Network Pentester

When to Use

• Plan or execute authorized external or internal network and infrastructure assessments
• Draft or validate rules of engagement, asset lists, test windows, and emergency stop procedures
• Perform host and service enumeration, banner/version correlation, and manual validation of scanner output
• Test network services (SSH, RDP, SMB, LDAP, databases, management planes) within agreed impact
• Document Active Directory attack paths, credential exposure, and in-scope lateral movement
• Validate segmentation, firewall rules, and east-west controls between zones
• Apply high-level wireless assessment methodology when explicitly scoped
• Produce remediation-focused reports and retest critical/high network findings

When NOT to Use

• OWASP web app, API, or session/auth testing → web-pentester
• Cross-engagement pentest program when network is not the primary specialty → penetration-tester
• Jailbreak LLMs, prompt injection, or agent tool abuse → ai-redteam
• Lead red team campaigns, purple team, or detection validation programs → red-team-specialist
• Triage SIEM/EDR alerts or SOC playbooks → soc-analyst
• Lead live incident command or war-room comms → incident-responder
• Implement IAM, WAF, SIEM, or cloud org guardrails → information-security-engineer, cloud-security-engineer
• Provision VPCs, clusters, or IaC without offensive testing → infrastructure-engineer

Related skills

Core Workflows

1. Scope and authorization

Do not test without written authorization.

1. Confirm signed SOW/ROE: IP ranges, hostnames, AD domains, methods, windows, contacts
2. Define out-of-scope (third parties, production PII, DoS unless approved, out-of-window systems)
3. Agree severity rubric, evidence handling, and credential/data minimization
4. Establish emergency stop and escalation path
5. Prefer isolated lab VLANs, jump hosts, or designated test forests when possible

See references/networkpentesterscope.md and references/scopingandrulesofengagement.md.

2. Enumeration and service testing

asset inventory → live host discovery → port/service ID → version & config review → validate findings

Document source, timestamp, tool, and raw output references. Validate automated scanner results manually before reporting.

See references/enumerationandservice_testing.md.

3. AD, lateral movement, and segmentation (in scope only)

• Map identity attack paths only per ROE (domain admin is not a default goal unless scoped)
• Document lateral movement with minimal PoC; redact secrets in evidence
• Test segmentation between zones; record allowed vs denied paths with packet/trace proof when useful
• Wireless: methodology and safe testing only when scoped—see segmentation/wireless reference

See references/activedirectoryandlateralmovement.md and references/segmentationwirelessand_external.md.

4. Reporting, remediation, and retest

Per finding: title, severity, impact, reproduction, evidence, remediation, retest criteria. Deliver executive summary + technical appendix; schedule retest for critical/high.

See references/reportingretestsafe_practices.md.

When to load references