Internal Network Penetration Testing Methodology

## Internal Network Penetration Testing Methodology

Review Cobalt pentest methodologies for internal networks.


:::info
Internal network penetration testing is a process in which a tester uses simulated attacks to identify potential security vulnerabilities in an internal network.

:::

Cobalt follows an industry-standard methodology primarily based on the [Open Source Security Testing Methodology Manual (OSSTMM)](https://www.isecom.org/OSSTMM.3.pdf).


 ![](https://brainfish-storage-prod.s3-accelerate.amazonaws.com/uploads/e425698c-e7a2-4adf-805e-55be5078fafc/a0625bac-28bf-4492-bfff-682a4f5a77f9/image.png?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Credential=ASIAUPPN5IL3VL534FL6%2F20260423%2Fus-east-2%2Fs3%2Faws4_request&X-Amz-Date=20260423T005720Z&X-Amz-Expires=3000&X-Amz-Security-Token=IQoJb3JpZ2luX2VjEJD%2F%2F%2F%2F%2F%2F%2F%2F%2F%2FwEaCXVzLWVhc3QtMiJHMEUCIQDWUbS1WzaSgauzp8yXkGjKt8BNRZij2jAeVPkyjz%2FDQgIgUeNIUoH9PKz6McEinTBAsNeUQ6RFnrZX5Zg1pm5CkrIq3AUIWRACGgwzMDgxMjU5NzUyODciDJvJ9CMn4NOnnj%2BbGCq5BYK8vm6Zl4ID7xg6L61166LBrHpHgTF7SDTaWiyDEgymw7Tuhk8RudNYOg%2FKMUBCHf0nJJxwc3%2ByqIWHVSLJI68rzoJ5euXbRwQwz%2FvUnP2RbyDPIvJCVkL1DFB81zILAlUHkndT0tmcYCwrJCYrZ1R3s5B0pW%2BJjFqRqOnhnx2oHDtXBscr5isbfm6xN9r4aCmOO3FD%2BmuTQqgfGdoO6xVvWVuQxF1wbXYIVxgGmW1%2BS06j67p%2F%2BRFptu7yy24Q7vRJo2wgITWP8TaXS7viZ6mvzko9go5c9V5o9xUMtDnc0zk4M%2FoTJIehVDSb54JNTzXP9a8KzuKILhdMoWca4tZ4VxpepL3DuwNQTLE%2Bgz7HHmvC2EbWfq6B5yDBx8UFrfkkijJMMjndkrvbYJ8eIIfc9IkhOI5CQ1OSL%2FMWAeCTiqHT%2BfRkdjNQ%2B2zdxkMr%2BnAOBRNZPlFRg76gkIbh%2B4%2BptCEI%2FZuq8U3NHvzT7oTfrf72FP2nK37vO4VhCnGyGbJh1Eptqhl9DkDaOcoFV%2FRc5V8bMKsnD4%2FjNH5EetqHiDWsLiE9pOCLbIVP6ggiWXtixq7ZEVW797qp0SDtNZADDU2o%2Fm5ovE3Ue5Pgac0Crc3xyTAoboITs3VCjik3XTcllCm675IX3C%2FCclUI%2Bhbl3mO5o5InZFUfDEv2p%2FB6wUT6p6bbZUX%2Bbsb2ya%2BBLcvpHD75vrmb2oSNn0xhz1XeQHZTxGUK9EeXMpcRAwDGb6uUR5Kqm3%2Bz%2Fw2pKs%2BHAON%2FaduDs2uCnxS%2FfBgKVH6EqjgseNFWv4e9zdVQdzxmw9uFrQcmGAQOqa%2BTT3NlPDhHXYxawcgJZMbjVqfoVbPRiHfooFo1dhbIg4VSIBkePOPZMs86jMhW7pj0KZ6nBMzC6q2LRL9ocUgl3gwQvei7A51GqjauHQIw68ulzwY6kAHALUs%2B%2FpOuxETb693kQaE79SDxV3YKaLRvLkmaOZPS8iMxVOvGlyaQdxo8PZ2Gv5H2QAuohkuX8PPe12%2FG2f5Y39SuN8hl58pwSHyMKgbFTj%2BrQv7DbEqqRu8XQpV3MpBYCOm6jmWXv46RlUuqD9Xu4QDZ0606C4wexrTfhSz05PYH6dRouasu5Uw9qHANOMw%3D&X-Amz-Signature=db4743676243de2ec000d41289db4fa9ba37169e8800fa39a4e6c0c936fb0312&X-Amz-SignedHeaders=host&response-content-disposition=attachment)


Penetration testing of an internal network includes the following stages:

* Service discovery
* Vulnerability scans
* Manual assessment
* Reporting, triaging, and retesting


:::info
#### Note

The tools that our pentesters use during each phase may vary from test to test.

:::

## Prerequisites

Because Cobalt pentesters execute pentests for internal networks remotely, they need:

* Access to the internal corporate network through a stable VPN connection.

OR

* A lightweight Linux server inside the network that serves as a [jump box](https://cobalt-io.brainfish.ai/en-us/articles/glossary-YfTMKeZ1VM#h-jump-box) from which pentesters can scan and test the internal network during the assessment.

Depending on your network setup, do the following:

* For networks running on Amazon Web Services (AWS) machines:
  * [Create a Kali Virtual Machine (VM)](https://aws.amazon.com/marketplace/pp/prodview-fznsw3f7mq7to) inside AWS.
  * Set up key-based SSH access for each pentester.
* For networks that do not use a cloud network setup:
  * Request a custom OVA Image from your TPM.

    OR
  * [Download a Kali VMWare/VirtualBox image](https://www.kali.org/get-kali/).
  * Set up key-based SSH access for each pentester.

For an internal network pentest, Cobalt recommends deploying the jump box as realistically as possible by placing it on the same network and VLAN that a pentester could use during an on-site assessment.

In case of multiple potential locations, prioritize a user network with active traffic, such as a corporate IT network, over less active segments (e.g., a conference room network). A busier network will create a more realistic and comprehensive testing environment.


:::info
#### Note

Recommended system resources for the virtual image (VMWare, VirtualBox, or AWS) should be at least:

* 2 allocated virtual CPUs
* 8 GB RAM
* 50 GB of disk space

Pentesters also need Root access to the Kali VM, which is mandatory.

:::

## Service Discovery

### Port Scans

Pentesters perform a complete port scan on the provided internal network ranges. This provides a detailed breakdown of the machines and services running inside the corporate network and what functions they perform.

Based on the results of the initial port scan, Cobalt’s pentesters identified the following:

* Host discovery
* Port identification
* Version numbers for services running
* Operating Systems (OS) in use

For example, the following services require access to the network to function:

* File servers
* Mail servers
* Web servers
* Network attached devices (Printers and phones)
* FTP servers
* Active Directory (AD) servers and clients

All of these services leave characteristic signatures that a port scan can detect.


:::info
#### Tools

During this testing phase, pentesters use multiple tools, such as:

* Nmap
* Masscan

:::

## Vulnerability Scans

Cobalt’s pentesters perform vulnerability scans to provide a comprehensive test. This phase of the test is to look for cracks in the internal network that the pentester can later attempt to exploit. The following vulnerabilities are often found when performing vulnerability scans:

* Identifying misconfigurations, such as default passwords and weak permissions
* Detecting outdated software and OS
* Identifying the use of insecure network services
* Weak encryption methods

Note: Exploitation of these vulnerabilities does not occur in this phase of the test.


:::info
#### Tools

During this testing phase, pentesters use multiple tools, such as:

* Nessus
* QualysGuard
* Metasploit
* Nikto
* InsightVM

:::

## Manual Assessment

During manual assessment, Cobalt’s pentesters examine specific resources that they identified. In most cases, pentesters focus on visibly open services:

* Web/FTP/Email/DNS servers
* Active Directory (AD) servers and all associated clients
* Domain Controllers (DC)
* Network attached devices
* SMB servers and file servers
* Other services that are in place on the internal IP address range


:::info
Note: As certain vulnerabilities and exploits could paralyze, damage, or alter the content of the network, Cobalt’s pentesters do not perform these attacks. They do make note of the possible risks. For example, Cobalt’s pentesters will not run exploits that:

:::

* Disable certain services.
* Deny service from outside systems.
* May affect customers, such as Denial of Service (DoS) attacks.
* Disable the ability of an organization to function.

### Active Directory Environments (Windows Only)

AD is an identity and access management solution. Organizations use this service on Windows domain networks and other OS.

Depending on the configuration and patch level, a pentester might find a path to take over the corporate network by compromising the Domain Controller (DC).

Some key areas that Cobalt’s pentesters might focus on during Active Directory testing are:

* Weak password policies
* Old or weak protocols
* Kerberos vulnerabilities
* Use of cached or cleartext credentials
* Misconfigured trust relationships
* ACDS misconfigured permissions

During the AD phase of the engagement, Cobalt’s pentesters will coordinate with your team to perform password spraying attacks. Please note that you can opt out of this.

### SMB Testing

Server Message Block (SMB) is a communication protocol that enables communication between computers and devices over a network. SMB is commonly used for file sharing, printer access, and domain services.

Cobalt’s pentesters enumerate SMB servers and attempt to exploit common vulnerabilities, such as:

* SMB message signing disabled
* Missing critical patches
* Null sessions
* SMB file shares with weak or missing authentication
* SMB relay attacks
* Insecure SMB encryption

### Web and FTP Servers

Web servers are vulnerable to defacement attacks, or could be used as a launching pad for further attacks against hosts based locally to the web server.

Cobalt’s pentesters scan all web and FTP servers in the internal network for potential exploits and vulnerabilities, such as:

* Poor patching policy
* Default installation
* Insecure credentials

### Email Servers

Cobalt’s pentesters check SMTP, POP3, and IMAP on the mail gateway for open relay vulnerabilities. Your mail servers should:

* Accept mail *only* for the organization’s domains.
* Not relay mail for other domains.

### Network Attached Devices

Printers inside corporate networks can be shared with the entire organization and may be a member of an AD network. These devices may use insecure default credentials or be vulnerable to web application attacks.

VOIP phones are a common presence on an internal network and can be vulnerable to misconfigurations, SIP vulnerabilities, and outdated firmware that may allow remote code execution (RCE).

Cobalt’s pentesters test printers and phones against all common attacks and make sure that they use secure credentials.

### Password Cracking

During an AD engagement, a pentester may perform offline password cracking against hashes obtained during the engagement. Some common techniques of obtaining hashes include:

* Conducting LLMNR/NBNS poisoning attacks
* Extracting NTDS.dit databases
* Performing Kerberoasting attacks
* Performing AS-REP roasting attacks
* Dumping SAM databases
* Performing attacks with Mimikatz

Password cracking will allow Cobalt’s pentesters to escalate privileges and move laterally within the network.


:::info
#### Tools

During this testing phase, pentesters use multiple tools, such as:

* Ettercap
* Metasploit
* Nmap
* Responder
* Impacket

:::

## Reporting, Triaging, and Retesting

Cobalt pentesters report and triage all vulnerabilities during the assessment. You can review details of all [findings](https://cobalt-io.brainfish.ai/en-us/articles/findings-6prkG67iav), in real time, through the Cobalt platform. In these findings, as well as in any [report](https://cobalt-io.brainfish.ai/en-us/articles/reports-YkC2da1roR), Cobalt’s pentesters include detailed information, including:

* Step-by-step remediation guidance
* Recommendations on how to improve your overall security posture

You can [remediate findings](https://cobalt-io.brainfish.ai/en-us/articles/remediate-findings-22WPR0Fnlv) during and after the pentest. Then you can submit findings for retest. Our pentesters test the updated components and retest vulnerabilities to ensure that there are no security-related residual risks.

Internal Network Methodologies

Cobalt Methodologies Overview

Web Methodologies

API Methodologies

External Network Methodologies

Mobile Methodologies

Cloud Configuration Review Methodologies

Cloud Pentest Methodology

Desktop Methodologies

AI/LLM Methodologies

Digital Risk Assessment Methodology

Secure Code Review Methodologies

Methodologies

How to get started with Cobalt

Getting Started

Risk Advisories

Assets are what we pentest

Asset Types

Create an Asset

Assets

Pentests

Overview

Asset Details

Pentest Details

Scope & Test Period

Preparation

Create a Pentest

Pentest Process

Pentest States

Coverage Checklist

Pentest Expectations

Set Up an In-House Pentest

Complete an In-House Pentest (For Pentesters)

In House Pentests

Finding States

Severity Levels

Remediate Findings

Findings

Customize Your Report

Co-branded Reports

Contents of a Pentest Report

Reports

Engagements Overview

Digital Risk Assessment

Secure Code Review

Engagements

Insights

Planning

Attack Surface Monitoring (ASM)

Attack Surface

DAST Scanner Overview

Best Practices

Integrations

Partial Scans: Reduced Scope

Scans

Sequence recorder

Targets

Target Authentication

Extra Hosts

Blackout Period

DAST Scanner

Account Overview

Account Settings

Password Best Practices

Sign In to Cobalt

Troubleshoot Sign-in Issues

User Account

Collaboration Overview

Collaborate on Pentests

Groups

Manage Pentest Collaborators

Manage Notifications

User Roles and Permissions

Collaboration

Organization Overview

Manage Users

Your Cobalt Contract

Configure SAML SSO

How to Configure SAML 2.0 for Cobalt 

SAML Migration: Update Your Configuration

SCIM Provisioning Setup Guide

Configure Organization Settings

Organization

Track Your Credits

Cobalt Credits

Cobalt PtaaS Tiers

Credits

Cobalt Integrations Overview

Troubleshooting

Create Jira tickets for Findings

Send email notifications for Findings from Outlook

Create GitLab tickets for Findings

Create GitHub tickets for Findings

HTTP Connector

Import Assets from Google Sheets

Map Cobalt Pentest Finding Severity to Jira Issue Priority

Modify Jira Issue Summary to contain Pentest Title

Create Azure DevOps Work Item for Findings

Send MS Teams notifications for Findings

How to Guides

Connect your applications

Integration Builder

Synchronize Cobalt Severity Levels with Jira

Push Cobalt Findings to Jira

Jira Cloud Integration

Jira Data Center Integration

Troubleshoot Your Jira Integration

Switching to a New Jira Instance

Integrate Jira with Cobalt

Slack

Microsoft Teams

Webhooks

DefectDojo

Kenna Security

Vanta

Carried Over Findings

Create Test Finding

Cobalt API Overview

Create a Personal Cobalt API Token

Get an Organization Token

Revoke Your Personal Cobalt API Tokens

Create or Modify an Asset

Import Findings to Google Sheets

Cobalt API

Glossary

March 2026

February 2026

January 2026

November 2025 

August 2025

July 2025

June 2025

May 2025

April 2025

March 2025

January 2025

December 2024

November 2024

October 2024

September 2024

August 2024

July 2024

June 2024

May 2024

April 2024

March 2024

January 2024

What's New

Guide

Cobalt Product Documentation

Internal Network Methodologies

Share

Share

Internal Network Methodologies

Share

Share