Network Penetration Testing Service
Digital Roxy runs external and internal network penetration tests against corporate infrastructure, cloud VPCs, and hybrid environments. From perimeter services to Domain Admin, every engagement maps the real path an attacker takes. OSCP-certified testers, manual exploitation, CVSS-scored findings, and compliance attestation.
Network pentest is adversary simulation against your infrastructure.
A network penetration test measures how far a motivated attacker can move through your network once they find a foothold. External network testing validates perimeter defenses against the internet-facing attack surface. Internal network testing simulates an insider, a phished employee, or a compromised contractor: someone already on the network, now trying to escalate. The measurement that matters is time-to-Domain-Admin. Every finding in the report is a step on that path.
Digital Roxy network pentests cover perimeter enumeration, firewall rule validation, segmentation testing, Active Directory exploitation, Kerberos attacks (Kerberoasting, ASREPRoasting, unconstrained delegation), and lateral movement with tools like CrackMapExec, BloodHound, and Impacket. Cloud VPC boundaries and hybrid-cloud trust relationships are in scope where relevant. Every engagement finishes with a documented attack path from starting point to crown jewels, plus the exact controls that would have stopped the chain.
Attack Paths We Exploit on Network Engagements
Network pentest findings are rarely single vulnerabilities. They are chains. These are the chain components we exploit on most engagements.
Active Directory Misconfigurations
Kerberoasting of service accounts with weak passwords. ASREPRoasting of accounts with pre-authentication disabled. Unconstrained delegation trust that leads to TGT compromise. Default ACLs on privileged groups. AD misconfig is still the #1 cause of Domain Admin compromise in enterprise environments.
Exposed Management Interfaces
RDP, SSH, SMB, WinRM, and VNC exposed to the internet or to broad internal subnets. Default credentials, weak passwords, and missing MFA on these interfaces are a direct path to shell. Shodan-style reconnaissance finds them in minutes.
SMB & Legacy Protocol Abuse
SMB signing not required allows relay attacks. LLMNR and NBT-NS poisoning on internal networks captures NTLM hashes. NTLMv1 still enabled on legacy systems. Protocols written before 2005 are still the most productive internal pentest targets.
Firewall Rule Gaps
Segmentation rules that look right in the firewall UI but fail in practice. Any-any rules from jump hosts to production subnets. Management VPNs that route broader than documented. We validate every segmentation claim by actually attempting the blocked traffic, not by reading the ruleset.
Credential Reuse & Password Spraying
One leaked credential in a breach corpus, sprayed across every service the organization exposes, lands on an account somewhere. Every external network pentest tests this. Most engagements find at least one account. Some find dozens.
Cloud-On-Prem Trust Boundary Abuse
Azure AD Connect sync accounts with excessive on-prem privileges. Federation trust misconfigurations. AWS IAM roles assumable from on-prem servers with overly broad permissions. The cloud boundary is the new perimeter, and most teams have not tested it.
IPv6 & mDNS Internal Enumeration
IPv6 enabled by default on modern Windows with no monitoring. mDNS, LLMNR, and WSD broadcasting on internal networks. These channels leak hostnames, user names, and hashed credentials that never show in IPv4 logs.
Patch Backlog & Unpatched CVEs
ProxyShell, ProxyLogon, PrintNightmare, and the rolling list of CVEs that stay exploitable for years on unpatched infrastructure. We validate exploitation, not just version numbers.
Our Network Pentest Methodology
Methodology aligned with OSSTMM 3 and NIST SP 800-115. External and internal phases are distinct engagements with distinct toolsets and distinct reporting structure.
External Attack Surface Mapping
Passive OSINT, DNS enumeration, subdomain discovery, certificate transparency logs, and identification of every internet-facing service tied to the organization. Shodan, Censys, and Digital Roxy's proprietary dataset give us the external surface you did not know you had.
External Service Probing
Port scanning with rate limits to avoid provider notification thresholds. Service fingerprinting against every exposed endpoint. Vulnerability correlation against known CVEs for the exact versions detected. Manual validation of every candidate finding before it enters the report.
Foothold Establishment
For external engagements that advance to active exploitation (when the scope allows it), we establish a foothold through a confirmed vulnerability. For internal engagements, the foothold is assumed: a provisioned user account or a corporate laptop image representing a phished employee.
Internal Network Enumeration
Once on the internal network, we enumerate Active Directory with BloodHound, map open shares, identify administrative tooling, and build the full internal attack graph. This is the phase where most "interesting" findings emerge.
Lateral Movement
Credential harvesting (LSASS, SAM, ntds.dit), pass-the-hash, pass-the-ticket, and targeted spraying to escalate from initial foothold into adjacent systems. Every lateral movement step is documented with the exact tooling and detection opportunity.
Privilege Escalation
Local privilege escalation on compromised hosts (SeImpersonate abuse, unquoted service paths, DLL hijacking). Domain privilege escalation through AD CS, DCSync rights, and delegation misconfigurations. Goal: Domain Admin or the pre-agreed crown jewel.
Attack Path Report & Retest
Narrative report showing the exact attack path from initial foothold to objective. CVSS-scored findings. Detection opportunities for each step (what your SOC would have seen if configured correctly). Free retest after remediation.
Our Network Pentest Toolset
Tooling lineage traces to the offensive security community. Every tool listed is used by real red teams and real attackers. Our skill is in combining them into attack chains, not in using them individually.
Nmap + Masscan
Port discovery and service fingerprinting. Masscan for breadth, Nmap for depth and script-based version validation.
BloodHound + SharpHound
Active Directory attack path mapping. Every engagement includes a BloodHound graph of your AD environment as a report deliverable.
Impacket
Kerberos attacks, SMB relay, DCSync, and the full catalog of AD-native protocol abuse. Python-based so it runs from attacker Linux boxes without Windows tooling.
CrackMapExec / NetExec
Swiss-army tool for post-foothold network traversal. Credential spraying, share enumeration, command execution, and data extraction across Windows and Linux.
Responder + mitm6
LLMNR/NBT-NS/mDNS poisoning for hash capture. mitm6 for IPv6-based DNS takeover that most environments miss entirely.
Metasploit + Cobalt Strike
Post-exploitation frameworks for beaconed operations. Cobalt Strike for engagements requiring detection evasion testing.
Network Pentest Engagement Tiers
Three engagement sizes. Every quote is fixed-price after a 15-minute scoping call. No hourly billing.
External
External-only pentest against internet-facing assets. Right for annual compliance with no internal scope.
- Up to 32 external IPs
- Subdomain enumeration
- Service fingerprinting
- CVE validation
- 1-week engagement
- One free retest
- PCI/SOC 2 attestation
External + Internal
Full network pentest simulating external attacker plus insider threat. Right for mature security programs.
- Everything in External
- Internal AD pentest
- BloodHound attack path mapping
- Lateral movement testing
- Kerberos attack testing (Kerberoasting, ASREPRoasting)
- Segmentation validation
- 2-3 week engagement
- Attack path narrative report
- Two free retests
Assumed Breach
Red-team-style assumed breach scenario. Tester starts with a low-privilege foothold and simulates a targeted intrusion.
- Everything in External + Internal
- Assumed breach foothold simulation
- Detection evasion testing
- Credential harvesting simulation
- Data exfiltration path testing
- Purple team debrief with SOC
- MITRE ATT&CK mapping
Network Pentest Questions, Answered Directly
Explore Related Penetration Tests
Ready to scope your Network Pentest?
Book a 15-minute scoping call. You get a fixed-price quote within one business day.