Network and Active Directory penetration testing
Assumed-breach testing of an internal network and Active Directory or Entra ID: privilege, credential exposure and lateral movement. The internet perimeter is a different engagement unless you add it.
- Human-led
- Every reported finding reproduced
- Retest included
-
Human testers leadTooling widens coverage only
-
Scoped firstScope and rules agreed before testing
-
Retest includedIn-scope fixes retested
-
Reproduced findingsEvidence a developer can replay
What we test
Assumed breach, stated plainly
Details
We begin where you tell us a real intrusion would begin: a standard domain user, a VPN session, or a host you provide. The objective is how far that position reaches.
Active Directory privilege
Details
Group membership, delegation, control paths and tiering mistakes that turn a user into an administrator. Written as a path, not a tool dump.
Credential exposure
Details
Secrets on shares, in scripts, in memory where the rules allow, and in legacy protocols you still run. We name the secret’s location and who could use it.
Trust and Entra ID
Domain trusts, hybrid sync and Entra roles when they are in scope.
Details
Domain trusts, hybrid sync and Entra roles when they are in scope. Hybrid is not assumed just because you use Microsoft 365.
Lateral movement
Which hosts a realistic position can reach, and which jump is noise.
Details
Which hosts a realistic position can reach, and which jump is noise. See the internal lateral-movement case study.
Services that matter
File servers, certificate services, backup, virtualisation admin and jump hosts.
Details
File servers, certificate services, backup, virtualisation admin and jump hosts. We do not boil the ocean of every printer.
Segmentation
Whether the network you described as separated still routes.
Details
Whether the network you described as separated still routes. A diagram is a hypothesis until a packet agrees.
Safety
Production impact is designed out.
Details
Production impact is designed out. No destructive payloads, no lockouts as a demo, and a live contact if something looks fragile.
About this scope
This page is the inside of the network. External hosts, VPN gateways and the internet edge are external infrastructure penetration testing unless the scope says both. Starting point here is usually a normal user, a compromised workstation, or a named foothold — not an invitation to scan the world.
Not the external perimeter
Read more
Buyers often ask for “network pentesting” and mean two different questions: what the internet can see, and what an insider or a phished laptop can do. PoCForge splits them so the rules, the starting point and the price stay clear. Book external when the question is exposure. Book this page when the question is identity and movement inside. Book both when you need the story end to end, and we will say so in one scope rather than pretend one checklist covers both.
A named red-team engagement, with detection goals and a longer premise, is quoted only when those goals are explicit. Otherwise this is a penetration test with an assumed-breach start, which is already enough for most internal reviews.
Deliverables
- Executive narrative of the assumed start and what it reached.
- Technical findings with evidence suitable for the identity and infrastructure owners.
- A note of domains, sites and accounts in scope.
- Retest results for paths you remediate in the window.
More about the report
A report can support SOC 2 and ISO 27001 evidence. It does not certify the company, and it does not replace the auditor. PoCForge is not a certification body and does not claim CERT-In empanelment. If a contract names an empanelled auditor, read when CERT-In empanelment is required and check the official list before you shortlist.
Who this fits
A good fit
- Organisations with Active Directory or a hybrid directory who need an internal answer for a board, a customer or an ISO programme.
- Multi-domain forests and several sites move the effort.
Worth knowing
- You do not need to hand over domain admin to begin.
- If the only assets are internet-facing SaaS with no internal network, this is the wrong page.
Investment
Indicative $4,500 – $8,000 before taxes. Multi-domain forests, many sites, or an explicit detection objective cost more. External perimeter work is additional. See the starting prices and the India network page.
TYPICAL INVESTMENT: $4.5K – $8K · taxes as applicable · final quote based on domain size and sites.
Coordination with the people who run the domain
Internal tests go badly when identity engineering hears about them on the day. Name a technical contact who can explain tiering, emergency access and which service accounts are fragile. Agree whether we may use a standard user you create, a workstation you image, or a VPN profile that lands where a remote employee lands. Exclude domain controllers from anything experimental. Certificate services, backup infrastructure and hypervisors are high value and easy to harm; they are listed as observe-and-prove or hands-off before we start.
Success is not a screenshot of the word administrator. Success is a path your team can break, from a starting position you believe is realistic, with the trusts and Entra roles that were actually in scope. If you also want detection goals — what the SOC should have seen — say that at scoping. That is a thicker engagement than a path-only test, and it is quoted as such rather than implied.
Multi-site organisations should say which sites are connected and which are decorative. A flat network you described as segmented is a finding only if we were allowed to check the route. We will not guess production impact from a diagram.
Scope and rules
- Starting position. The user, host or VPN profile we may use, plus out-of-scope servers and change windows.
- Rules and safety. Who to call, what must not be locked, and whether exploit attempts beyond proof-of-access are allowed.
- Map identity. Domains, trusts, privileged groups and the services those groups actually use.
- Walk the plausible paths. Privilege and movement with evidence. Stop when the objective is shown or the rules say stop.
- Report. The path, the fix that breaks it, and what was not tested.
- Retest. Closed paths are checked from the same class of starting position.
Internal AD lateral-movement pattern
Anonymised internal AD / identity engagement pattern: meaningful privilege paths versus scan noise, with remediation and retest framing.
Read the case study →- Human-led
- Every reported finding reproduced
- Retest included
Related
Frequently asked questions
Do you start with domain admin?
No. The useful start is a position an attacker could actually get. Domain admin as a starting gift hides the path you need to see.
Is the external perimeter included?
Not by default. External infrastructure is its own scope. We will combine them when you ask, with both rules written down.
Will this break production?
The design is to avoid outages and lockouts. Fragile systems are excluded or touched only in an agreed window with a contact online.
Can you include Entra ID?
Yes, when hybrid identity is in scope. It is not added automatically because the company uses Microsoft 365.
Do you claim CERT-In empanelment?
No. PoCForge does not claim CERT-In empanelment.
Scope an internal network test
Tell us the starting position, the directory, and whether the internet edge is in or out.
Request a free scope review →