External vs Internal Network Penetration Testing

Enterprise networks operate across two distinct trust boundaries: the external perimeter that interfaces with the public internet, and the internal network that connects corporate workstations, domain controllers, database clusters, and internal services.

An External Network Penetration Test evaluates your organization from the perspective of an untrusted internet adversary with zero insider knowledge. The objective is to discover internet-facing IP addresses, enumerate exposed services, test perimeter gateways (such as VPN concentrators and firewalls), and attempt to gain an initial foothold into your environment.

An Internal Network Penetration Test evaluates your posture from an assumed-breach perspective. The assessor begins from a position inside the corporate network—connected to an office ethernet port, an internal Wi-Fi network, or operating through a compromised standard employee laptop. The objective is to determine whether an attacker who has bypassed perimeter controls can move laterally, escalate privileges within Active Directory, and compromise critical corporate data.

External testing provides essential assurance that internet-facing infrastructure is properly hardened against automated reconnaissance and targeted exploitation:

• Exposed Administrative Interfaces: Identifying internet-facing SSH, RDP, Telnet, database listeners, or out-of-band management cards (such as IPMI, iLO, or iDRAC) that should never be reachable from the public internet.

• Legacy and Unpatched Edge Devices: Discovering outdated VPN concentrators (such as Pulse Secure, Fortinet, or SonicWall), Citrix Gateways, or web proxies vulnerable to known public exploits (frequently listed on the CISA Known Exploited Vulnerabilities catalog).

• DNS Hygiene and Subdomain Takeovers: Verifying that DNS records do not point to deleted cloud storage buckets, decommissioned cloud services, or unallocated Elastic IPs.

• Mail Server Hygiene: Reviewing SPF, DKIM, and DMARC configurations to ensure attackers cannot forge email originating from your domain.

The vast majority of catastrophic enterprise ransomware incidents occur not because of perimeter vulnerabilities, but because internal Active Directory (AD) environments lack privilege tiering and identity hardening. Once an assessor gains an internal foothold, testing focuses on Active Directory hygiene:

• Kerberoasting: In Active Directory, service accounts that run background workloads (such as database instances or backup agents) register Service Principal Names (SPNs). Any standard, unprivileged domain user can query domain controllers for these accounts and request an encrypted Kerberos Ticket Granting Service (TGS) ticket. Because the ticket is encrypted using the service account’s password hash, the tester extracts the ticket and cracks it offline using high-speed dictionary attacks without triggering account lockout policies or generating network noise. If the service account utilizes a weak password, the attacker recovers plaintext credentials and inherits its administrative rights.

• AS-REP Roasting: Targeting user accounts configured with Kerberos pre-authentication disabled. Assessors request authentication data directly from the domain controller and crack the returned encrypted timestamp offline.

• Attack Path Analysis and Graph Mapping: Mapping hidden relationship chains—such as unconstrained Kerberos delegation, nested group memberships, and write permissions over organizational units—that allow an unprivileged user to escalate to Domain Administrator privileges through indirect permissions.

• Credential Harvesting and Lateral Movement: Extracting password hashes and Kerberos tickets from local operating system memory on compromised workstations, then reusing those credentials across adjacent systems via Pass-the-Hash or Pass-the-Ticket techniques without requiring plaintext passwords.

An effective internal defense relies on network segmentation: dividing the enterprise into isolated security zones protected by internal firewalls and Access Control Lists (ACLs).

During an internal test, assessors systematically validate whether lower-trust zones (such as guest Wi-Fi networks, contractor workstations, developer lab subnets, or IoT smart building devices) can communicate with critical infrastructure, such as production database clusters, payment gateways, or Domain Controllers. True defense-in-depth ensures that a compromise in one subnet is strictly contained.

Assuming a network perimeter will never be breached is an obsolete defense strategy. Modern security architecture assumes that an employee will eventually enter credentials into a phishing portal or execute malicious code. The primary engineering metric is blast radius containment: ensuring that a compromised workstation cannot escalate to domain-wide compromise within minutes.

Eradicating Active Directory attack paths requires structural architectural hardening rather than individual patch updates:

• Implement an Administrative Tiering Model: Strictly separate Tier 0 (Domain Controllers, PKI, Identity), Tier 1 (Enterprise servers and cloud management), and Tier 2 (User workstations). Domain Admin credentials must never be entered into Tier 1 or Tier 2 machines where they can be harvested from memory.

• Deploy Microsoft LAPS (Local Administrator Password Solution): Automatically randomize unique local administrator passwords across every server and workstation to stop lateral Pass-the-Hash attacks in their tracks.

• Enforce Group Managed Service Accounts (gMSA): Replace user-based service accounts with gMSAs that utilize 128-character automatically rotated passwords, permanently neutralizing Kerberoasting.