Internal ethical hacking: assessment from inside the network

80% of serious attacks involve lateral movement within the network. We simulate an attacker who has already gained initial access to assess how far they can get inside your internal infrastructure.

What happens once an attacker is inside your network?

Most companies invest in protecting the perimeter, but once inside, an attacker can move freely through the internal network, escalate privileges, reach critical systems and exfiltrate data for weeks or months without being detected. Insider threats and successful phishing are the most common entry vectors. The question is: how far can they get once they're in?

Scope

  • Active Directory assessment: enumeration, ACL abuse, Kerberoasting, AS-REP Roasting
  • Lateral movement: pass-the-hash, pass-the-ticket, NTLM relay
  • Local and domain privilege escalation
  • Network segmentation: VLANs, internal firewalls, micro-segmentation
  • Credential assessment: weak passwords, reuse, service accounts
  • Insecure protocols: SMBv1, NTLMv1, cleartext protocols
  • Access to critical data: shares, databases, backups
  • Persistence detection: scheduled tasks, registry, services
  • PTES + MITRE ATT&CK Enterprise methodology

Methodology

  1. Internal enumeration: Complete mapping of the internal network: hosts, services, users, groups and shared resources.
  2. Active Directory analysis: Thorough AD assessment with BloodHound to identify escalation paths to Domain Admin.
  3. Lateral movement: Simulated lateral movement between systems using real attacker techniques.
  4. Privilege escalation: Escalation from a standard user to domain administrator via the identified paths.
  5. Impact report: Documentation of the full attack chain with real impact, classified by MITRE ATT&CK.

Deliverables

  • Internal network and Active Directory map
  • Attack path graph (BloodHound)
  • Technical report with full attack chains and PoC
  • Findings classified by MITRE ATT&CK
  • Active Directory and internal network hardening plan
  • Re-test included

Use cases

  • Companies with Active Directory that want to assess their resilience to internal attacks
  • Organizations that have suffered ransomware and want to understand how it spread
  • Companies with remote employees and VPN access that want to assess internal access risk
  • Organizations subject to NIS2 or ISO 27001 with internal assessment requirements
  • IT teams that want to validate their network segmentation

Frequently asked questions

What starting point is used for internal ethical hacking?

We typically simulate a standard domain user (the most realistic scenario: a compromised employee or an attacker with initial access via phishing). We can also start from physical network access (a network cable) or from an unprivileged account on the machine.

Can the test affect production systems?

We coordinate all testing with the IT team. The most invasive techniques (such as modifying AD) are only performed with explicit authorization and within agreed windows. The goal is to simulate an attack, not to cause damage.

What is BloodHound and why does it matter?

BloodHound is the industry-standard tool for analyzing Active Directory relationships and finding privilege escalation paths. Attackers use it; so do we, so you can see exactly what they would see in your AD.