Network penetration testing
Find out how far an attacker gets, from the internet and from inside.
Two tests, run separately or together: what someone on the internet can reach, and how far one stolen employee login or one infected laptop gets inside your network, up to full control of your Windows domain.
Discuss my scopeWhat’s tested
Two tests · order one or both
| From outsideExternal Penetration Test | From insideInternal Penetration Test | |
|---|---|---|
| Starting point | On the internet | One employee login, over VPN |
| You provide | Your domains and IP ranges | VPN or jump host, plus one domain account |
| We test |
|
|
| The goal | Find a way inside | Reach Domain Admin and your sensitive data |
| Based on | PTES · NIST SP 800-115 | |
| You get · both |
|
|
External test
StartOn the internet, with only your domains and IPs
- Exposed systems
attack surface discovery · port scanning
- Remote access
edge-device CVEs
- Logins and passwords
password spraying · missing MFA
GoalFind a way inside
Internal test
StartInside, with one employee login over VPN
- Passwords on the network
LLMNR/NBT-NS poisoning · SMB relay
- Path to Domain Admin
Kerberoasting · AD CS · delegation
- Moving between machines
lateral movement · local admin reuse
- Sensitive systems
segmentation · open shares
GoalReach Domain Admin and your sensitive data
Based on · either test
PTES · NIST SP 800-115
What you get · either test
- Critical findingsreported straight away
- Reportsummary for management, attack paths step by step for IT
- Readout and retesta call, then one retest after your fixes
What a finding looks like
Findings are shown as attack paths, step by step from the starting point to what was reached, so it is clear which fix breaks each path.
Any employee account can become Domain Admin in three steps
corp.example.com · Active Directory
- Impact
- Whoever phishes a single employee gets control of every Windows machine, mailbox and file share in the domain.
- Proof
- From an ordinary account, requested a service ticket for the svc_sql service account, cracked its password offline, and logged in with it: svc_sql is a member of Domain Admins.
- Fix
- Move svc_sql to a group managed service account with a long random password, and take it out of Domain Admins.
FAQ
-
What comes with every engagement?
Every engagement is led by a senior tester and done by hand. During testing, a shared chat channel and a weekly call keep you up to date, and anything critical is reported straight away. After the report you get a readout call and one retest.
-
External, internal or both?
External shows what someone on the internet can reach. Internal shows what happens after one login is stolen or one laptop is infected. If you can only do one, the scoping call helps you pick the one that fits your setup.
-
Will testing disrupt our network?
It shouldn’t. There is no denial-of-service or load testing, password guessing stays below your lockout limits, and if anything behaves unexpectedly, testing pauses and you are told straight away.
-
Do you need to be on site?
No. Testing is done remotely, over a VPN or a jump host you provide.
-
How is this different from a vulnerability scan?
A scan lists outdated software and open ports one by one. It can’t show that a weak password on one service account and one misconfiguration add up to control of the whole domain. That chain is what this test looks for.
-
Will the report help with PCI DSS, SOC 2 or ISO 27001?
Yes. PCI DSS requires internal and external penetration testing, including checks that network segmentation holds, and SOC 2 and ISO 27001 auditors usually expect it. The report states the scope, the method, every finding and the retest results.
-
What isn’t part of this test?
Phishing and social engineering, physical access to your offices, denial-of-service testing and full red-team exercises. Cloud accounts are a separate assessment.
-
Do you sign an NDA?
Yes, before any details are shared.
-
What language is the report in?
The report is in English.
Get in touch
Tell us what you would like tested: roughly how many internet-facing hosts, and how many users and servers on the internal network.
What happens next
-
We reply within 24 hours
By email, with a link to book a call with the team.
-
Intro call
We learn what you need and answer your questions.
-
Proposal
Scope, timing and price, in writing. Nothing starts before an NDA is signed.
Prefer email? Write to hello@alteasecurity.com