# Pentest Network Internal > Internal network penetration testing, Active Directory enumeration, and lateral movement simulation. Use when this capability is needed. - Skill: `tomevault-io/pentest-network-internal` (Agent Skill, multi-file: 2 files) - Install (CLI): `npx skillmds@latest add tomevault-io/pentest-network-internal` - Raw SKILL.md: https://api.skillmd.com/api/skills/tomevault-io/pentest-network-internal/raw - Safety review: pending (external: skill-scanner PASS, skillspector PASS) - Works with: Claude Code, Claude.ai, OpenAI Codex - Category: Coding & Dev Tools - Author: tomevault-io (https://skillmd.com/u/tomevault-io) - Updated: 2026-09-17 - Page: https://skillmd.com/skills/tomevault-io/pentest-network-internal --- # Pentest Network Internal ## Purpose Simulate an internal attacker to identify weak credentials, misconfigured services, and Active Directory paths to high-value assets. ## Core Workflow 1. **Network Discovery**: Map the internal network, live hosts, and open ports using `nmap` and `masscan`. 2. **Service Enumeration**: Identify running services, versions, and potential entry points (SMB, RDP, SSH, etc.). 3. **Vulnerability Scanning**: Check for known service vulnerabilities (e.g., EternalBlue, ZeroLogon) using `nuclei` and `nmap-scripts`. 4. **Credential Auditing**: Test weak passwords and default credentials using `hydra` and `netexec` (CrackMapExec). 5. **Active Directory Enum**: Map AD trust relationships, users, and groups using `bloodhound` and `ldapdomaindump`. 6. **Lateral Movement**: Simulate movement between hosts using valid credentials or exploits. ## References - `references/tools.md` - `references/workflows.md` --- > Converted and distributed by [TomeVault](https://tomevault.io/claim/jd-opensource) — claim your Tome and manage your conversions.