skills.rest
braydos-h
braydos-hCOMMUNITY
Explore all skills by this author →
GitHub

conducting-internal-network-penetration-test

Executes internal network penetration tests covering discovery, credential attacks, lateral movement, and reporting.

4|Updated Apr 28, 2026
Search Tags:#penetration testing#network security#nmap#lateral movement#active directory#impacket#responder
One-click install
npx skills add https://github.com/braydos-h/BreachPilot --skill conducting-internal-network-penetration-test-braydos-h
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: conducting-internal-network-penetration-test
Source: https://github.com/braydos-h/BreachPilot/tree/main/skills/conducting-internal-network-penetration-test
Command: npx skills add https://github.com/braydos-h/BreachPilot --skill conducting-internal-network-penetration-test-braydos-h

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill requires ldap3, impacket, python-nmap, and includes scripts (resource) and references (resource) and assets (resource) components.

What problem does it solve? Security teams need a structured, repeatable methodology for internal network penetration tests that simulates an assumed-breach attacker, covering everything from host discovery to domain compromise documentation without missing critical phases. ## Core Features & Use Cases - Phased Attack Methodology: Guides testers through network discovery, credential capture (Responder, mitm6), Kerberoasting, lateral movement (PsExec, WMI, WinRM), and domain escalation (DCSync, Golden Ticket, ADCS). - Automation Scripts: Includes Python agents that run nmap scans, check SMB signing, enumerate Active Directory via ldap3, and generate Markdown findings reports. - Reporting Assets: Ships a report template, MITRE ATT&CK technique mappings, and compliance references (PCI DSS, ISO 27001, NIST CSF) for professional deliverables. - Use Case: A consultant on an authorized engagement connects to a client VLAN, runs the automation against the subnet, collects BloodHound data, and produces a severity-ranked findings report with remediation guidance. ## Quick Start Ask the assistant to run an internal network penetration test against subnet 10.0.0.0/24 for domain corp.local using the provided automation scripts and produce a findings report.

Frequently Asked Questions about conducting-internal-network-penetration-test

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I run an internal network penetration test with this skill?▼

Run scripts/process.py with --subnet, --domain, and --dc-ip arguments to automate host discovery, port scanning, SMB signing checks, and BloodHound collection. The script outputs a Markdown report with findings and remediation recommendations.

What tools are needed for internal Active Directory pentesting?▼

The workflow uses nmap for discovery, Responder for LLMNR/NBT-NS poisoning, Impacket for lateral movement and secrets dumping, BloodHound for attack path mapping, NetExec for SMB enumeration, and Hashcat for hash cracking.

Does the automation script require domain credentials?▼

No, credentials are optional. Without them the script still performs host discovery, port scanning, and SMB signing checks. Providing --username and --password additionally enables share enumeration, BloodHound collection, and password policy retrieval.

Is this penetration testing skill legal to use?▼

It is legal only for authorized testing with a signed Rules of Engagement and written permission from the system owner. The skill includes explicit legal notices stating that unauthorized use against systems you do not own violates computer fraud laws.

Why does SMB signing matter in internal pentests?▼

Hosts without SMB signing required are vulnerable to NTLM relay attacks, where captured authentication is forwarded to gain access. The scripts flag unsigned hosts as HIGH severity and recommend enabling signing via GPO.

Related Skills

Explore More Software Engineering Skills→
xalgordxalgord
954

conducting-internal-network-penetration-test

Execute an internal network penetration test covering enumeration, credential attacks, lateral movement, and reporting.

Community
Advanced
Jayarr03Jayarr03

mitre-attack-review

Map system attack paths to MITRE ATT&CK techniques and objectives.

Community
Advanced
xalgordxalgord
954

deploying-active-directory-honeytokens

Deploys Active Directory honeytokens and SIEM detection rules for deception-based threat detection.

Community
Advanced
davila7davila7
30.5k

Pentest Checklist

Guides planning, execution, and remediation of penetration testing engagements through structured checklists.

Community
Intermediate