INFRASTRUCTURE PENETRATION TESTING
External and internal, black-box and gray-box testing, from perimeter breach to lateral movement, based on NIST SP800-115.
A single exposed service, a forgotten host in the DMZ, or one reused credential is the first step in a path that leads inward, from the perimeter to the servers and databases that actually matter. A vulnerability scanner will hand you a list of open ports and known CVEs, but it will not tell you which of those weaknesses an attacker can chain together into that path. Our infrastructure penetration test treats your network the way a real intruder would and proves the path from initial foothold to sensitive data.
External and internal testing
Infrastructure testing splits into two engagements, and a complete assessment usually runs both.
External infrastructure pentest
Attacks your network from the Internet, the way a remote attacker with no prior access would. We probe everything you expose at the perimeter: public services, the DMZ, remote-access endpoints, anything reachable from outside. We are looking for the weakness that gets us a foothold on the inside.
Internal infrastructure pentest
Starts from inside the intranet. It models a malicious insider, a contractor with network access, or an attacker who has already breached the perimeter (through a phished laptop, for example) and is now looking to expand. From that vantage point we test how far an intruder can move once the outer wall is behind them.
Run together, the two engagements tell one continuous story: breach the perimeter from the outside, establish a foothold, then expand into the internal network, reaching the server zone and database farm, attacking critical servers, and collecting the sensitive information an attacker would actually be after. The result is a demonstrated attack path that shows which weaknesses matter because they connect, and which do not.
How we work
Every engagement follows the same structure, framed by a clear pre-engagement agreement and closed by a report your team can act on. Before any packet is sent, we agree the objective, the scope, any compliance requirements the test must satisfy, and a shared understanding of the risk involved in testing production systems.
The active phases then run in order:
Reconnaissance & information gathering
We map the target: live hosts, exposed services, versions, network topology, and the trust relationships between systems. Nothing is attacked before it is understood.
Exploitation & initial compromise
We turn the weaknesses we found into a foothold (a misconfigured service, an unpatched host, a weak or default credential), establishing our first real access to the environment.
Privilege escalation & lateral movement
From that foothold we escalate privilege and move sideways: pivoting host to host, harvesting credentials, and working through the internal network toward the systems that hold real value. This is where the attack path is proven.
Achieving the agreed test objectives
We drive toward the goals set during scoping (reaching the server zone, compromising a domain, accessing the database farm, or extracting a defined set of sensitive data) and record exactly how we got there.
Once execution is complete, everything is written up in the reporting phase described below.
Active Directory and the internal estate
Most internal networks run on Microsoft Active Directory, and that is where an internal engagement earns its value. Once we have a foothold (even an unprivileged domain account), we enumerate the directory: users, groups, permissions, trust relationships, and the misconfigurations that accumulate as a domain ages. We then map the attack paths those relationships create, tracing the chain of small privileges that adds up to Domain Admin. A single over-permissioned service account, a stale delegation, or a cached credential on the wrong host is often all it takes to turn a standard login into full domain control. We prove that path host by host. Where the network is segmented, we test whether the segmentation holds, or whether a foothold in one zone reaches another.
How we limit risk
Testing production infrastructure carries real risk, and we manage it in the open. High-impact actions are agreed with you before we take them. If we find a critical vulnerability that should not wait for the final report, we tell you immediately so you can act. Any change we make to a production environment is controlled and recorded. Our tooling is a mix of open-source and licensed software (tested in our own lab and widely used in the security community), supplemented by custom scripts when a target needs a tailored approach; we do not run unreliable or untrusted tools against your systems.
Scope we agree up front
We fix the boundaries of the test with you before it starts, so there are no surprises, and you get a proposal with a fixed timeline and price.
Four dimensions define the engagement
- Location
External, testing from the Internet against your perimeter, or internal, testing from inside your intranet. Many clients scope both to cover the full attack path.
- Scenario
Black-box, where we begin knowing nothing but an IP range, simulating an external hacker; or gray-box, where you grant some access up front (typically a standard user account) to simulate a malicious employee or an attacker who already has a toehold. Gray-box reaches parts of the network black-box testing may never touch, and shows what a legitimate account can be turned into.
- Number of IP addresses
The count of in-scope hosts, agreed in advance, so the scope and the timeline are fixed and transparent.
- Revisit / retest
Whether a retest is included, so we can verify your fixes after remediation.
What you get
Every report contains, at minimum:
Executive summary
A business-level risk picture, suitable for management and auditors.
Findings by Risk Level
Each issue rated Critical, High, Medium, or Low, so remediation can be prioritised objectively.
Reproduction / POC for every finding
The exact steps to reproduce each finding, with proof.
Remediation guidance
Practical fixes tied to your environment.
Retest verification
When a revisit is in scope, findings are re-checked after your fixes and the report is updated to reflect closed items.
Every engagement to date has produced validated findings.
Team credentials
- OSCP
- OSCE
- CREST CRT
- CREST CPSA
- GIAC GREM
Testing is performed by our in-house team, with certifications earned through hands-on practical examination. See the full list of certifications the team holds.
Our methodology follows NIST SP800-115 (Technical Guide to Information Security Testing and Assessment), which structures the engagement from planning through discovery, attack, and reporting. Findings are rated by Risk Level and documented so your team can reproduce and close them.
Related services
Infrastructure testing rarely stands alone.
Web application penetration test
It pairs naturally with infrastructure testing for the services that sit on top of the network.
Penetration test
Both feed into a broader penetration test programme scoped to what your audits require.
Red teaming
To test how an adversary would combine people, process, and technology to reach your critical assets.
Security hardening
Once the report is in hand, security hardening closes the findings and brings the operating systems, network devices, and services underneath them to a documented baseline.
Last reviewed: 12 Oct 2026
Infrastructure Penetration Test
The objective, the scope and any compliance requirements are agreed before testing starts, and you receive a proposal with a fixed timeline and price.
Frequently asked questions
What is the difference between external and internal infrastructure testing?
An external infrastructure pentest attacks your network from the Internet, the way a remote attacker with no prior access would, probing public services, the DMZ, and remote-access endpoints for the weakness that gets a foothold. An internal pentest starts from inside the intranet, modelling a malicious insider or an attacker who has already breached the perimeter, and tests how far they can move. Run together, they tell one continuous story from perimeter breach to the database farm.
Do you test Active Directory?
Yes. Most internal networks run on Microsoft Active Directory, and that is where an internal engagement earns its value. From a foothold, even an unprivileged domain account, we enumerate the directory and map the attack paths its relationships create, tracing the chain of small privileges that adds up to Domain Admin. A single over-permissioned service account or stale delegation is often all it takes, and we demonstrate that path host by host.
What is the difference between black-box and gray-box testing?
For an infrastructure engagement the difference is where you start on the network. Black-box begins with nothing but an IP range, simulating an outsider who has just reached the perimeter. Gray-box hands us a standard domain user account up front, the toehold a phished employee or malicious insider already has, so we can test what that ordinary login escalates into across the internal estate. Gray-box reaches parts of the network black-box may never touch; many clients scope both to cover the full path from perimeter to Domain Admin.
How do you limit the risk of testing production infrastructure?
We manage it in the open. High-impact actions are agreed with you before we take them; if we find a critical vulnerability that should not wait for the final report, we tell you immediately. Any change to a production environment is controlled and recorded, and our tooling is tested in our own lab and widely used in the community, so nothing unreliable or untrusted is run against your systems.
Which standard do you follow?
NIST SP800-115 is a technical testing guide, not a compliance scheme, so it governs how the work is run and written up and does not produce a certificate. The report serves as audit evidence, and every finding carries a Risk Level and the steps to reproduce it. Tell us during scoping which audit the report has to answer to and we will structure the deliverable for it.
From our testers
ARTICLES/10 Aug 2026
Kerberos Delegation Attacks Part 1: Unconstrained Delegation
Kerberos Delegation ถูกสร้างมาเพื่อรองรับ multi-tier application แต่ trust relationship ที่ให้สิทธิ์สูงของมันก็เปิดช่องให้ attacker ปลอมเป็นผู้ใช้และทำ lateral movement ได้ถ้าตั้งค่าผิด
ARTICLES/27 Aug 2021
Pave the way to Domain Admins with BloodHound
ก่อนมี BloodHound การไล่หาเส้นทางสู่ Domain Admins กินเวลามาก บทความแสดงว่าเครื่องมือนี้ย่นขั้นตอนให้ pentester ได้อย่างไร
ARTICLES/7 Jun 2021
Remote Access Security Assessment
ช่วงการระบาดของ COVID-19 Incognito Lab เปิดให้องค์กรตรวจความมั่นคงปลอดภัยของระบบ Remote Access ผ่าน VPN โดยไม่คิดค่าใช้จ่าย บันทึกที่มาและขอบเขตของบริการนี้
Tell us where the test should start
External, internal or both, black-box or gray-box: we agree the starting point with you before any packet is sent.
