Network Pentest

Skill: Network Penetration Testing

Supplementary Files:

• payloads.md — Complete attack payload library covering the full network kill chain: host discovery, port scanning, service enumeration, vulnerability scanning, MITM attacks, traffic capture, credential attacks, and lateral movement.
• test-cases.md — Structured test case checklist covering five major categories: reconnaissance, enumeration, vulnerability assessment, MITM attacks, and vulnerability exploitation.

Summary

Network Pentest skill domain covering network attack operations.

Tools: nmap, tcpdump, tshark, bettercap, hping3, responder, enum4linux, arp-scan (+9 more)

Domain: network-attack

MITRE ATT&CK: TA0046-Initial Access

Description

Network penetration testing covering the full attack chain from reconnaissance, port scanning, and service fingerprinting through vulnerability assessment, exploitation, traffic sniffing, and MITM attacks. The core objective is assessing network security posture, discovering protocol and service-layer weaknesses, and verifying defense mechanisms. Mastery requires deep understanding of the TCP/IP stack, packet-level analysis, and proficiency with sniffing, spoofing, and scanning tools.

Use Cases

1. Internal network penetration assessment — Perform security assessment on enterprise internal networks; discover unauthorized services and configuration weaknesses.
2. Network architecture audit — Verify network segmentation, VLAN isolation, and firewall rule effectiveness.
3. Protocol security testing — Assess security configuration of SMB, RDP, FTP, SNMP, and other network protocols.
4. MITM attack verification — Test network resilience against ARP spoofing, DNS spoofing, and other man-in-the-middle attacks.
5. Incident response forensics — Locate attack paths of security events through traffic capture and analysis.

Core Tools

Methodology

Attack Chain

Network Discovery     Port Scanning       Service Fingerprint   Vulnerability ID
(arp-scan,            (nmap -sS,          (nmap -sV,            (nmap --script,
 ping sweep)          nmap -sT)           nmap -sC)             enum4linux)
    |                     |                    |                     |
    v                     v                    v                     v
Exploitation          Traffic Sniffing    MITM Attack           Lateral Movement
(Metasploit,          (tcpdump,           (bettercap,           (impacket,
 CVE exploit)         tshark)             responder)            smbexec)

Phase Details:

1. Network discovery — Use ARP scans and ICMP detection to quickly locate live hosts and establish network topology.
2. Port scanning — From SYN half-open scans to full-connect scans; select scan policy based on stealth requirements.
3. Service fingerprinting — Capture banners and probe services to identify running versions; match against known vulnerabilities.
4. Vulnerability identification — Use NSE scripts and specialized tools to verify service configuration flaws and known CVEs.
5. Vulnerability exploitation — Leverage discovered vulnerabilities to obtain initial access.
6. Traffic sniffing — Capture and analyze network traffic to extract credentials and sensitive information.
7. MITM attack — Intercept and modify network communications via ARP/DNS spoofing.
8. Lateral movement — Use obtained credentials and access to extend control scope within the internal network.

Defense Perspective

Practical Steps

See payloads.md for detailed payloads and test-cases.md for the complete test checklist.

1. Host Discovery and Port Scanning

Use nmap to perform host discovery and port scanning; select the appropriate scan policy based on target environment.

# Quick host discovery (no port scan)
nmap -sn 192.168.1.0/24

# SYN half-open scan + service version detection + default scripts + all ports
sudo nmap -sS -sV -sC -p- -T4 --min-rate 1000 target

# UDP scan (slower but covers DNS/SNMP/DHCP)
sudo nmap -sU --top-ports 100 target

# Stealth: slow timing + fragmentation + decoy
sudo nmap -sS -T2 -f -D RND:10 target

2. Traffic Capture and MITM Attack

Use tcpdump/tshark for traffic analysis and bettercap for ARP spoofing + credential sniffing.

# Capture traffic to file with BPF filter
tcpdump -i eth0 -w capture.pcap 'port 80 or port 443'

# Real-time HTTP request extraction
tshark -i eth0 -Y "http.request" -T fields -e http.host -e http.request.uri

# Start bettercap interactive session
bettercap -iface eth0
# Inside bettercap:
#   net.probe on
#   arp.spoof on
#   set arp.spoof.targets 192.168.1.50
#   http.proxy on

3. Service Enumeration and Lateral Movement

Use enum4linux and the impacket toolkit for deep Windows environment enumeration and lateral movement.

# Comprehensive SMB enumeration
enum4linux -a target

# Alternative: netexec (modern CME successor)
netexec smb 10.0.0.0/24 -u user -p pass --shares

# WMI remote command execution
impacket-wmiexec domain/user:password@target

# Pass-the-Hash with smbexec
impacket-smbexec -hashes :NTHASH domain/user@target

# Dump NTDS.dit remotely
impacket-secretsdump domain/admin:pass@DC -just-dc-ntlm

Common Pitfalls

• Scanning without proper authorization: Network scanning is detectable and can trigger IDS alerts or legal consequences. Always verify scope authorization before initiating any scan, and use cautious scan rates on sensitive production networks.
• Relying on a single scanning tool: Different tools discover different things. Nmap may miss hosts that arp-scan finds on the local subnet, and vice versa. Combine multiple tools and cross-reference results for comprehensive coverage.
• Ignoring UDP services: Most port scanning focuses on TCP, but critical services like DNS (53), SNMP (161), and DHCP (67) run over UDP. Use nmap -sU to scan UDP ports, though be aware that UDP scanning is significantly slower and less reliable than TCP scanning.

Automation and Scripting

Automate network reconnaissance with shell scripts that chain discovery tools together: arp-scan for live host discovery piped into nmap for service enumeration, with results parsed and stored in a structured format for later analysis. Use Python with scapy to craft custom protocol packets for targeted testing. Schedule periodic network scans with cron and compare results over time to detect unauthorized devices, new open ports, or configuration changes that may indicate compromise.

Reporting and Documentation

Network penetration test reports should include a network topology map showing discovered hosts, services, and trust relationships. Document each finding with the specific nmap or tool command used, the raw output, and the assessed risk level. Include a traffic capture summary (protocols, volumes, anomalies) and highlight any credentials or sensitive data intercepted during MITM testing. Map all findings to MITRE ATT&CK techniques for standardized communication with stakeholders.

Legal and Ethical Considerations

Network penetration testing involves active exploitation of network protocols and interception of traffic, which is regulated by law in most jurisdictions. Obtain explicit written authorization specifying the IP ranges, testing windows, and permitted attack types. MITM attacks and credential sniffing are particularly sensitive — ensure authorization specifically covers these activities. Never capture or store credentials from production networks without explicit approval, and always sanitize captured traffic of any unrelated sensitive data before including it in reports.

Integration with Other Tools

Network penetration testing naturally chains into multiple adjacent skills. Port scan results feed directly into vulnerability assessment (OpenVAS, Nuclei) for CVE identification. Extracted credentials from Responder or sniffing feed into password-attack skill for offline cracking. MITM findings inform application-layer testing (web XSS, SSRF) by revealing unencrypted internal communications. Use BloodHound for Active Directory graph analysis after enumerating SMB and LDAP services, and pivot to post-exploitation once initial access is obtained.

Case Studies and Examples

• Internal network assessment: An arp-scan revealed an undocumented legacy server on a supposedly decommissioned subnet. Nmap service enumeration showed it was running an unpatched SMB service (MS17-010 vulnerable). The server had domain admin credentials cached in memory, enabling full domain compromise via Pass-the-Hash.
• MITM credential harvesting: During an internal assessment, Responder captured NTLMv2 hashes from LLMNR poisoning. One hash belonged to a service account with local admin privileges on 47 workstations, enabling lateral movement across the entire floor.
• Firewall rule audit: By comparing nmap scan results from different network segments, identified that the firewall allowed unrestricted traffic between the DMZ and internal database VLAN, violating the documented network segmentation policy.

Detection Methods

Understanding how network attacks are detected helps testers operate more stealthily and helps defenders build better monitoring.

Network-Level Indicators

• Port scan patterns: SYN without ACK completion (nmap -sS), XMAS tree flags (FIN+URG+PSH), idle scan anomalies.
• Service fingerprinting: Repeated connections to multiple ports from same source IP within short window.
• Anomalous protocols: Unusual SMB/RPC traffic outside business hours; unexpected LLMNR/NBT-NS queries.
• MITM indicators: ARP table changes (>3/min on access switch), duplicate MAC addresses, ARP replies from non-DHCP server.

Host-Level Indicators

• Process anomalies: Unexpected nmap/masscan/wireshark binary execution on workstations.
• Network connections: New outbound connections to unknown IPs (correlate with threat intel).
• Log gaps: Suspicious gaps in /var/log/auth.log or Windows Event Log (often indicates anti-forensics).

SIEM Detection Rules

• Sigma rule: sigma/rules/network/net_scan_pattern.yml — detects nmap-typical patterns.
• ELK query: event.action:"connection_attempt" AND destination.port:<1024 GROUP BY source.ip HAVING count() > 20
• Splunk SPL: index=network sourcetype=firewall action=denied | stats count by src_ip | where count > 100
• Windows Event ID 4697: Service install from suspicious path (Responder indicator).

Defense Evasion Techniques

IDS/IPS Evasion

• Fragmented packets: nmap -f splits probe packets across IP fragments to bypass signature matching.
• Decoy scans: nmap -D RND:10 mixes real source with 10 random decoy IPs.
• Timing manipulation: nmap -T0 (paranoid) spreads probes over hours; -T1 (sneaky) over minutes.
• Custom payloads: Modify signature strings to avoid pattern matching (e.g., change nmap User-Agent).
• Idle scan: nmap -sI zombie:80 uses a zombie host as the apparent source.
• Source port manipulation: --source-port 53 or --source-port 88 exploits permissive firewall rules that allow DNS/Kerberos.

Logging Evasion

• Log injection: Modify /var/log/wtmp and /var/log/btmp to remove login records.
• Time-stomping: Change file timestamps with timestomp (Meterpreter) to match legitimate files.
• Clear specific events: Use wevtutil on Windows to delete specific Event IDs (requires admin).
• Memory-only execution: Use memfd_create() syscall to run tools without disk artifacts.

Tool Obfuscation

• Binary renaming: Rename nmap binary to avoid process-name detection (e.g., nmap → network_scanner).
• Static compilation: Compile tools statically to avoid dynamic library dependencies that may be monitored.
• Custom builds: Modify open-source tools to change signatures and behavior patterns.

MITM Stealth

• Selective ARP spoofing: Target only specific hosts rather than the entire subnet to reduce noise.
• Short TTL on spoofed entries: Refresh spoofed ARP entries less frequently to avoid detection.
• One-way MITM: Only poison client→server traffic (asymmetric) to halve the ARP traffic footprint.

Performance Considerations

Network scan performance depends heavily on the target environment and testing constraints. For large networks (/16 or larger), use nmap's host discovery mode (-sn) first to identify live hosts before running full port scans. Use --min-rate and --max-rate to control scan speed. For time-constrained engagements, prioritize the top 1000 ports (-F) over all 65535 ports. When capturing traffic with tcpdump, use BPF filters to capture only relevant protocols and avoid filling disk space with irrelevant data. Consider using tshark with display filters for real-time analysis instead of capturing everything and filtering later.

Tool Comparison Matrix

Hacker Laws

Learning Resources

Skill supplementary files: payloads.md, test-cases.md

Related Skills: skills/post-exploitation/SKILL.md, skills/wifi-pentest/SKILL.md, skills/ad-ldap-attack/SKILL.md

External Resources:

• Nmap Official Documentation — Nmap reference guide, required reading.
• Nmap NSE Scripts — Complete script library with usage examples.
• Wireshark Wiki — tshark and Wireshark protocol analysis.
• Bettercap Official Documentation — MITM framework complete reference.
• Impacket GitHub — Windows network protocol Python library.
• tcpdump Manual Page — BPF filter syntax authoritative reference.
• MITRE ATT&CK Reconnaissance — Initial Access technique mapping.

Workspace notes: memory/tshark.md | memory/bettercap.md | memory/hping3.md | memory/arp-scan.md | memory/mtr.md | memory/zenmap.md