TLPT (Threat-Led Penetration Testing): Objective and Methodology
In a context where cyberattacks are becoming more sophisticated, targeted and persistent, traditional security approaches are reaching their limits. I...
What is Infrastructure and Network Penetration Testing?
An infrastructure and network pentest aims to assess the security level of your IT infrastructure by simulating attacks targeting internal and external networks. The goal is to identify exploitable vulnerabilities within exposed services, network architecture, configurations (firewalls, routers, switches), active services (DNS, VPN, administration services) and critical components such as Active Directory or Wi-Fi access.
At the end of the mission, a detailed report presents the identified flaws, the associated attack scenarios, and specific, prioritised recommendations for remediation. A counter-audit phase can then be carried out to validate the effectiveness of the fixes implemented and confirm the effective reduction of risks.
Our Technical Expertise in Infrastructure and Network Penetration Testing
Our auditors perform infrastructure and network penetration tests in a variety of complex environments. Whether it's a traditional on-premise infrastructure, a hybrid network, an information system spread across multiple sites, or cloud environments interconnected with internal infrastructures, our approach adapts to your architecture and operational constraints.
Tests Carried Out During an External Infrastructure Penetration Test
Analysis of the external attack surface
- Mapping of exposed IP addresses, domain names and subdomains
- Identification of services and ports accessible from the Internet
- Detection of unnecessary or excessively exposed services
- Analysis of technologies used and associated versions
Audit of exposed services and protocols
- Analysis of accessible network protocols
- Detection of obsolete, vulnerable or poorly secured services
- Assessment of risks related to unpatched versions and weak configurations
Identification of exploitable vulnerabilities
- Search for known vulnerabilities (CVEs) on exposed services
- Targeted exploitation tests to validate the real impact of vulnerabilities
- Detection of authentication weaknesses or access control mechanisms
- Identification of exploitable information leaks (banners, application errors, metadata)
Network Penetration Testing
Analysis of configurations and protocols
- Audit of network protocols
- Detection of obsolete, vulnerable or unsecured services
- Assessment of risks associated with unpatched versions
Assessment of segmentation
- Verification of separation between VLANs
- Control of internal flow filtering rules
- Identification of vulnerabilities facilitating lateral movement
- Analysis of access paths to critical resources and sensitive servers
Identification of common attack vectors
- Exploitation of vulnerable services (CVEs)
- Retrieval of credentials or secrets from misconfigured shares
- Identity theft via unencrypted protocols
- Data interception through man-in-the-middle attacks
Audit of security controls
- Verification of internal firewall configurations and security policies
- Search for misconfigurations in security policies
- Identification of opportunities for privilege escalation or uncontrolled access
Active Directory Penetration Testing
Analysis of configurations and privileges
- Verification of delegated rights and excessive privileges
- Identification of unjustified high-privilege accounts
- Detection of stored plaintext credentials
- Audit of ACLs (Access Control Lists)
Assessment of specific protocols and attacks
- Simulation of targeted attacks: Kerberoasting, AS-REP Roasting, NTLM Relay, poisoning
- Verification of risks related to ticket forging (Golden Ticket, Silver Ticket)
- Assessment of persistence level and potential access to the entire domain
Audit of password policies and privilege segmentation
- Analysis of the robustness of password policies and their effective enforcement
- Detection of weak, reused or shared passwords
- Simulation of Password Spraying, Pass-the-Hash and Pass-the-Ticket attacks
Audit of Active Directory Certificate Services (AD CS)
- Assessment of AD CS service configuration
- Verification of certificate issuance and approval rights
- Detection of risks of fraudulent or misappropriated certificate issuance
- Identification of opportunities for user or machine identity theft via certificates
Tests Carried Out During a WI-FI Penetration Test
Authentication capture and exploitation tests
- Simulation of deauthentication attacks to force clients to reconnect
- Capture of authentication exchanges (handshakes) between access points and terminals
- Offline key cracking attempts (brute force or dictionary)
- Simulation of evil twin attacks to divert traffic or intercept credentials
Evaluation of network segmentation and VLAN isolation
- Verification of isolation between guest and internal networks
- Control of the separation of VLANs associated with different SSIDs
- Identification of unauthorised access paths to internal resources
Analysis of connected devices
- Identification of automatically connected devices
- Assessment of their resistance to compromise or rebound attempts
- Verification of the risk of use as an attack relay
Network Penetration Testing Methodology
Network reconnaissance and discovery
Our auditors begin the assignment with a detailed mapping of the internal environment. They identify active IP address ranges, locate accessible hosts, and perform port and service scans to establish an initial inventory. At this stage, they also fingerprint systems and services to determine versions and technical characteristics, while performing passive discovery to complete the visibility picture.
Service enumeration
Our auditors conduct a thorough enumeration of the identified services. They examine SMB shares and sessions, query directories (LDAP/Kerberos) in Active Directory environments, and analyse remote access and administration services.
Vulnerability research
Our auditors then cross-reference the collected data with vulnerability databases and perform technical validation of potential flaws. They target both historical and critical CVEs as well as common configuration issues: weak or default passwords, unsecured shares, insufficient system hardening, etc.
Exploitation
Our auditors attempt to exploit identified vulnerabilities to measure the real impact of a compromise. They seek to gain additional access via remote code execution or Active Directory-specific techniques, perform lateral movement, escalate privileges on compromised machines and, if necessary, extract elements such as LSASS/SAM hashes to assess the risk associated with credential reuse. Finally, they test pivoting to other segments of the network to assess the scope of an intrusion and the robustness of compartmentalisation.
Reporting
Once the tests are complete, our auditors compile a detailed report listing all the vulnerabilities identified. Each vulnerability is documented along with its severity level, exploitation scenario and associated technical evidence (screenshots, commands, logs). The report also includes prioritised remediation recommendations to help technical teams effectively address the vulnerabilities. A debriefing meeting is organised to present the results, explain the attack scenarios observed and support your teams in implementing corrective measures.
Types of Network Penetration Tests
A network penetration test can be carried out using two complementary approaches, each offering a specific perspective on the security of your corporate network.
Black box network penetration testing
Our auditors simulate an internal attacker with no prior knowledge of the network, systems or user accounts.
They explore the environment from minimal access in order to identify exploitable vulnerabilities, configuration errors or possible attack vectors.
Grey box network penetration testing
Our auditors have partial information or limited access to the internal network (user accounts, architecture diagrams, network segments, etc.).
By combining an offensive approach with targeted knowledge of the environment, they identify deeper vulnerabilities related to access rights, internal configurations, or privilege management.
CUSTOMER TESTIMONIALS
About Vaadata
Conduct an Infrastructure and Network Penetration Test with Vaadata, a Certified Offensive Security Expert
Choosing Vaadata to carry out an infrastructure and network penetration test means placing your trust in a leading French company certified to the most demanding international standards. Vaadata is PASSI, CREST, ISO 27001 and ISO 27701 accredited, guaranteeing the quality, methodology and compliance of its penetration tests with cybersecurity and data protection standards. These certifications demonstrate our commitment to maintaining high standards and adhering to industry best practices.
Our auditors hold numerous certifications, attesting to their expertise in identifying and exploiting complex vulnerabilities in heterogeneous network or Active Directory contexts.
Depending on your objectives, we adapt the scope of the internal pentest to target the most sensitive segments or perform a comprehensive assessment of the infrastructure. We guarantee personalised support to strengthen the security of your internal network and the overall resilience of your organisation in the long term.
Resources
Our Latest Resources
Ransack Query Injection: Analysis and Exploitation of an ORM Vulnerability
Developers often rely on libraries to manage communications with databases. This saves them from having to write raw queries. These libraries generall...
What is Pass-the-Hash? Attacks Types and Security Best Practices
During our internal penetration tests, we regularly compromise Active Directory without using any passwords. This is possible thanks to an iconic atta...
