Infrastructure testing

Infrastructure testing answers two different questions. From the outside: can someone get in from the internet? From the inside, more important and more often ignored: once a laptop is compromised — through phishing, a lost device, a supplier with access — how far does the attacker reach? In most networks we test, the path from the initial foothold to “Domain Admin” takes hours, not weeks, and runs through configurations that nobody ever considered a vulnerability.

External

We test the perimeter as an anonymous but methodical attacker. We map the real attack surface (not just what you think you expose): forgotten administration services, VPN and portals without MFA, exposed RDP and SMB, management interfaces, orphaned subdomains. We run controlled password spraying — a single common password tried broadly catches more often than it should — and verify the CVEs that can actually be exploited, not the entire list a scanner spits out.

Internal and Active Directory

This is the core. We start from an “assumed breach” position and follow the complete chain:

• Credential capture — LLMNR / NBT-NS / mDNS poisoning and SMB relay, to obtain the first hashes without breaking anything
• Kerberos and AD attacks — Kerberoasting and AS-REP Roasting (service accounts with weak passwords, cracked offline), Pass-the-Hash and Pass-the-Ticket, delegation abuse (constrained and unconstrained), DCSync, and attacks on Active Directory Certificate Services (ESC1–ESC8) — an escalation class that few networks have under control
• Path mapping — with BloodHound we analyse relationships between users, groups, sessions and permissions and find the shortest path to domain control, including paths an administrator would never suspect
• Escalation and lateral movement — local Windows/Linux configurations, in-memory credential extraction, WinRM/PsExec/RDP

Segmentation validation

Segmentation “exists on paper” at nearly every organisation. We test it in practice: we prove whether a foothold in one zone actually reaches critical systems. It’s common, for instance, for a bank to test its ATM zone or SWIFT zone separately — and there a single forgotten firewall rule matters more than ten CVEs.

Methodology and deliverables

We follow PTES (reconnaissance → enumeration → analysis → access → post-exploitation → domain domination → reporting), Black-Box or White-Box. We deliver:

• An executive summary with actual exposure and probable breach paths
• The attack-path narrative — step by step, how a single foothold became full domain access; this is the part that changes decisions, not the port table
• Findings with CVSS scores, affected hosts, evidence, reproduction and remediation prioritised by exploitability
• Segmentation test results and an Active Directory hardening plan
• Retesting after remediation and a technical presentation session