Internal infrastructure penetration testing

• Two networks are joining after an acquisition.
• Your team has changed network segmentation, remote access or directory permissions.
• You need to know what would be exposed if a contractor account or workstation were compromised.

Choose a starting point such as a staff network, contractor connection or low-privilege test account. Name the servers, shared services and network segments in scope, and identify a target that matters to the business.

Use an internal network test to see which hosts and services a contractor can reach. If the question is who can administer a directory through nested groups, delegated permissions or trusts, choose Active Directory testing.

• Which shared files, internal services and administration interfaces the starting account can reach.
• Whether network rules keep users and devices away from restricted systems, and what happens where a permitted route crosses that boundary.
• Whether weak service configuration, missing patches or permissions on shared resources could let an ordinary account reach a more valuable system. A dedicated directory assessment goes deeper into identity administration and trust relationships.

• Network ranges, approximate host counts, relevant sites and a diagram showing separation between teams or systems.
• A route into each agreed network and test accounts with the starting permissions you want examined.
• The owners of sensitive services, any exclusions and a contact for the testing window.

Agreed boundaries

Agree how far the testers may follow an access route, which systems are sensitive and who can pause the test. For a critical system, read-only evidence can establish the issue without changing live accounts or running code on the target.

An executive summary and technical findings showing the starting access, the systems reached, the permissions involved and the business impact. Your network and identity owners can see which fixes break each route.

Follow-up

After remediation, repeat the relevant access check from the agreed starting position. Vambrace offers free retests of vulnerabilities found for 12 months.