/network-pentest

name: network-pentest
description: >-
  Run an authorized network penetration test: host discovery, port/service
  enumeration, vulnerability identification, exploitation, and lateral
  movement/pivoting — within an agreed scope and rules of engagement. Use to
  actively test internal/external network security you're authorized to assess.

Goal

Evidence-backed network findings and demonstrated impact (where authorized), mapped to a methodology and ranked — without straying outside scope or causing disruption.

Prerequisites

• **Authorization and explicit scope**: in-scope ranges/hosts, exclusions, testing

window, rules of engagement, and allowed techniques. Do not touch out-of-scope systems. Coordinate to avoid outages.

Methodology (see `reference.md` for ports/services/checks)

1. **Host discovery** — identify live hosts within scope (respecting rate limits). 2. **Port & service enumeration** — open ports, service/version fingerprinting, default/again-exposed admin services. 3. **Vulnerability identification** — map services to known weaknesses and misconfigurations; validate, don't just trust a scanner. 4. **Exploitation** (only if authorized, to the depth agreed) — confirm exploitable issues with controlled, non-destructive proof. 5. **Post-exploitation / lateral movement** — assess what the foothold reaches: credential exposure, trust relationships, pivoting — within RoE. 6. **Document** — findings with evidence, impact, and remediation; log what you did for deconfliction.

Output

A findings table: host/service · issue · evidence · impact · remediation, plus a network attack-path view (`security-diagramming:attack-tree`) for notable chains. Confirmed issues → `security-reporting:finding`.

Notes

Validate before exploiting and keep proofs non-destructive — this is assessment, not disruption. Stay strictly in scope and log activity for deconfliction. The highest-impact network findings are usually exposed admin services, weak/again-used credentials, and flat networks enabling lateral movement (see `network-segmentation-review`).