Infrastructure Penetration Testing

What We Test — and How

Each service area is a standalone engagement with its own methodology and deliverable. We define scope individually — below is a precise breakdown of what each test covers.

Internal Penetration Test

Active Directory Internal Network ADCS Lateral Movement 8–15 MD

We simulate a breach scenario — attacker already inside via a compromised workstation, phishing link, stolen VPN credential or physical network access. We don't assess the perimeter. We answer the question that actually matters: how far can an attacker get once they're in? The output is a precise attack chain from unprivileged domain user to full domain compromise.

Network Reconnaissance & Mapping

Active host discovery, open port enumeration and service fingerprinting. OS and version identification. VLAN and segmentation mapping, management interfaces (iDRAC, IPMI, web consoles).

TCP/UDP port scanning, service enumeration
SNMPv1 community string enumeration
Default credentials on network devices and management interfaces
Detection of cleartext internal protocols (Telnet, FTP, HTTP)

Active Directory — Path to Domain Admin

The most common path to full compromise. BloodHound maps every route to Domain Admin — then we validate each one manually against your environment.

Kerberoasting and AS-REP Roasting (service account hash cracking)
NTLM relay, Pass-the-Hash, Pass-the-Ticket
Active Directory Certificate Services (ADCS) — ESC1 through ESC8
Misconfigured GPO, ACL and permission delegation
Misconfigured domain trusts and SID history abuse

Network Devices & Management Interfaces

Firewalls, switches, routers, printers and VPN gateways are a chronically overlooked attack surface. We test every misconfiguration and unnecessarily exposed interface.

Unauthorised access to management interfaces (web GUI, SSH, SNMP)
ACL and firewall rule misconfigurations
Printers and IoT devices as pivot points into the rest of the network
VPN gateways — authentication, encryption and session management

Privilege Escalation & Post-Exploitation

Starting from a compromised workstation — we escalate privileges, move laterally and reach the data that matters to your business.

DLL Hijacking, Unquoted Service Path, token impersonation
AV/EDR evasion (AMSI bypass, Living-off-the-Land binaries)
Lateral movement via SMB, WMI, PsExec, RDP, WinRM
Access to databases, file servers and backup systems
Data exfiltration simulation within agreed scope

Test Workflow

Scoping

Scope definition, rules of engagement, NDA and authorisation letter.

Access & Recon

Establishing access, enumerating the AD environment, mapping the internal network.

Exploitation

AD attacks, privilege escalation, lateral movement.

Post-Exploitation

Credential dumping, data access, persistence simulation.

Report & Debrief

CVSS scoring, full attack chains, prioritised remediation plan — plus a debrief session with your IT team.

What We Need From You

VPN or on-site access — no credentials to your systems required upfront.
A standard read-only domain user account in AD.
An IT contact available during the engagement for coordination.

Tooling Nmap BloodHound Impacket CrackMapExec Mimikatz Rubeus Certipy Metasploit

Controlled testing: Destructive techniques (DoS, data wipe) are always agreed in advance. Exploitation runs in coordination with your IT team within defined time windows.

External Penetration Test

Perimeter VPN / RDP / SSH ASM Proof-of-Concept 3–10 MD

An attacker on the internet who knows nothing about you — only your domain name. We start with passive reconnaissance and Attack Surface Management, exactly as a real threat actor would. We regularly discover systems our clients didn't know were exposed. Every finding is validated as a working proof-of-concept — no theoretical results without demonstrated impact.

Attack Surface Mapping (ASM)

We identify everything visible from the internet — including forgotten systems and shadow IT that never made it into your asset inventory.

Subdomain enumeration — passive and active techniques
TCP/UDP scanning, OS and service version fingerprinting
Detection of exposed HTTP(S), VPN, RDP, SSH, SMTP and FTP endpoints
TLS/SSL audit — certificate validity, weak ciphers, HSTS enforcement
Technology stack fingerprinting and software version identification

Exploitation & Authentication Attacks

We validate every vulnerability as a working exploit — not a scanner output. Every critical finding includes a screenshot or dump as proof of access.

Default credentials, targeted brute-force with lockout detection
RCE, SQL Injection, SSRF, XXE, LFI/RFI exploitation
VPN gateway vulnerabilities (Cisco, Fortinet, Palo Alto, Pulse)
Web server and middleware misconfigurations
CVE exploitation against identified software versions

Perimeter Breach — When Exploitation Succeeds

Pivoting into the internal network is not a default scope item — but when exploitation succeeds, we can attempt a direct breach with client approval to demonstrate real-world impact.

Escalation to root/admin after successful compromise
Lateral movement into the internal network (with client approval)
Access to internal databases and file servers
Data exfiltration simulation (within agreed scope)

Test Workflow

Scoping

Target IP ranges and domains, rules of engagement.

OSINT & ASM

Passive recon, subdomain enumeration, breach database checks.

Active Scanning

Port scanning, fingerprinting, CVE identification.

Exploitation & PoC

Validated exploitation with a working proof-of-concept for every critical finding.

Report

Executive summary + technical detail + prioritised remediation plan.

What We Need From You

List of IP ranges and domains in scope
Whitelist our IP at your SOC / SIEM to suppress false-positive alerts
Point of contact for coordination in case of a critical finding

Tooling Nmap Shodan Amass Nuclei Metasploit Burp Suite ffuf Censys

Wi-Fi Penetration Test

WPA2 / WPA3 802.1X Evil Twin VLAN Segmentation 2–5 MD

An attacker physically present near your building — a parked car, the reception area, a conference room. No network access required, proximity is enough. Most common critical finding: guest Wi-Fi and production network sharing the same VLAN — printers, NAS and internal systems reachable from the lobby.

Wireless Environment Reconnaissance

We map everything broadcasting near your premises — visible and hidden networks, rogue APs and encryption strength.

SSID mapping including hidden networks and rogue APs
Protocol analysis — WPA2, WPA3, 802.1X, WPS
Identification of weak authentication configurations
Passive traffic capture and handshake collection

Active Attack Scenarios

Attacks requiring zero network access — physical proximity to the building is sufficient.

Evil Twin / Rogue AP — spoofing a legitimate access point
Deauth attacks forcing client reconnection
Offline WPA2 handshake cracking
MITM credential capture post-connection
WPS PIN brute-force (where WPS is enabled)

802.1X & RADIUS Exploitation

Enterprise Wi-Fi authentication via RADIUS has specific weaknesses. We test resilience against downgrade attacks and invalid certificate acceptance.

RADIUS exploitation and invalid certificate acceptance
PEAP-MSCHAPv2 downgrade attacks
Client acceptance of self-signed certificates
Verification of correct EAP chain configuration

Guest vs. Production Network Segmentation

Once connected, we verify that segmentation holds at every layer — not just on paper.

Guest VLAN isolation from the production network
Reachability of printers, NAS and internal systems from the guest segment
Cross-VLAN communication and firewall gaps
Lateral movement after connecting to the guest network

Test Workflow

Scoping

Target location(s), SSIDs in scope, on-site access logistics.

Passive Recon

Full SSID survey, passive traffic capture, client and AP fingerprinting.

Active Attacks

Evil Twin, deauth, cracking, 802.1X testing.

Post-Connect

VLAN isolation testing, lateral movement attempts post-connection.

Report

Per-SSID and per-location findings, CVSS scoring, remediation steps.

What We Need From You

Physical access to the target building or campus.
SSIDs to be included in scope.
IT or security contact available during the engagement.

Tooling Aircrack-ng Kismet Hostapd-wpe hcxdumptool hashcat Wireshark

Cloud Penetration Test

AWS Azure GCP IAM Privilege Escalation CIS Benchmarks 5–12 MD

Cloud pentest from the perspective of an attacker with minimal access — or no access at all when resources are publicly exposed. Most common critical finding: IAM privilege escalation from a restricted account to administrator via misconfigured roles. We test AWS, Azure and GCP against CIS Benchmarks and our own methodology built from real-world cloud incidents.

S3 / Blob Storage & Exposed Credentials

The most common source of cloud incidents — public storage buckets with sensitive data and leaked credentials in public repositories.

Publicly accessible S3 / Blob Storage buckets containing sensitive data
API keys and tokens in public GitHub repositories and CI/CD pipelines
Credentials in configuration files and paste sites
Databases and storage exposed without authentication

IAM Privilege Escalation

The most exploited weakness in cloud environments. We test dozens of escalation techniques from restricted access to full administrator.

Escalation via misconfigured IAM roles and policies
Assume-role exploitation and cross-account access
Lambda / Cloud Functions privilege escalation
Instance Metadata Service (IMDS) abuse
Service account keys with excessive permissions

Network Configuration & Exposure

Misconfigured Security Groups and NSGs expose internal services to the internet. We review every rule.

Security Groups / NSG — overly permissive rules (0.0.0.0/0)
Publicly accessible databases (RDS, CosmosDB without authentication)
Exposed management ports (22, 3389, 5432)
VPC / VNet peering with unintended transitivity

CIS Benchmarks Audit

Systematic cloud configuration audit against industry standards.

Logging and monitoring — CloudTrail, Azure Monitor, Cloud Audit Logs
Encryption at rest and in transit
Secrets management and access key rotation
MFA enforcement on root / global admin accounts
Alerting on critical actions (root login, IAM policy changes)

Test Workflow

Scoping

Cloud accounts and regions in scope, services to be tested, rules of engagement.

Reconnaissance

Asset inventory, IAM role and policy mapping, public exposure review.

IAM Exploitation

Escalation path testing from restricted user to cloud administrator.

CIS Audit

Automated tooling (Prowler, ScoutSuite) combined with manual review.

Report

Findings ranked by business impact — from full tenant takeover to billing abuse.

What We Need From You

Read-only IAM role — not a full admin account.
List of cloud accounts and subscriptions to be tested.
A cloud architect or DevOps contact for technical questions during the engagement.

Tooling Prowler ScoutSuite Pacu CloudSploit PowerZure ROADtools AWS CLI

Cloud provider policies: AWS, Azure and GCP each have their own penetration testing terms. We always operate within provider policies and secure any required permissions in advance.

OSINT Analysis

Passive — no system contact Technical OSINT Personnel OSINT Dark Web 3–6 MD

No scanning. No system contact. No exploitation. We work entirely from public sources — the same way a threat actor researches a target before the first breach attempt. OSINT runs as a standalone digital footprint audit or as the reconnaissance phase before an external test. All we need to get started is your domain name.

Technical Attack Surface

A complete map of what a potential attacker knows about your infrastructure — including forgotten assets and shadow IT.

Domains and subdomains — passive and active enumeration
Forgotten infrastructure, shadow IT, expired certificates
Shodan / Censys — exposed ports and services
Publicly visible technologies and versions with associated CVEs

Data Leaks & Breach Databases

We find what breach databases and dark web sources know about your organisation — before an attacker does.

Leaked employee credentials in breach databases
API keys and passwords in GitHub commits and paste sites
Internal documents and configs in public repositories
Presence in threat intelligence feeds and dark web sources

Personnel OSINT

People remain the weakest link. The digital footprint of management and key roles as an entry point for spear-phishing or vishing.

LinkedIn, Facebook, GitHub — profile analysis for key roles
Digital footprint of IT team and privileged users
Mapping of vendor and third-party relationships
Identification of spear-phishing and vishing attack vectors

Output — Attack Surface Report

A complete picture of your organisation's attack surface — as a foundation for further testing or as a standalone document for management and board.

Attack surface map with risk prioritisation
Overview of discovered leaks and exposed data
Recommendations to reduce your digital footprint
Input data for planning a follow-on external penetration test

How It Works

Seed Information

Your domain name — we build the full picture from there.

Technical OSINT

Infrastructure mapping, subdomains, certificates, Shodan and Censys.

Data Leaks

Breach databases, GitHub history, paste sites, dark web monitoring.

Personnel OSINT

Key roles, digital footprint, supplier and third-party relationships.

Attack Surface Report

Attack surface map, all findings, reduction recommendations and external test inputs.

What We Need From You (minimum)

Your domain name
Optional: list of key roles for the personnel OSINT phase

Tooling Maltego Shodan theHarvester SpiderFoot Recon-ng GitLeaks HaveIBeenPwned

Infrastructure
Penetration Testing

What We Test — and How

Internal Penetration Test

External Penetration Test

Wi-Fi Penetration Test

Cloud Penetration Test

OSINT Analysis

Who Needs Infrastructure Penetration Testing

Frequently Asked Questions

Find Out Where Your Infrastructure Is Exposed

Žadost o vzorovou zprávu výsledků z testu