Penetration Testing Hub › Penetration Testing Explained
Network Penetration Testing: A Practical Walkthrough
Only test networks you own or have explicit written permission to test. Unauthorised access to a computer system is a criminal offence in Ireland under the Criminal Justice (Offences Relating to Information Systems) Act 2017. Everything below assumes you are working on your own environment or one you are formally authorised to assess.
'Network penetration testing' really means two jobs. External testing asks what someone on the internet can reach and do. Internal testing asks what someone who's already inside — a phished user, a compromised laptop, a contractor's device — can do next. The second is where most real breaches actually escalate, and it's the one most organisations underestimate.
This page walks through how both are done, what you can check yourself, what to expect if you hire out, and where to stop.
1. How it's done
External: the view from outside
The tester starts with what the internet already knows about you: DNS records, subdomains, certificate transparency logs, exposed services, VPN and mail endpoints, and any credentials leaked in past breaches. Then they scan your public IP ranges for open ports and services, fingerprint versions, and probe for known vulnerabilities and misconfigurations. The recurring external findings: a forgotten test server, an exposed admin panel, an unpatched VPN appliance, or a service that should never have been public.
Internal: assume the attacker is already in
Internal testing usually starts from a foothold — a network port, a standard user account, or a device on the LAN — because that's the realistic starting point after a phish. From there the tester maps the network, hunts for default and reused credentials, looks for unpatched internal services, and tests whether segmentation actually holds. The prize is lateral movement and privilege escalation: getting from one ordinary machine to domain admin, the file shares that matter, or the backups. Active Directory is usually the battleground — we cover that in its own guide.
Chaining
The value isn't any single finding — it's the chain. 'Guest VLAN reaches a print server, which has cached domain credentials, which open the finance share.' Our Attack Canvas tool exists to map exactly these paths visually. A vulnerability scan lists the links; a pentest shows you the chain.
2. What to look for — the self-check
- You have an up-to-date inventory of what's actually on the network — including the things nobody owns any more.
- No default or shared credentials on switches, routers, printers, cameras, iLO/iDRAC or hypervisors.
- Network segmentation is real: guest, OT, and user VLANs can't freely reach servers or management.
- A recent vulnerability scan has been run internally and the criticals are fixed.
- SMB signing is enforced and legacy protocols (SMBv1, LLMNR/NBT-NS) are disabled.
- Domain admin membership is minimal and no service accounts have needless privilege.
- Management interfaces (RDP, SSH, web consoles) aren't reachable from ordinary user subnets.
- Backups are offline or immutable — and you've actually restored from them.
3. What to expect if you hire out
Scoping: you'll agree IP ranges, whether it's external, internal or both, black/grey/white box, and what's strictly out of scope. Internal testing needs either an on-site presence or a small device (or VM) placed on your network.
Access: for internal work, a network drop and often a standard user account; for white-box, documentation and credentials. A contact who can answer questions and pull the plug if needed.
Duration: commonly one to three weeks end to end, with a few days of active testing. External-only tests are usually shorter than internal.
Production risk: most enumeration is safe, but exploitation and any testing of fragile or legacy systems carries risk — which is why those are called out in the rules of engagement and often run in a window.
The report: severity-rated findings, the attack chains that matter most, reproduction steps and prioritised remediation, plus a re-test.
4. When you need a pro
You can safely map your own network, check for default credentials, and run internal scans. Stop before active exploitation of production systems, before anything that could crash a fragile server, and before you start dumping credentials or moving laterally in anger — that's where a mistake takes down a service or corrupts data, and where a professional brings a rollback plan and the experience to do it safely.
Download: Internal Network Security Checklist
A printable one-page version of the self-check above. No email required. Open the Internal Network Security Checklist
Common questions
What's the difference between internal and external penetration testing?
External testing assesses what an attacker on the internet can reach and exploit — your public-facing services. Internal testing assumes the attacker is already inside (via phishing or a compromised device) and measures how far they can get. Most organisations need both, but internal testing usually reveals the more serious escalation paths.
How do I pentest my own network safely?
Work only on your own estate, tell your team first, and start passive: map what's there, check for default credentials and unpatched services, and test whether segmentation holds. Stop before actively exploiting anything production-critical — that's where you need professional care and a rollback plan.
Do I need internal network testing if I have a firewall?
Yes. A firewall controls the perimeter, but most breaches start with a phished user or a compromised laptop already inside it. Internal testing measures what happens after that first foothold — and a flat internal network behind a good firewall is still a flat internal network.
If you'd rather we ran the network test, here's how a CyberLabs engagement works: agreed scope and rules of engagement, internal and/or external testing, the attack chains mapped out, and a report your engineers can act on — with a re-test.
No prices on this page and no hard sell.
This page is educational and not legal advice. Only test systems you own or are explicitly authorised to test. · ↑ Back to top