Skill: Network Penetration Testing

Supplementary Files:

• payloads.md — Complete attack payload library covering the full network kill chain: host discovery, port scanning, service enumeration, vulnerability scanning, MITM attacks, traffic capture, credential attacks, and lateral movement.
• test-cases.md — Structured test case checklist covering five major categories: reconnaissance, enumeration, vulnerability assessment, MITM attacks, and vulnerability exploitation.

Summary

Network Pentest skill domain covering network attack operations.

Tools: nmap, tcpdump, tshark, bettercap, hping3, responder, enum4linux, arp-scan (+9 more)

Domain: network-attack

MITRE ATT&CK: TA0046-Initial Access

Description

Network penetration testing covering the full attack chain from reconnaissance, port scanning, and service fingerprinting through vulnerability assessment, exploitation, traffic sniffing, and MITM attacks. The core objective is assessing network security posture, discovering protocol and service-layer weaknesses, and verifying defense mechanisms. Mastery requires deep understanding of the TCP/IP stack, packet-level analysis, and proficiency with sniffing, spoofing, and scanning tools.

---

Use Cases

1. Internal network penetration assessment — Perform security assessment on enterprise internal networks; discover unauthorized services and configuration weaknesses.
2. Network architecture audit — Verify network segmentation, VLAN isolation, and firewall rule effectiveness.
3. Protocol security testing — Assess security configuration of SMB, RDP, FTP, SNMP, and other network protocols.
4. MITM attack verification — Test network resilience against ARP spoofing, DNS spoofing, and other man-in-the-middle attacks.
5. Incident response forensics — Locate attack paths of security events through traffic capture and analysis.

---

Core Tools

Tool	Purpose	Command Example
nmap	Network discovery, port scanning, service/OS fingerprinting	nmap -sV -sC -O -p- target
masscan	Internet-scale fast port scanning	masscan -p1-65535 10.0.0.0/8 --rate=10000
rustscan	Modern fast port scanner (nmap frontend)	rustscan -a target -- -sV -sC
tcpdump	Lightweight packet-level capture for interval sniffing	tcpdump -i eth0 -w capture.pcap
tshark	Wireshark CLI; deep protocol dissection and analysis	tshark -r file.pcap -Y "http.request"
wireshark	Graphical protocol analyzer with deep inspection	wireshark capture.pcap
bettercap	Modular MITM framework: ARP/DNS spoofing, credential sniffing	bettercap -eval "net.probe on; arp.spoof on"
hping3	Custom TCP/IP packet construction; firewall/IDS testing	hping3 -S target -p 80 --flood
responder	LLMNR/NBT-NS/mDNS poisoning; NTLM hash capture	responder -I eth0
netexec	Network attack swiss army knife (CME successor)	netexec smb 10.0.0.0/24
enum4linux	SMB/NetBIOS enumeration for Windows recon	enum4linux -a target
arp-scan	Local subnet ARP scanning for live host discovery	arp-scan -l
mitmproxy	HTTP/HTTPS interactive proxy for traffic analysis	mitmproxy -p 8080
impacket	Windows protocol Python library (wmiexec, smbexec, secretsdump)	impacket-wmiexec domain/user:pass@target

---

Methodology

Attack Chain

Network Discovery     Port Scanning       Service Fingerprint   Vulnerability ID
(arp-scan,            (nmap -sS,          (nmap -sV,            (nmap --script,
 ping sweep)          nmap -sT)           nmap -sC)             enum4linux)
    |                     |                    |                     |
    v                     v                    v                     v
Exploitation          Traffic Sniffing    MITM Attack           Lateral Movement
(Metasploit,          (tcpdump,           (bettercap,           (impacket,
 CVE exploit)         tshark)             responder)            smbexec)

Phase Details:

1. Network discovery — Use ARP scans and ICMP detection to quickly locate live hosts and establish network topology.
2. Port scanning — From SYN half-open scans to full-connect scans; select scan policy based on stealth requirements.
3. Service fingerprinting — Capture banners and probe services to identify running versions; match against known vulnerabilities.
4. Vulnerability identification — Use NSE scripts and specialized tools to verify service configuration flaws and known CVEs.
5. Vulnerability exploitation — Leverage discovered vulnerabilities to obtain initial access.
6. Traffic sniffing — Capture and analyze network traffic to extract credentials and sensitive information.
7. MITM attack — Intercept and modify network communications via ARP/DNS spoofing.
8. Lateral movement — Use obtained credentials and access to extend control scope within the internal network.

Defense Perspective

Defense Layer	Measures	Key Points
Network Segmentation	VLAN + subnet isolation + microsegmentation (Cisco TrustSec, VMware NSX)	Limit lateral movement blast radius; enforce default-deny between zones; review quarterly
IDS/IPS	Snort / Suricata + signature + anomaly detection + threat intel feeds	Deploy at perimeter AND critical internal segments; tune to reduce false positives below 5%
Port Security	Disable unused ports + firewall ingress/egress rules + NAC	Follow least-privilege principle; document every open port with business justification
Encrypted Communications	TLS 1.3 everywhere + HSTS + certificate pinning for critical services	Prevent traffic sniffing and credential leakage; enforce via policy (disable plain-text protocols)
ARP Protection	Dynamic ARP Inspection (DAI) + static ARP binding + DHCP snooping	Deploy on all access switches; alert on ARP table changes; integrate with SIEM
802.1X Authentication	Strong identity verification (cert-based EAP-TLS preferred) for network access	Prevent unauthorized device access; combine with RADIUS accounting for audit trail
LLMNR/NBT-ES Disable	Disable LLMNR/NBT-NS via GPO; require DNS-only resolution	Eliminates Responder attack vector; fallback acceptable only for legacy systems
SMB Hardening	SMB signing required + disable SMBv1 + restrict SMB to specific hosts	Prevents relay attacks; monitor for abnormal SMB session patterns

---

Practical Steps

See payloads.md for detailed payloads and test-cases.md for the complete test checklist.

1. Host Discovery and Port Scanning

Use nmap to perform host discovery and port scanning; select the appropriate scan policy based on target environment.

# Quick host discovery (no port scan)
nmap -sn 192.168.1.0/24

# SYN half-open scan + service version detection + default scripts + all ports
sudo nmap -sS -sV -sC -p- -T4 --min-rate 1000 target

# UDP scan (slower but covers DNS/SNMP/DHCP)
sudo nmap -sU --top-ports 100 target

# Stealth: slow timing + fragmentation + decoy
sudo nmap -sS -T2 -f -D RND:10 target

2. Traffic Capture and MITM Attack

Use tcpdump/tshark for traffic analysis and bettercap for ARP spoofing + credential sniffing.

# Capture traffic to file with BPF filter
tcpdump -i eth0 -w capture.pcap 'port 80 or port 443'

# Real-time HTTP request extraction
tshark -i eth0 -Y "http.request" -T fields -e http.host -e http.request.uri

# Start bettercap interactive session
bettercap -iface eth0
# Inside bettercap:
#   net.probe on
#   arp.spoof on
#   set arp.spoof.targets 192.168.1.50
#   http.proxy on

3. Service Enumeration and Lateral Movement

Use enum4linux and the impacket toolkit for deep Windows environment enumeration and lateral movement.

# Comprehensive SMB enumeration
enum4linux -a target

# Alternative: netexec (modern CME successor)
netexec smb 10.0.0.0/24 -u user -p pass --shares

# WMI remote command execution
impacket-wmiexec domain/user:password@target

# Pass-the-Hash with smbexec
impacket-smbexec -hashes :NTHASH domain/user@target

# Dump NTDS.dit remotely
impacket-secretsdump domain/admin:pass@DC -just-dc-ntlm

---

Common Pitfalls

• Scanning without proper authorization: Network scanning is detectable and can trigger IDS alerts or legal consequences. Always verify scope authorization before initiating any scan, and use cautious scan rates on sensitive production networks.
• Relying on a single scanning tool: Different tools discover different things. Nmap may miss hosts that arp-scan finds on the local subnet, and vice versa. Combine multiple tools and cross-reference results for comprehensive coverage.
• Ignoring UDP services: Most port scanning focuses on TCP, but critical services like DNS (53), SNMP (161), and DHCP (67) run over UDP. Use nmap -sU to scan UDP ports, though be aware that UDP scanning is significantly slower and less reliable than TCP scanning.

Automation and Scripting

Automate network reconnaissance with shell scripts that chain discovery tools together: arp-scan for live host discovery piped into nmap for service enumeration, with results parsed and stored in a structured format for later analysis. Use Python with scapy to craft custom protocol packets for targeted testing. Schedule periodic network scans with cron and compare results over time to detect unauthorized devices, new open ports, or configuration changes that may indicate compromise.

Reporting and Documentation

Network penetration test reports should include a network topology map showing discovered hosts, services, and trust relationships. Document each finding with the specific nmap or tool command used, the raw output, and the assessed risk level. Include a traffic capture summary (protocols, volumes, anomalies) and highlight any credentials or sensitive data intercepted during MITM testing. Map all findings to MITRE ATT&CK techniques for standardized communication with stakeholders.

Legal and Ethical Considerations

Network penetration testing involves active exploitation of network protocols and interception of traffic, which is regulated by law in most jurisdictions. Obtain explicit written authorization specifying the IP ranges, testing windows, and permitted attack types. MITM attacks and credential sniffing are particularly sensitive — ensure authorization specifically covers these activities. Never capture or store credentials from production networks without explicit approval, and always sanitize captured traffic of any unrelated sensitive data before including it in reports.

Integration with Other Tools

Network penetration testing naturally chains into multiple adjacent skills. Port scan results feed directly into vulnerability assessment (OpenVAS, Nuclei) for CVE identification. Extracted credentials from Responder or sniffing feed into password-attack skill for offline cracking. MITM findings inform application-layer testing (web XSS, SSRF) by revealing unencrypted internal communications. Use BloodHound for Active Directory graph analysis after enumerating SMB and LDAP services, and pivot to post-exploitation once initial access is obtained.

Case Studies and Examples

• Internal network assessment: An arp-scan revealed an undocumented legacy server on a supposedly decommissioned subnet. Nmap service enumeration showed it was running an unpatched SMB service (MS17-010 vulnerable). The server had domain admin credentials cached in memory, enabling full domain compromise via Pass-the-Hash.
• MITM credential harvesting: During an internal assessment, Responder captured NTLMv2 hashes from LLMNR poisoning. One hash belonged to a service account with local admin privileges on 47 workstations, enabling lateral movement across the entire floor.
• Firewall rule audit: By comparing nmap scan results from different network segments, identified that the firewall allowed unrestricted traffic between the DMZ and internal database VLAN, violating the documented network segmentation policy.

Detection Methods

Understanding how network attacks are detected helps testers operate more stealthily and helps defenders build better monitoring.

Network-Level Indicators

• Port scan patterns: SYN without ACK completion (nmap -sS), XMAS tree flags (FIN+URG+PSH), idle scan anomalies.
• Service fingerprinting: Repeated connections to multiple ports from same source IP within short window.
• Anomalous protocols: Unusual SMB/RPC traffic outside business hours; unexpected LLMNR/NBT-NS queries.
• MITM indicators: ARP table changes (>3/min on access switch), duplicate MAC addresses, ARP replies from non-DHCP server.

Host-Level Indicators

• Process anomalies: Unexpected nmap/masscan/wireshark binary execution on workstations.
• Network connections: New outbound connections to unknown IPs (correlate with threat intel).
• Log gaps: Suspicious gaps in /var/log/auth.log or Windows Event Log (often indicates anti-forensics).

SIEM Detection Rules

• Sigma rule: sigma/rules/network/net_scan_pattern.yml — detects nmap-typical patterns.
• ELK query: event.action:"connection_attempt" AND destination.port:<1024 GROUP BY source.ip HAVING count() > 20
• Splunk SPL: index=network sourcetype=firewall action=denied | stats count by src_ip | where count > 100
• Windows Event ID 4697: Service install from suspicious path (Responder indicator).

Defense Evasion Techniques

IDS/IPS Evasion

• Fragmented packets: nmap -f splits probe packets across IP fragments to bypass signature matching.
• Decoy scans: nmap -D RND:10 mixes real source with 10 random decoy IPs.
• Timing manipulation: nmap -T0 (paranoid) spreads probes over hours; -T1 (sneaky) over minutes.
• Custom payloads: Modify signature strings to avoid pattern matching (e.g., change nmap User-Agent).
• Idle scan: nmap -sI zombie:80 uses a zombie host as the apparent source.
• Source port manipulation: --source-port 53 or --source-port 88 exploits permissive firewall rules that allow DNS/Kerberos.

Logging Evasion

• Log injection: Modify /var/log/wtmp and /var/log/btmp to remove login records.
• Time-stomping: Change file timestamps with timestomp (Meterpreter) to match legitimate files.
• Clear specific events: Use wevtutil on Windows to delete specific Event IDs (requires admin).
• Memory-only execution: Use memfd_create() syscall to run tools without disk artifacts.

Tool Obfuscation

• Binary renaming: Rename nmap binary to avoid process-name detection (e.g., nmap → network_scanner).
• Static compilation: Compile tools statically to avoid dynamic library dependencies that may be monitored.
• Custom builds: Modify open-source tools to change signatures and behavior patterns.

MITM Stealth

• Selective ARP spoofing: Target only specific hosts rather than the entire subnet to reduce noise.
• Short TTL on spoofed entries: Refresh spoofed ARP entries less frequently to avoid detection.
• One-way MITM: Only poison client→server traffic (asymmetric) to halve the ARP traffic footprint.

Performance Considerations

Network scan performance depends heavily on the target environment and testing constraints. For large networks (/16 or larger), use nmap's host discovery mode (-sn) first to identify live hosts before running full port scans. Use --min-rate and --max-rate to control scan speed. For time-constrained engagements, prioritize the top 1000 ports (-F) over all 65535 ports. When capturing traffic with tcpdump, use BPF filters to capture only relevant protocols and avoid filling disk space with irrelevant data. Consider using tshark with display filters for real-time analysis instead of capturing everything and filtering later.

Tool Comparison Matrix

Tool	Best For	Speed	Stealth	Skill Level
nmap	Comprehensive scanning with scripts	Configurable (T0-T5)	Moderate with tuning	Beginner-Advanced
masscan	Fast full-port scans of large ranges	Extremely fast (10M pps)	Low (noisy)	Intermediate
rustScan	Fast port discovery + nmap integration	Very fast	Low	Beginner
tcpdump	Raw packet capture with minimal overhead	N/A (passive)	High (passive)	Intermediate
tshark	Deep protocol dissection (CLI Wireshark)	N/A (passive)	High (passive)	Advanced
bettercap	Interactive MITM with multiple modules	N/A (active)	Moderate	Advanced
Responder	Passive credential capture via poison protocols	N/A (passive)	High (passive)	Beginner
netexec	Windows network attack swiss army knife	Fast	Moderate	Intermediate

Hacker Laws

Law	Application in Network Penetration
Attack Surface Minimization	Every open port is a potential entry point. Use nmap scanning to enumerate the full attack surface; the defensive countermeasure is then to disable all unnecessary ports and services.
Defense in Depth	Networks cannot rely on firewalls alone. Requires layered defenses: IDS/IPS + encryption + authentication + segmentation. A single layer failing should not cause comprehensive compromise.
Trust but Verify	Never blindly trust any network data — ARP responses can be forged, DNS answers can be hijacked, SSL certificates can be spoofed. Always validate at multiple layers.
First Principles	Understand protocols at the packet level. Without understanding the TCP three-way handshake, you cannot understand SYN scanning. Without understanding ARP, you cannot understand MITM attacks.
Assume Breach	Design networks assuming the attacker is already inside. Build detection capabilities (traffic analysis, anomaly detection) and containment capabilities (network segmentation, microsegmentation).
Obscurity ≠ Security	Running SSH on a non-standard port does not provide security — nmap -sV trivially identifies service fingerprints regardless of port. Real security requires strong authentication and encryption.

---

Learning Resources

Skill supplementary files: payloads.md, test-cases.md

Related Skills: skills/post-exploitation/SKILL.md, skills/wifi-pentest/SKILL.md, skills/ad-ldap-attack/SKILL.md

External Resources:

• Nmap Official Documentation — Nmap reference guide, required reading.
• Nmap NSE Scripts — Complete script library with usage examples.
• Wireshark Wiki — tshark and Wireshark protocol analysis.
• Bettercap Official Documentation — MITM framework complete reference.
• Impacket GitHub — Windows network protocol Python library.
• tcpdump Manual Page — BPF filter syntax authoritative reference.
• MITRE ATT&CK Reconnaissance — Initial Access technique mapping.

Workspace notes: memory/tshark.md | memory/bettercap.md | memory/hping3.md | memory/arp-scan.md | memory/mtr.md | memory/zenmap.md