Contact
Phone & 24/7 emergency hotline+49 2932 465265-0 Emailinfo@rootsektor.deMon–Fri 8:00 a.m.–5:00 p.m. CET/CEST · outside business hours: 24/7 emergency hotline
Request a pentest quote Report an emergencyPenetration Testing
From the perimeter to the domain controller
How far would an attacker get – first from the internet, then inside your internal network? With network penetration testing, we assess firewalls and VPN, mail, and web servers as well as Active Directory and network segmentation, and show you the real attack paths to your critical systems.
Definition
In network penetration testing – often also called an infrastructure pentest – we carry out targeted attacks on your IT infrastructure on your behalf: servers, clients, network services, firewalls, and directory services. The test doesn’t stop at a list of theoretical weaknesses – we demonstrate which vulnerabilities can actually be exploited and where they would lead an attacker.
We distinguish between two starting points. From the outside, everything that is reachable from the internet counts – VPN gateways, mail and web servers, remote access, but also systems no one has on their radar anymore. From the inside, what counts is what happens after the first successful step: an attacker is already in the corporate network – via a phishing email, a compromised laptop, or as a malicious insider. How far can they get from there?
It’s especially on the inside that you see how vulnerable an organization really is. Many ransomware attacks follow the same pattern: initial access, lateral movement through the network, takeover of Active Directory, and encryption of servers and backups. An internal pentest shows where you can break this chain – through hardening, better segmentation, and clean privilege management.
Our approach is based on the penetration testing guideline of the BSI (Germany’s Federal Office for Information Security), PTES, OSSTMM, and NIST SP 800-115; we map attack techniques to MITRE ATT&CK. The results support your evidence under Art. 32 GDPR, ISO/IEC 27001:2022 (Annex A 8.8 and 8.20 to 8.22), NIS2, DORA, or PCI DSS 4.0.1 (Requirement 11.4). As a company that is independent of vendors and service providers, we assess your infrastructure objectively.
Our approach
It all starts with the question of what an attacker sees. Externally, we map your public IP ranges, DNS records, subdomains, and certificates and identify reachable services and their versions. Internally, we start from a realistic position – a network port in the office, a standard user account, or a prepared client – and map networks, systems, shares, and the relationships in your Active Directory.
Automated scans only provide leads. We verify every relevant finding manually, rule out false positives, and chain individual vulnerabilities into attack paths: from an intercepted password hash via a poorly protected service account all the way to domain admin rights. Our certified pentesters proceed in a controlled manner – we agree on risky steps on critical systems with you in advance.
Common vulnerabilities
Edge devices with known, unpatched vulnerabilities are among the preferred entry points because they are directly reachable from the internet. If multi-factor authentication is also missing, a guessed or leaked password is all it takes to get into the corporate network.
RDP, SMB, databases, or the admin interfaces of firewalls, hypervisors, and NAS systems are reachable from the internet even though no one needs them there. Attackers search automatically for exactly these services and try default passwords and known exploits.
When a Windows machine queries an unknown name via LLMNR or NBT-NS, any device on the same network segment can respond – including an attacker’s. The machine then authenticates to it and hands over NTLM hashes that can be cracked offline. If SMB signing isn’t enforced or LDAP signing and channel binding are missing, the attacker can even relay these authentications directly to other systems.
Accounts with a service principal name and a weak password can be cracked offline via Kerberoasting, and accounts without Kerberos pre-authentication via AS-REP roasting. Service accounts in particular often have far-reaching privileges.
Insecure certificate templates allow a regular user account to request certificates for arbitrary identities – up to and including domain administrator. Coerced authentications from domain controllers can sometimes be relayed to the certificate authority as well.
Without LAPS (Local Administrator Password Solution), many machines share the same admin password. A single compromised client then opens the way to all the others via pass-the-hash.
Passwords in logon scripts, configuration files, spreadsheets, or old Group Policies are often readable by all domain users on network drives or in SYSVOL.
If clients, servers, production systems, and management interfaces sit on the same network or firewall rules are too permissive, an attacker can spread almost unhindered.
Test types
Each test type can be ordered individually. They’re most effective in combination, because real attacks combine an entry from outside with lateral movement inside.
External
We attack your infrastructure from the internet – just as an attacker would who specifically targets your company.
Internal · Assumed breach
We start inside the network – with a network port, a standard account, or a prepared client – and test how far an attacker can get from there.
Segmentation
We verify whether your network zones are actually separated the way your network design intends.
Process
An infrastructure pentest touches your live operations. That’s why we plan every step transparently and with clear agreements – following our proven approach to penetration testing.
We define IP ranges, sites, the starting point for the internal test, testing windows, exclusions, and contacts for questions during the test. You receive your fixed-price quote within 24 hours of scoping (on business days).
Externally, we map your attack surface; internally, we map networks, systems, services, shares, and permission structures in Active Directory.
We combine automated scans with manual verification, filter out false positives, and assess every finding in the context of your environment.
We exploit vulnerabilities in a controlled manner, chain them together, and demonstrate lateral movement and privilege escalation – as far as the agreed rules of engagement allow.
You receive an executive summary, findings with CVSS ratings, documented attack paths, and prioritized measures. On request, we present the results to your team.
Once you’ve remediated the findings, we retest the affected vulnerabilities free of charge. After the test is complete, you also receive a test certificate.
Reporting
An infrastructure pentest often produces a long list of findings. What matters is what needs fixing first. Our report rates every finding using CVSS and by its role in the attack path, and it distinguishes quick, immediate fixes from structural improvements such as a tiering model for administrative accounts.
A pentest gives you the answer – with concrete evidence and a clear plan for the next steps. Request your fixed-price quote now.
FAQ
Didn’t find your question? Call us at +49 2932 465265-0 or email info@rootsektor.de.
The two tests answer different questions. The external test determines whether an attacker on the internet can find a way in at all – through an unpatched VPN gateway or an open remote access point, for example. The internal test starts where the external one ends: it assumes successful initial access and shows which systems, data, and privileges can be reached from there – up to and including a takeover of Active Directory.
In most cases, yes. An external test alone leaves open what happens after a successful phishing attack; an internal test alone says nothing about the attack surface of your perimeter. If your budget is limited, we’ll advise you on which perspective makes the most sense first for your risk situation.
In an assumed breach scenario, we assume that an attacker already has a foot in the door – for example, via a compromised laptop or a stolen user account. Instead of spending time on initial access, the test focuses on what happens next. That’s realistic, because phishing and stolen credentials are common ways in.
Yes. We perform the internal test either on site or remotely – via VPN access or a provided, preconfigured test system in your network. For segmentation tests at multiple sites or in production environments, an on-site visit can make sense – we work for you in Germany and internationally.
No. A vulnerability scan finds known vulnerabilities automatically and is suited to ongoing monitoring – for example, with solutions from our partner Greenbone. A penetration test goes further: we check manually whether findings can be exploited and chained together, and we uncover misconfigurations that no scanner detects. Learn more on our vulnerability assessment page.
We work in a controlled manner and agree on testing windows, exclusions, and contacts in advance. We don’t perform denial-of-service tests unless they are explicitly agreed, and risky steps on critical systems only take place after consultation. For sensitive environments such as production networks, we plan with particular care.
We recommend at least one test per year plus additional assessments after major changes, such as a firewall migration, a new VPN solution, changes to Active Directory, or an acquisition. PCI DSS 4.0.1, for example, requires internal and external penetration tests at least every twelve months and after significant changes.
The price depends on the number of IP addresses and sites, the size of your Active Directory, and the depth of testing you need. After scoping, you receive a fixed-price quote within 24 hours (on business days) – with no hidden costs and including a free retest.
Tell us which sites, systems, and goals you have in mind. We’ll get back to you to arrange a no-obligation initial consultation and send you a fixed-price quote within 24 hours of scoping (on business days).
Diese Seite gibt es auch auf Deutsch.