skills.rest
Yenn503
Yenn503COMMUNITY
Explore all skills by this author →
WebsiteGitHub

conducting-internal-network-penetration-test

Executes internal network penetration tests covering enumeration, credential attacks, lateral movement, and reporting.

1|1|Updated Apr 3, 2026
Search Tags:#penetration testing#privilege escalation#lateral movement#active directory#impacket#responder#assumed breach
One-click install
npx skills add https://github.com/Yenn503/Net-Runners --skill conducting-internal-network-penetration-test-yenn503
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: conducting-internal-network-penetration-test
Source: https://github.com/Yenn503/Net-Runners/tree/main/.netrunner/skills/infra/conducting-internal-network-penetration-test
Command: npx skills add https://github.com/Yenn503/Net-Runners --skill conducting-internal-network-penetration-test-yenn503

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve? Security teams need a structured, repeatable methodology to assess what an attacker could do after gaining a foothold inside the corporate network, and ad-hoc testing often misses lateral movement paths, privilege escalation vectors, and exposed sensitive data. ## Core Features & Use Cases - Five-Phase Methodology: Guides testers through network discovery, credential attacks, exploitation and lateral movement, data access demonstration, and reporting. - Active Directory Attack Coverage: Includes BloodHound collection, Kerberoasting, AS-REP roasting, DCSync, Golden/Silver Ticket attacks, and ADCS exploitation with Certipy. - Credential Capture and Cracking: Uses Responder for LLMNR/NBT-NS poisoning, mitm6 for IPv6 takeover, ntlmrelayx for relay attacks, and Hashcat for offline cracking. - Use Case: A pentester on an assumed-breach engagement uses the workflow to poison LLMNR with Responder, crack the captured NTLMv2 hash, move laterally with PsExec, extract DA credentials, and document a full domain compromise attack path with MITRE ATT&CK mappings. ## Quick Start Ask the agent to walk you through an authorized internal network penetration test starting from an assumed-breach position on the corporate VLAN, beginning with network discovery and enumeration.

Frequently Asked Questions about conducting-internal-network-penetration-test

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I conduct an internal network penetration test?▼

Follow the five-phase methodology: network discovery with Nmap and arp-scan, credential capture with Responder and mitm6, lateral movement with Impacket and Evil-WinRM, privilege escalation with PowerUp or LinPEAS, and reporting with MITRE ATT&CK-mapped attack paths. Start from an assumed-breach position with signed rules of engagement.

What tools are needed for Active Directory penetration testing?▼

Core tools include BloodHound for attack path analysis, Impacket for secretsdump and psexec, NetExec for SMB enumeration and password spraying, Certipy for ADCS exploitation, and Hashcat for cracking Kerberoast and AS-REP hashes. Responder handles LLMNR/NBT-NS poisoning for credential capture.

How does Kerberoasting work against service accounts?▼

Kerberoasting requests service tickets for accounts with SPNs using impacket-GetUserSPNs, then cracks the extracted hashes offline with Hashcat mode 13100. The skill recommends remediation via gMSA accounts and passwords of 25 or more characters.

Is authorization required before running these penetration testing commands?▼

Yes, signed Rules of Engagement covering the internal network scope are a mandatory prerequisite, along with coordination with IT/SOC for monitoring. Unauthorized use against systems you do not own or lack written permission to test is illegal under computer fraud laws.

What are the limitations of LLMNR poisoning for credential capture?▼

LLMNR/NBT-NS poisoning with Responder only works when these legacy name resolution protocols are enabled on target hosts. Networks that have disabled them via GPO are immune, which is why the findings matrix lists disabling LLMNR/NBT-NS as the primary remediation.

Related Skills

Explore More Software Engineering Skills→
braydos-hbraydos-h
4

conducting-internal-network-penetration-test

Executes internal network penetration tests covering discovery, credential attacks, lateral movement, and reporting.

Community
Advanced
Amazon-QuickAmazon-Quick
47

vulnerability-report-summarizer

Parse vulnerability scan data, deduplicate findings, and score risk with CVSS.

Official
Advanced
riparinoriparino
1

defensive-sqli

Correlate web, WAF, and database logs to detect SQL injection attempts.

Community
Intermediate
Ed1s0nZEd1s0nZ
5.6k

network-penetration-testing

Execute network penetration testing phases with Nmap, Nessus, and Metasploit.

Community
Advanced