Network Penetration Testing
Network penetration testing is an authorized assessment that probes reachable hosts, services, and trust paths to show which weaknesses can be combined into real access. It turns scanner observations into evidence about attack paths, impact, and remediation priorities.
itOffensive security and application security | OpenSkills.info
Intro
Network Penetration Testing
Network penetration testing is an authorized attempt to cross security boundaries in a defined network. A tester discovers reachable systems, identifies exposed services, validates selected weaknesses, and follows permitted paths to show what access is possible. The result is evidence about attack paths and business impact, not a list of every scanner alert.
Authorization is part of the technical design. A signed rules-of-engagement document defines target address ranges, source addresses, allowed techniques, testing windows, contacts, data-handling rules, and stop conditions. An address outside that boundary is not a target. A technique outside that boundary is not permitted, even when a tool makes it available.
The assessment system
A network test has four interacting parts:
- Test origin: the host, network segment, or remote location from which probes begin.
- Target scope: the approved systems, address ranges, services, identities, and exclusions.
- Controls and trust boundaries: firewalls, routers, virtual private networks, identity systems, segmentation rules, and monitoring controls that shape reachability.
- Evidence channel: notes, timestamps, packet captures, tool output, screenshots, and logs that connect each finding to a reproducible observation.
Continue the course
This section is part of the paid course.
See pricing to subscribe, or log in if you already have access.
Where this skill leads
Relevant careers
See how this topic contributes to broader role-level skill maps.
Sources
- https://csrc.nist.gov/pubs/sp/800/115/final
Supports
- Technical security assessment planning, execution, analysis, and mitigation
- Four-stage penetration-testing methodology of planning, discovery, attack, and reporting
- Iteration from attack back to discovery
- Penetration testing as vulnerability validation and demonstration of greater access
- Operational impact and the need to combine periodic tests with recurring scans
- Publication in September 2008 for the timeline
- https://tsapps.nist.gov/publication/get_pdf.cfm?pub_id=152164
Supports
- Rules-of-engagement scope, boundaries, signatures, test origin, allowed and forbidden activity, stop criteria, incident contacts, and cleanup
- External and internal test positions and iterative privilege or network access
- Claims and quiz answers about authorization, safety, evidence, reporting, and retesting
- https://www.pentest-standard.org/index.php/Main_Page
Supports
- Seven PTES sections from pre-engagement interactions through reporting
- Reference-path rationale for a complete engagement structure
- https://nmap.org/book/man.html
Supports
- Nmap as a network exploration and security-auditing tool
- Target specification, discovery, scan methods, service detection, timing, and output
- The address-to-service evidence chain in the course
- https://nmap.org/book/man-host-discovery.html
Supports
- Default discovery before port scanning
- ARP or Neighbor Discovery on local Ethernet and combinations of ICMP and TCP probes
- Effects of skipping host discovery and reasons a host may be missed
- https://nmap.org/book/man-port-scanning-basics.html
Supports
- Meanings and limits of open, closed, filtered, unfiltered, open or filtered, and closed or filtered states
- Quiz answer about filtered results
- https://nmap.org/book/man-version-detection.html
Supports
- Protocol-aware probes and response matching for service, application, version, device, and operating-system inference
- Limits of banners and port-number assumptions
- Quiz answer on why a service fingerprint is not exploitability proof
- https://nmap.org/book/scan-methods-udp-scan.html
Supports
- UDP silence and the open or filtered ambiguity
- Use of ICMP errors and version detection to refine UDP results
- Hero quiz answer about inconclusive UDP evidence
- https://nmap.org/book/history-future.html
Supports
- Nmap first release on 1997-09-01
- Operating-system detection in Nmap 2.00 on 1998-12-12
- First official Windows build on 2000-12-07
- Early service and version detection on 2003-07-21
- Timeline descriptions of how these functions broadened network assessment
- https://www.kali.org/docs/introduction/kali-linux-history/
Supports
- Whoppix release on 2004-08-30
- BackTrack 1 release on 2006-05-26 and its lineage from earlier distributions
- Kali succeeding BackTrack in 2013
- https://www.kali.org/blog/kali-linux-1-0-0-release/
Supports
- Kali Linux 1.0 release on 2013-03-13
- Debian-based rebuild and transition from BackTrack
- https://www.kali.org/docs/introduction/should-i-use-kali-linux/
Supports
- Intended audience and operational considerations for Kali Linux
- Final reference-path rationale
- https://docs.rapid7.com/metasploit/what-is-penetration-testing/
Supports
- Penetration testing as authorized attack simulation to identify security holes
- Reference-path rationale for platform-oriented methodology
- https://github.com/enaqx/awesome-pentest
Supports
- Discovery of Masscan, RustScan, Impacket, Ncrack, THC Hydra, Wireshark, and Scapy for Awesome Links
- Placement of those projects in network reconnaissance, authentication, protocol analysis, and network tooling categories
- https://github.com/robertdavidgraham/masscan
Supports
- Asynchronous wide-range port scanning, explicit rate controls, exclusions, and contrast with Nmap depth
- Masscan Awesome Links rationale
- https://github.com/bee-san/RustScan
Supports
- Fast port discovery, scripting, and Nmap handoff
- RustScan Awesome Links rationale
- https://github.com/fortra/impacket
Supports
- Python classes and examples for working with network protocols, including Windows-oriented protocols
- Impacket Awesome Links rationale
- https://nmap.org/ncrack/
Supports
- Network authentication testing across supported protocols
- Ncrack Awesome Links rationale
- https://github.com/vanhauser-thc/thc-hydra
Supports
- Parallel login testing across supported network protocols
- THC Hydra Awesome Links rationale
- https://www.wireshark.org/docs/
Supports
- Packet capture, protocol dissection, display filters, and inspection of raw network evidence
- Wireshark Awesome Links rationale and Landscape placement
- https://scapy.readthedocs.io/en/latest/introduction.html
Supports
- Packet creation, sending, receiving, matching, and protocol dissection
- Scapy Awesome Links rationale
- https://nmap.org/
Supports
- Nmap Landscape placement as discovery and enumeration
- https://www.kali.org/
Supports
- Kali Linux Landscape placement as an assessment platform
- https://www.rapid7.com/products/metasploit/
Supports
- Metasploit Landscape placement for exploit validation and session evidence
- https://www.coresecurity.com/products/core-impact
Supports
- Core Impact Landscape placement for commercial penetration-test automation and attack paths
- https://www.cobaltstrike.com/
Supports
- Cobalt Strike Landscape placement for post-exploitation and adversary simulation
- https://www.tenable.com/products/nessus
Supports
- Nessus vulnerability assessment, network penetration tester use case, and Landscape placement
- https://openvas.org/
Supports
- OpenVAS community scanner and Network Vulnerability Tests
- OpenVAS Landscape placement
- https://www.qualys.com/apps/vulnerability-management-detection-response
Supports
- Qualys asset discovery, assessment, prioritization, and Landscape placement