01 Network Pentesting Labs

Lab Track Overview

Welcome to the Network Pentesting Labs track.

This lab series is designed to develop the practical methodology expected from a penetration tester assessing enterprise networks in an authorized environment.

The objective is not to memorize scanning commands or jump directly into exploitation.

The objective is to learn how to move through a structured network assessment:

Scope → Discover → Enumerate → Analyze → Validate → Correlate → Evidence → Report

These labs should be performed only against:

• systems you own

• explicitly authorized lab environments

• intentionally vulnerable training systems

• isolated virtual networks

The core principle throughout the track is:

Methodology first. Tools second. Evidence always.

What You Will Learn

Across this lab track, you will practice:

• defining network pentest scope

• identifying live hosts

• mapping network topology

• scanning TCP and UDP services

• identifying operating systems and technologies

• enumerating exposed services

• analyzing network attack surfaces

• reviewing authentication exposure

• identifying weak network services

• assessing segmentation

• validating vulnerabilities safely

• documenting findings

• correlating multiple weaknesses into attack paths

• prioritizing remediation

• producing a professional penetration testing report

Network Pentesting Methodology

Use this sequence throughout the labs:

Scope
  ↓
Network Discovery
  ↓
Host Identification
  ↓
Port Discovery
  ↓
Service Identification
  ↓
Enumeration
  ↓
Vulnerability Analysis
  ↓
Controlled Validation
  ↓
Segmentation Assessment
  ↓
Attack-Path Analysis
  ↓
Evidence
  ↓
Reporting

Or more simply:

Discover → Enumerate → Analyze → Validate → Report

Recommended Lab Architecture

A safe training environment can contain:

                   Isolated Pentest Network
                           │
          ┌────────────────┼────────────────┐
          │                │                │
          ▼                ▼                ▼
   Pentest Workstation   Linux Target   Windows Target
          │
          │
          ├──────────────► Web Target
          │
          └──────────────► Network Services

For more advanced labs:

                    Pentest Workstation
                           │
                           ▼
                       DMZ Network
                           │
                 ┌─────────┴─────────┐
                 ▼                   ▼
              Web Server         Gateway
                                     │
                                     ▼
                               Internal Network
                                │           │
                                ▼           ▼
                             Windows      Linux

Avoid exposing intentionally vulnerable systems directly to the Internet.

Network Pentesting Labs — Recommended Sequence

I recommend keeping this track to 15 focused labs.

Lab	Title	Primary Skill
01	Build Your Network Pentesting Lab	Environment Setup
02	Network Discovery & Host Identification	Reconnaissance
03	TCP Port Scanning & Service Discovery	Network Mapping
04	UDP Service Discovery	UDP Enumeration
05	Network Service Enumeration	Enumeration
06	Vulnerability Assessment & Finding Validation	Vulnerability Analysis
07	Authentication & Remote Access Assessment	Access Security
08	SMB & Windows Network Service Assessment	Windows Networking
09	Linux Network Service Assessment	Linux Services
10	DNS & Network Infrastructure Assessment	Infrastructure Security
11	Network Traffic & Protocol Security Assessment	Packet Analysis
12	Network Segmentation & Access Control Assessment	Segmentation
13	Network Attack-Path Analysis	Attack-Path Modeling
14	Vulnerability Validation & Pentest Reporting	Evidence & Reporting
15	Enterprise Network Pentesting Capstone	End-to-End Assessment

Lab 01 — Build Your Network Pentesting Lab

Students build an isolated environment containing:

• pentest workstation

• Linux target

• Windows target

• intentionally vulnerable service host

• optional router/firewall VM

Primary learning objectives:

• lab isolation

• IP addressing

• network interfaces

• VM connectivity

• snapshots

• safe authorization boundaries

• evidence folders

Outcome:

A reusable, isolated network pentesting environment.

Lab 02 — Network Discovery & Host Identification

Students learn how to determine:

What systems actually exist on the authorized network?

Practice areas:

• network range identification

• ARP-based discovery

• ICMP behavior

• host availability

• discovery limitations

• MAC-address observations

• device inventory

Primary deliverable:

Network Asset Register

Host ID	IP	MAC	Status	Initial Role

Outcome:

A documented map of discovered systems.

Lab 03 — TCP Port Scanning & Service Discovery

This lab introduces systematic TCP assessment.

Students investigate:

• open ports

• closed ports

• filtered ports

• common service ports

• service identification

• banner information

• scanning accuracy

• false assumptions based on port numbers

Primary question:

Which TCP services are exposed by each discovered host?

Deliverables:

• Port Register

• Service Register

• screenshots/evidence

• preliminary attack-surface map

Lab 04 — UDP Service Discovery

Students learn why UDP assessment differs from TCP.

Practice areas include:

• UDP behavior

• common UDP services

• timeout interpretation

• open vs open/filtered

• DNS

• SNMP concepts

• DHCP awareness

• NTP exposure

Important principle:

No response does not automatically mean no service exists.

Outcome:

A combined TCP/UDP network-service inventory.

Lab 05 — Network Service Enumeration

This lab moves beyond ports.

Students examine case-relevant services such as:

• SSH

• HTTP/HTTPS

• SMB

• FTP

• DNS

• SMTP

• database listeners

• remote administration interfaces

For each service:

Host:

Port:

Protocol:

Service:

Version:

Authentication:

Encryption:

Information Exposure:

Potential Security Concern:

Outcome:

A detailed service-level attack-surface inventory.

Lab 06 — Vulnerability Assessment & Finding Validation

Students now transition from enumeration to analysis.

Practice areas:

• vulnerability scanning concepts

• version-based vulnerability research

• configuration weaknesses

• scanner false positives

• vulnerability confirmation

• evidence quality

• CVSS context

• environmental impact

Key principle:

Scanner Alert
     ≠
Confirmed Vulnerability

Students learn to classify:

Observation

Potential Vulnerability

Validated Finding

False Positive

Needs Further Review

Lab 07 — Authentication & Remote Access Assessment

Focus on how services protect access.

Assess:

• SSH

• RDP

• VPN-style access concepts

• web administration

• exposed management services

• account lockout

• default configurations

• anonymous access where intentionally configured

• transport security

• administrative exposure

This lab should use only supplied or authorized test accounts.

No password cracking is required.

Primary question:

Are exposed authentication services configured and restricted appropriately?

Lab 08 — SMB & Windows Network Service Assessment

Students investigate Windows-oriented network exposure.

Topics:

• SMB discovery

• Windows host identification

• SMB signing concepts

• exposed shares

• permissions

• anonymous/guest exposure in training scenarios

• administrative shares

• legacy protocols

• Windows service exposure

Evidence Register:

Host	Share/Service	Access	Observation	Risk

Focus on security posture, not uncontrolled exploitation.

Lab 09 — Linux Network Service Assessment

Students assess exposed Linux network services.

Possible areas:

• SSH

• web services

• file transfer services

• NFS

• databases

• remote administration

• service banners

• encryption

• access restrictions

Primary objective:

Determine whether Linux services expose unnecessary information, weak access controls, or excessive network reachability.

Lab 10 — DNS & Network Infrastructure Assessment

Students investigate infrastructure-level exposure.

Topics include:

• DNS server identification

• forward/reverse lookup concepts

• resolver exposure

• DNS records

• name-resolution leakage

• infrastructure naming

• authoritative vs recursive DNS concepts

• zone-transfer risk conceptually in the authorized lab

• network-device management exposure

Primary deliverable:

Infrastructure Exposure Register

Asset	Service	Observation	Impact	Recommendation

Lab 11 — Network Traffic & Protocol Security Assessment

This lab introduces packet-level thinking from a penetration-testing perspective.

Students examine controlled lab traffic for:

• plaintext protocols

• encrypted protocols

• DNS

• HTTP

• TLS

• authentication exposure

• insecure data transmission

• protocol metadata

Key distinctions:

Traffic Visible
     ≠
Sensitive Data Exposed

and:

Encryption Present
     ≠
Configuration Secure

Students learn how packet observations can become defensible findings.

Lab 12 — Network Segmentation & Access Control Assessment

One of the most important enterprise network pentesting labs.

Scenario:

User Network
     │
     ▼
Firewall / ACL
     │
     ▼
Server Network
     │
     ▼
Management Network

Students determine:

• which zones can communicate

• expected paths

• unexpected paths

• blocked services

• permitted services

• management exposure

• segmentation weaknesses

Build a matrix:

Source Zone	Destination Zone	Service	Expected	Observed
User	Web	HTTPS	Allow	Allow
User	Database	DB	Deny	?
User	Management	SSH/RDP	Deny	?

This is excellent preparation for enterprise pentesting.

Lab 13 — Network Attack-Path Analysis

This lab moves beyond isolated findings.

Students connect weaknesses.

Example:

Exposed Service
      ↓
Weak Configuration
      ↓
Excessive Network Access
      ↓
Sensitive Internal Service
      ↓
Potential Business Impact

Students create an Attack Path Register:

Step	Asset	Condition	Evidence	Impact
1	Host A	Exposed service
2	Host B	Reachable internally
3	DB	Excessive access

The focus is not exploitation.

The focus is:

How multiple individually moderate weaknesses create higher enterprise risk when combined.

Lab 14 — Vulnerability Validation & Pentest Reporting

Students take discovered issues and turn them into professional findings.

Each finding should contain:

Finding ID

Title

Affected Asset

Description

Evidence

Security Impact

Likelihood

Severity

Validation Status

Remediation

Retest Guidance

Students should distinguish:

Scanner Output
      ≠
Evidence

A screenshot of a scanner alert alone is not enough.

Evidence should demonstrate the actual condition.

Lab 15 — Enterprise Network Pentesting Capstone

This is the final network pentesting lab.

Students receive an authorized enterprise-style environment containing:

External/DMZ
     │
     ▼
Web / Gateway
     │
     ▼
User Network
     │
     ▼
Server Network
     │
     ├── Windows Services
     ├── Linux Services
     └── Internal Application

They must conduct:

Scope
   ↓
Discovery
   ↓
Port Mapping
   ↓
Service Enumeration
   ↓
Vulnerability Analysis
   ↓
Authentication Assessment
   ↓
Windows/Linux Service Review
   ↓
Infrastructure Assessment
   ↓
Segmentation Validation
   ↓
Attack-Path Analysis
   ↓
Evidence Collection
   ↓
Risk Prioritization
   ↓
Professional Report

The final question becomes:

“What network weaknesses exist, which ones are actually validated, how can they combine into meaningful attack paths, and what should the organization remediate first?”

Evidence Standards for Every Lab

Each lab should maintain:

Network-Pentesting-Labs/
└── Lab-XX/
    ├── Scope/
    ├── Notes/
    ├── Discovery/
    ├── Enumeration/
    ├── Evidence/
    ├── Screenshots/
    ├── Findings/
    └── Report/

Every important action should answer:

What was tested?

Why was it tested?

What was observed?

What evidence supports it?

What does it mean?

What should happen next?

Finding Classification

Use four levels throughout the track:

Observation

Something interesting was identified.

Potential Vulnerability

Evidence suggests a security weakness.

Validated Finding

The condition has been safely confirmed.

Attack Path

Multiple validated conditions combine into a meaningful security risk.

Evidence Register

Recommended:

ID	Host	Service	Observation	Validation	Finding
NET-001
NET-002

Network Pentest Journal Template

# Network Pentest Lab Journal

## Mission Objective

## Authorization and Scope

## Environment

## Network Range

## Discovery

## Host Inventory

## TCP Services

## UDP Services

## Enumeration

## Authentication Assessment

## Vulnerability Analysis

## Validation

## Segmentation

## Attack Paths

## Evidence

## Findings

## Limitations

## Remediation

## Conclusion

Professional Network Pentesting Mindset

Avoid:

Scan → Exploit → Move On

Instead use:

Question
   ↓
Technique
   ↓
Observation
   ↓
Evidence
   ↓
Interpretation
   ↓
Validation
   ↓
Impact
   ↓
Recommendation

For example:

Question:
Can the user network reach the database directly?

Technique:
Authorized connectivity assessment.

Observation:
Database service responds from the user segment.

Evidence:
Connection evidence and segmentation matrix.

Interpretation:
Expected network isolation is not enforced.

Finding:
Excessive inter-segment database reachability.

Impact:
A compromised user endpoint could directly communicate with a
sensitive database service.

Recommendation:
Restrict database access to approved application systems.

That is a professional penetration-testing finding.

Network Pentesting Labs — Final Structure

Network Pentesting Labs
│
├── 01 Build Your Network Pentesting Lab
├── 02 Network Discovery & Host Identification
├── 03 TCP Port Scanning & Service Discovery
├── 04 UDP Service Discovery
├── 05 Network Service Enumeration
├── 06 Vulnerability Assessment & Finding Validation
├── 07 Authentication & Remote Access Assessment
├── 08 SMB & Windows Network Service Assessment
├── 09 Linux Network Service Assessment
├── 10 DNS & Network Infrastructure Assessment
├── 11 Network Traffic & Protocol Security Assessment
├── 12 Network Segmentation & Access Control Assessment
├── 13 Network Attack-Path Analysis
├── 14 Vulnerability Validation & Pentest Reporting
└── 15 Enterprise Network Pentesting Capstone

This gives the Academy a clean progression:

Environment → Discovery → Ports → Services → Vulnerabilities → Authentication → Infrastructure → Segmentation → Attack Paths → Reporting → Enterprise Capstone

What’s Next?

➡️ Lab 01 — Build Your Network Pentesting Lab

We can make Lab 01 the foundation for all remaining network pentesting exercises, including the exact isolated topology, Kali/attacker workstation, Windows/Linux training targets, network addressing plan, evidence workspace, connectivity verification, snapshots, scope document, and final readiness checklist.