open SMB share.

110. Step 7 — Identify Root Causes

Possible causes:

Anonymous Share Access

Sensitive Backup Storage

Weak Secret Management

Multiple controls failed.

111. Step 8 — Develop Recommendations

Recommend:

1. Disable anonymous SMB access.

2. Restrict share permissions.

3. Remove configuration backups.

4. Rotate exposed credentials.

5. Store secrets using approved mechanisms.

6. Monitor sensitive share access.

This addresses the complete attack path.

112. Step 9 — Create Evidence

Your evidence set might contain:

EV-NET-001 — Host Discovery

EV-NET-002 — Port Scan

EV-NET-003 — SMB Share Listing

EV-NET-004 — Sanitised Configuration Evidence

EV-NET-005 — Controlled Login Validation

Each evidence item supports a conclusion.

113. Step 10 — Write the Finding

Do not write:

SMB hacked.

Write:

Unauthenticated Network Share Exposes Application Credentials

Then explain:

Observation
      ↓
Attack Scenario
      ↓
Impact
      ↓
Recommendation

This is professional penetration testing.

114. Network Penetration Testing Checklist

[ ] Scope confirmed
[ ] Network ranges documented
[ ] Exclusions understood
[ ] Tester network position identified
[ ] Routes understood
[ ] Live hosts discovered
[ ] TCP ports enumerated
[ ] Important UDP services assessed
[ ] Services fingerprinted
[ ] HTTP services enumerated
[ ] SSH reviewed
[ ] FTP reviewed where present
[ ] SMB reviewed
[ ] DNS reviewed
[ ] SNMP reviewed where present
[ ] LDAP/Kerberos identified
[ ] RDP/WinRM exposure reviewed
[ ] Database exposure reviewed
[ ] Management interfaces identified
[ ] Vulnerability analysis completed
[ ] Scanner findings validated
[ ] Exploitation controlled
[ ] Credentials protected
[ ] Privilege boundaries assessed
[ ] Segmentation assessed
[ ] Trust relationships analysed
[ ] Lateral movement paths considered
[ ] Pivot opportunities documented where authorised
[ ] Attack paths developed
[ ] Evidence collected
[ ] Findings validated
[ ] Root causes identified
[ ] Recommendations developed
[ ] Cleanup completed

115. Build Your Network Penetration Testing Toolkit

Create:

Network Penetration Testing Toolkit/
│
├── 01 Network Scope Template
├── 02 Network Mapping Worksheet
├── 03 Host Discovery Checklist
├── 04 TCP Scanning Checklist
├── 05 UDP Scanning Checklist
├── 06 Service Enumeration Checklist
├── 07 HTTP Enumeration
├── 08 SMB Enumeration
├── 09 DNS Enumeration
├── 10 SSH Review
├── 11 SNMP Review
├── 12 Database Review
├── 13 Vulnerability Validation
├── 14 Segmentation Matrix
├── 15 Credential Log
├── 16 Attack Path Worksheet
├── 17 Evidence Log
├── 18 Finding Template
└── 19 Network Report Template

116. Build a Service Enumeration Cheat Sheet

Maintain:

Service
│
├── Default Ports
├── Purpose
├── Enumeration Questions
├── Useful Tools
├── Common Misconfigurations
├── Authentication
├── Evidence
└── Remediation

Do this for:

• HTTP

• SSH

• SMB

• DNS

• FTP

• LDAP

• Kerberos

• RDP

• WinRM

• SNMP

• Databases

Over time, this becomes your personal penetration-testing reference.

117. Network Penetration Testing Questions

For every discovered service ask:

Exposure

Who can reach this service?

Purpose

Why does it exist?

Version

What technology is running?

Authentication

Who can authenticate?

Authorization

What can authenticated users do?

Encryption

Is communication protected?

Configuration

Is the service securely configured?

Vulnerability

Are relevant vulnerabilities present?

Trust

What other systems trust this service?

Credential

Could compromise expose credentials?

Path

Where could an attacker go next?

Impact

What does compromise ultimately mean?

118. Common Network Penetration Testing Mistakes

Avoid:

Scanning Everything Without Confirming Scope

Adjacent networks may not be authorised.

Running Only Default Scans

Important services may exist on non-standard ports.

Ignoring UDP

Some critical services use UDP.

Treating Ports as Vulnerabilities

An open port is information.

Trusting Service Banners Blindly

Validate important conclusions.

Exploiting Before Enumerating

Thorough enumeration frequently reveals safer and more meaningful paths.

Ignoring Credentials

Identity often drives lateral movement.

Ignoring Segmentation

Reachability itself can represent an important control weakness.

Reporting Every Tool Output

Report security issues, not raw scanner noise.

Ignoring Attack Chains

The combined path may represent the real risk.

119. The Network Hacker Mindset

When you see:

445/tcp open

do not think only:

SMB.

Think:

Which Host?
   ↓
Which SMB Version?
   ↓
Domain?
   ↓
Anonymous?
   ↓
Shares?
   ↓
Permissions?
   ↓
Files?
   ↓
Credentials?
   ↓
Trust?
   ↓
Next System?

When you see:

3389/tcp open

think:

Who Can Reach It?
   ↓
Who Can Authenticate?
   ↓
Is MFA Present?
   ↓
Which System?
   ↓
What Privilege?
   ↓
Why Is It Exposed?

This questioning process is the real skill.

120. Think in Relationships

A network is not simply:

IP
Port
Service

A network is:

Identity
   ↓
System
   ↓
Service
   ↓
Credential
   ↓
Trust
   ↓
Another System
   ↓
Critical Asset

The Ethical Hacker’s job is to understand those relationships.

121. Think About the Defender

For every attack path ask:

What Control Should Prevent This?

What Control Should Detect This?

Which Log Records It?

Which Team Owns It?

What Would Break the Attack Path?

This improves your recommendations and prepares you for red team engagements.

122. Definition of Success

A successful network penetration test is not:

I found 50 open ports.

It is not:

The vulnerability scanner found 100 issues.

It is not even necessarily:

I obtained administrator access.

A successful assessment can explain:

What Is Exposed
      ↓
What Is Weak
      ↓
What Can Be Exploited
      ↓
Where an Attacker Can Move
      ↓
What Critical Asset Is at Risk
      ↓
Which Controls Should Change

That is the difference between running security tools and conducting a professional Network Penetration Test.

Key Takeaways

Network Penetration Testing requires strong networking fundamentals and disciplined enumeration.

Remember:

Understand the network before scanning it.

Confirm scope before touching a target.

Discover hosts before investigating services.

Enumerate services before attempting exploitation.

Do not ignore UDP.

An open port is not automatically a vulnerability.

Configuration weaknesses can be as important as CVEs.

Credentials frequently connect separate attack paths.

Segmentation determines how far compromise can spread.

Lateral movement requires reachability, identity, permission, and a usable service.

Attack paths matter more than isolated findings.

Collect evidence that proves the security conclusion.

Use controlled exploitation only to demonstrate sufficient impact.

Your core methodology is:

Scope
  ↓
Map Network
  ↓
Discover Hosts
  ↓
Enumerate Ports
  ↓
Enumerate Services
  ↓
Analyse Configuration
  ↓
Identify Weaknesses
  ↓
Validate
  ↓
Analyse Credentials
  ↓
Test Trust Boundaries
  ↓
Develop Attack Paths
  ↓
Determine Impact
  ↓
Collect Evidence
  ↓
Report
  ↓
Recommend

The strongest network penetration testers do not simply know how to scan networks.

They understand:

protocols, services, identities, trust relationships, segmentation, attack paths, and business impact.

What’s Next?

➡️ 03 — Web Application Security

In the next module, you will move from infrastructure and network services into one of the largest modern attack surfaces:

Web Applications and APIs.

You will learn how to systematically analyse:

• Web application architecture

• HTTP and HTTPS

• Requests and responses

• Headers

• Cookies

• Sessions

• Authentication

• Authorization

• Input validation

• Injection vulnerabilities

• Cross-Site Scripting

• Access-control weaknesses

• File handling

• Server-side vulnerabilities

• APIs

• Business logic

• Web attack paths

• Evidence

• Professional web security findings

The mindset remains the same:

Understand
   ↓
Enumerate
   ↓
Form Hypothesis
   ↓
Test
   ↓
Validate
   ↓
Determine Impact
   ↓
Report

You are simply applying it to a different attack surface.

The goal of the next module is to move from:

“I can systematically assess network infrastructure.”

to:

“I can understand how a web application works, identify its trust boundaries, test its security controls, and develop realistic application attack paths.”