Lab 15 Enterprise Network PenTesting Capstone

Mission Overview

Welcome to the final lab in the Network Pentesting Labs track.

This capstone brings together the complete methodology from Labs 01–14 into one enterprise-style assessment.

You will not treat this as a collection of disconnected technical tasks. Instead, you will work through a complete professional workflow:

Scope → Discover → Enumerate → Analyze → Validate → Assess Trust → Model Attack Paths → Evidence → Report

The goal is to demonstrate that you can perform an authorized network penetration test from beginning to end while maintaining:

clear scope
disciplined methodology
minimal-impact validation
evidence integrity
defensible findings
business context
remediation quality
professional reporting

Mission Goal: Conduct a complete authorized network penetration test against the isolated enterprise lab, validate meaningful security weaknesses, analyze trust relationships and attack paths, and deliver a professional penetration-testing report.

Mission Information

Item	Details
Difficulty	Advanced
Estimated Time	4–6 hours
Primary Skill	End-to-End Network Penetration Testing
Secondary Skill	Evidence-Based Security Assessment
Environment	GoHackersCloud Enterprise Network Pentesting Lab
Assessment Type	Internal Network Penetration Test
Primary Outcome	Complete Enterprise Pentest Deliverable
Safety Level	Authorized Isolated Lab Only

Capstone Objectives

By completing this capstone, you should be able to independently perform:

rules-of-engagement preparation
network scoping
asset discovery
network mapping
TCP service discovery
UDP service discovery
service enumeration
vulnerability assessment
manual finding validation
authentication assessment
Windows network-service assessment
Linux network-service assessment
infrastructure-service assessment
packet and protocol analysis
segmentation validation
trust-boundary analysis
attack-path modeling
risk prioritization
remediation planning
executive reporting

Capstone Methodology

Use the complete workflow:

Authorization
      ↓
Scope
      ↓
Asset Discovery
      ↓
Network Mapping
      ↓
Port Discovery
      ↓
Service Enumeration
      ↓
Vulnerability Analysis
      ↓
Controlled Validation
      ↓
Authentication Assessment
      ↓
Windows / Linux Assessment
      ↓
Infrastructure Assessment
      ↓
Traffic Analysis
      ↓
Segmentation Assessment
      ↓
Attack-Path Analysis
      ↓
Finding Validation
      ↓
Risk Prioritization
      ↓
Reporting

The governing principle remains:

Methodology first. Tools second. Evidence always.

Enterprise Lab Scenario

You have been engaged to assess a simulated enterprise network.

The organization contains several security zones.

Example topology:

                         Internet
                            │
                            ▼
                           DMZ
                            │
                       ┌────┴────┐
                       │         │
                     WEB01     VPN01
                       │
                       ▼
                Application Network
                       │
                      APP01
                       │
                       ▼
                  Database Tier
                       │
                      DB01


User Network
     │
     ├────────► WEB01
     │
     └────────► Internal Services


Management Network
     │
     ├────────► Linux Servers
     ├────────► Windows Servers
     ├────────► Database
     └────────► Infrastructure


Guest Network
     │
     └────── X ──────► Internal Networks

Your actual lab may use a simpler topology.

Suggested Lab Addressing

Example only:

Asset	IP	Role
Pentest Workstation	`192.168.56.10`	Assessment system
Linux01	`192.168.56.20`	Linux server
WIN01	`192.168.56.30`	Windows server
DNS01	`192.168.56.40`	DNS/NTP
DB01	`192.168.56.50`	Database
MGMT01	`192.168.56.60`	Management

Only use the addresses assigned to your authorized lab.

Phase 1 — Engagement Preparation

Step 1 — Create the Capstone Workspace

Create:

Network-Pentesting-Labs/
└── Lab-15-Capstone/
    ├── 01-Scope/
    ├── 02-Asset-Discovery/
    ├── 03-Network-Mapping/
    ├── 04-TCP-Scanning/
    ├── 05-UDP-Scanning/
    ├── 06-Enumeration/
    │   ├── SSH/
    │   ├── HTTP-HTTPS/
    │   ├── SMB/
    │   ├── DNS/
    │   ├── NFS/
    │   ├── RPC/
    │   └── Databases/
    ├── 07-Vulnerability-Assessment/
    ├── 08-Authentication/
    ├── 09-Windows/
    ├── 10-Linux/
    ├── 11-Infrastructure/
    ├── 12-Traffic/
    ├── 13-Segmentation/
    ├── 14-Attack-Paths/
    ├── 15-Evidence/
    │   ├── Raw/
    │   ├── Validated/
    │   └── Redacted/
    ├── 16-Findings/
    ├── 17-Remediation/
    └── 18-Final-Report/

Step 2 — Define Rules of Engagement

Create:

01-Scope/Rules-of-Engagement.md

Document:

Assessment:
Enterprise Network Penetration Test

Authorized Network:

Authorized Assets:

Authorized Source Systems:

Assessment Window:

Testing Team:

Allowed:
- host discovery
- controlled TCP/UDP scanning
- service enumeration
- approved vulnerability scanning
- non-destructive manual validation
- supplied-account authentication testing
- packet analysis of generated lab traffic
- segmentation validation
- evidence collection

Not Allowed:
- public targets
- denial-of-service
- destructive exploitation
- credential spraying
- brute force
- leaked credentials
- persistence
- malware deployment
- data destruction
- unrelated sensitive-data collection

Step 3 — Create Stop Conditions

Stop immediately if:

an unknown production system appears
the scope appears incorrect
public infrastructure is reached
a test destabilizes a target
sensitive non-lab information appears
authorization is unclear

Use:

Stop → Verify → Continue only when authorization is clear.

Step 4 — Create an Assessment Journal

TIME:

PHASE:

TARGET:

ACTION:

PURPOSE:

COMMAND / METHOD:

RESULT:

EVIDENCE ID:

NOTES:

Record significant actions throughout the capstone.

Phase 2 — Asset Discovery

Step 5 — Verify Your Assessment Host

Confirm your lab interface:

ip addr

Review routing:

ip route

Record:

Assessment IP:

Lab Interface:

Authorized Subnet:

Default Route:

Lab Route:

Step 6 — Discover Authorized Hosts

Use the host-discovery methodology from Lab 02.

For an authorized training subnet:

nmap -sn 192.168.56.0/24

Save:

nmap -sn 192.168.56.0/24 -oN 02-Asset-Discovery/host-discovery.txt

Do not expand into adjacent networks.

Step 7 — Review Local Neighbor Information

Use:

ip neigh

Compare:

Expected Assets
      versus
Discovered Assets

Step 8 — Build the Asset Register

Asset ID	IP	MAC	Hostname	Expected	Status
A-01				Yes	Active
A-02				Yes	Active

Classify:

Confirmed Active
Active — Limited Response
Expected but Not Observed
Unexpected
Unverified

Phase 3 — Network Mapping

Step 9 — Build the Initial Network Map

Example:

Pentest Workstation
        │
        ▼
     Lab Network
     /    |    \
 Linux  Windows DNS
   │       │
   └──► Database

Add:

IP addresses
roles
zones
known communication relationships

Step 10 — Identify Security Zones

Create:

Zone	Systems	Purpose
User		End users
Server		Workloads
Database		Data
Management		Administration
Infrastructure		DNS/NTP/SNMP
Guest		Low trust

Phase 4 — TCP Service Discovery

Step 11 — Perform Targeted TCP Discovery

Based on expected services:

nmap -p 21,22,80,443,445,3389,3306,5432 <authorized-host>

Step 12 — Perform Standard TCP Discovery

nmap <authorized-host>

Save every output.

Step 13 — Perform Full TCP Port Discovery Where Required

Against one authorized lab host at a time:

nmap -p- <authorized-host>

The goal is completeness, not aggressive timing.

Step 14 — Identify Services

For discovered ports:

nmap -sV -p <known-ports> <authorized-host>

Remember:

Port Number ≠ Confirmed Service

Step 15 — Build the TCP Service Register

Host	Port	State	Service	Version Confidence

Phase 5 — UDP Discovery

Step 16 — Identify Important UDP Services

Focus on relevant infrastructure services.

Example:

sudo nmap -sU -p 53,69,123,137,138,161 <authorized-host>

Step 17 — Validate UDP Services

Where required:

sudo nmap -sU -sV -p 53,123,161 <authorized-host>

Remember:

UDP silence is ambiguous.

Step 18 — Build the UDP Service Register

Host	Port	State	Likely Service	Confidence

Phase 6 — Service Enumeration

Step 19 — Create the Enumeration Queue

Rank discovered services.

Example:

Priority	Service	Reason
High	SSH	Management
High	SMB	File/Auth
High	RDP	Management
High	DB	Sensitive data
Medium	HTTP	Application
Medium	DNS	Infrastructure

Step 20 — Enumerate SSH

Identify:

version
authentication requirement
expected exposure
network restrictions
supplied-account access where authorized

No password guessing.

Step 21 — Enumerate HTTP/HTTPS

Example:

curl -I http://<target>

and:

curl -I https://<target>

Document:

redirect behavior
TLS
authentication
server disclosure
administrative interfaces

Do not perform web exploitation in this capstone unless separately included in the engagement.

Step 22 — Enumerate SMB

Use supplied credentials only.

Assess:

share visibility
access
permissions
administrative shares
signing
protocol version

Do not access unrelated content.

Step 23 — Enumerate DNS

Use approved lab queries.

Example:

dig @<dns-server> host1.example.test

Determine:

role
authoritative behavior
recursion
information disclosure

Step 24 — Enumerate Linux Infrastructure Services

Where present assess:

NFS
RPC
FTP
database listeners
custom daemons

Apply least-impact enumeration.

Phase 7 — Vulnerability Assessment

Step 25 — Build the Vulnerability Assessment Queue

Create:

Candidate	Asset	Evidence	Priority
V-01
V-02

Potential indicators may come from:

scanner results
old-looking versions
insecure configuration
broad exposure
legacy protocols
weak transport protection

Step 26 — Run an Approved Vulnerability Scanner

Configure:

Targets:
Authorized assets only

Unsafe Checks:
Disabled

DoS Checks:
Disabled

Credentialed Scan:
Only when supplied and authorized

Output:
Saved

Step 27 — Validate Scanner Results

Use:

Observation → Research → Correlate → Validate → Contextualize

For every important result ask:

Correct product?

Correct version?

Affected configuration?

Relevant vendor advisory?

Patch/backport status?

Reachable from assessment position?

Compensating controls?

Step 28 — Classify Vulnerability Candidates

Use:

Validated Finding
Potential Finding
False Positive
Inconclusive
Observation

Phase 8 — Authentication Assessment

Step 29 — Build the Authentication Surface Register

Asset	Service	Authentication	Expected Source
Linux	SSH	Yes	Management
Windows	RDP	Yes	Management
Web	HTTPS	Yes	Users/Admin
DB	DB Auth	Yes	App/Mgmt

Step 30 — Use Only Supplied Test Accounts

Do not perform:

password spraying
brute force
credential stuffing
default-password guessing

Assess:

role
privilege
MFA
encryption
network restriction
logging

Phase 9 — Windows Assessment

Step 31 — Assess Windows Service Exposure

Review:

135/TCP
139/TCP
445/TCP
3389/TCP
137/UDP
138/UDP

Step 32 — Assess SMB

Build:

Protocol Version:

Authentication:

Shares:

Standard User Access:

Guest / Anonymous:

Administrative Shares:

Signing:

Encryption:

Expected Exposure:

Step 33 — Assess Windows Administrative Reachability

Determine whether RDP or other administrative services are available only from intended source networks.

Phase 10 — Linux Assessment

Step 34 — Review Local Listener Baseline Where Authorized

Use:

ss -tuln

or where allowed:

ss -tulpn

Compare with remote visibility.

Step 35 — Build the Binding Register

Service	Port	Binding	Remote Visibility
SSH	22
DB	3306
Web	80

Remember:

Listening Locally ≠ Remotely Exposed

Step 36 — Assess Linux Service Accounts

Where read-only visibility is authorized:

ps aux

Assess whether services operate under appropriate identities.

Do not attempt privilege escalation.

Step 37 — Assess NFS Where Present

Use authorized, benign enumeration.

Example where supported:

showmount -e <nfs-server>

Document:

exports
allowed clients
expected scope

Do not abuse export permissions.

Phase 11 — Infrastructure Assessment

Step 38 — Assess DNS

Determine:

authoritative role
resolver role
recursion
approved record exposure
network restrictions

Step 39 — Assess NTP

Validate:

service presence
expected role
allowed clients

Do not perform amplification testing.

Step 40 — Assess SNMP

Use only supplied credentials.

Assess:

version
source restrictions
read-only behavior
information exposed
management-plane placement

Do not guess community strings.

Phase 12 — Network Traffic Assessment

Step 41 — Capture Only Authorized Lab Traffic

Using the correct interface:

sudo tcpdump -i <lab-interface> net <lab-network> \
-w 12-Traffic/capstone-traffic.pcap

Step 42 — Generate Controlled Traffic

Generate known lab interactions such as:

DNS query
HTTP request
HTTPS request
SSH session
SMB access
approved infrastructure queries

Step 43 — Analyze Protocol Security

Determine:

Protocol	Content Protection	Finding
HTTP	Plaintext	Context
HTTPS	TLS	Positive
SSH	Encrypted	Positive
DNS	Traditional plaintext	Context
SMB	Configuration dependent	Review

Step 44 — Build the Communication Matrix

Source	Destination	Protocol	Expected
User	Web	HTTPS	Yes
App	DB	DB Protocol	Yes
User	DB	DB Protocol	No
Mgmt	Linux	SSH	Yes

Phase 13 — Segmentation Assessment

Step 45 — Define Expected Flows Before Testing

Example:

User → Web:443
ALLOW

User → DB:3306
DENY

User → SSH:22
DENY

Management → SSH:22
ALLOW

Guest → Internal
DENY

Step 46 — Validate Specific Paths

Use known service ports.

Example:

nc -vz <authorized-target> <known-port>

The goal is:

Policy validation, not broad re-scanning.

Step 47 — Build the Segmentation Validation Matrix

Source	Destination	Port	Expected
User	Web	443	Allow
User	DB	3306	Deny
User	Linux	22	Deny
Mgmt	Linux	22	Allow
Guest	Windows	445	Deny

Step 48 — Identify Positive Controls

Examples:

Guest cannot reach internal SMB.

User cannot reach DB.

SSH available only from management.

Application server can reach DB.

SNMP limited to management.

Phase 14 — Attack-Path Analysis

Step 49 — Define Starting Assumptions

Example:

Assumption: An ordinary user workstation is compromised.

Do not perform the initial compromise.

Step 50 — Identify High-Value Assets

Examples:

database
management server
file server
infrastructure server

Step 51 — Correlate Evidence

Use:

Entry Position
      ↓
Validated Reachability
      ↓
Validated Weakness
      ↓
Trust Relationship
      ↓
High-Value Asset

Step 52 — Build Attack Path 01

Example:

[ASSUMED]
Compromised User Host
        │
        ▼
[CONFIRMED]
SSH Reachable from User Zone
        │
        ▼
[CONDITIONAL]
Valid Server Access Obtained
        │
        ▼
[CONFIRMED]
Server Can Reach Database
        │
        ▼
Critical Database

Step 53 — Build Attack Path 02

Example:

User Network
      │
      ▼
Database Port Directly Reachable
      │
      ▼
Database Authentication Surface
      │
      ▼
Critical Data Tier

Step 54 — Identify Chokepoints

Ask:

Which single control would break the greatest number of attack paths?

Examples:

management ACL
database ACL
guest isolation
permission redesign

Step 55 — Build the Control-Break Matrix

Attack Path	Breaking Control	Priority
AP-01	Mgmt segmentation	High
AP-02	DB ACL	High
AP-03	SMB permissions	Medium

Phase 15 — Finding Validation

Step 56 — Create the Candidate Finding Register

ID	Condition	Status
FC-01	User→DB	Validate
FC-02	SSH exposure	Validate
FC-03	Old version	Validate
FC-04	DNS naming disclosure	Observation

Step 57 — Validate Every Finding

Every reported finding must answer:

What was observed?

Where?

From what source?

What was expected?

What evidence confirms it?

What impact is supported?

What remains unproven?

Step 58 — Remove False Positives

Keep a separate register.

Do not inflate the report.

Step 59 — Consolidate Root Causes

Example:

SSH exposure
RDP exposure
SNMP exposure
Admin HTTPS exposure

may point to:

Overly permissive management-plane segmentation.

Phase 16 — Risk Assessment

Step 60 — Assign Severity

Use:

Critical
High
Medium
Low
Informational

Consider:

Exposure
Exploitability
Asset Criticality
Authentication
Privilege
CIA Impact
Business Context
Compensating Controls

Step 61 — Assign Confidence Separately

Use:

High
Medium
Low

Example:

Severity:
High

Confidence:
High

Step 62 — Build the Final Findings Register

ID	Finding	Severity	Confidence
SEG-01	User→DB access	High	High
AUTH-01	User→SSH admin surface	Medium	High
SMB-01	Excessive share permissions	High	High
INFRA-01	Broad SNMP exposure	Medium	High

Use only findings actually supported by the capstone.

Phase 17 — Remediation

Step 63 — Write Specific Recommendations

Poor:

Improve network security.

Better:

Restrict TCP 3306 to designated application and database
administration systems. Deny user and guest source networks.

Step 64 — Build the Remediation Roadmap

Priority 1 — Immediate

Examples:

isolate critical databases
restrict management services
remove plaintext administrative authentication
correct severe authorization gaps

Priority 2 — Near Term

Examples:

remove unnecessary services
improve SMB/NFS permissions
strengthen management controls

Priority 3 — Strategic

Examples:

microsegmentation
network policy governance
continuous segmentation testing
centralized hardening

Step 65 — Define Retest Criteria

Each finding should have a pass/fail condition.

Example:

Finding:
User → DB permitted

After remediation:

User → DB:3306
Expected:
Denied

Application → DB:3306
Expected:
Allowed

Phase 18 — Final Reporting

Step 66 — Build the Executive Summary

Explain:

what was tested
overall posture
major risk themes
highest-risk findings
attack-path implications
most important remediations
strong controls already working

Do not overload executives with tool output.

Step 67 — Build the Final Report

Recommended structure:

01 Cover Page

02 Document Control

03 Executive Summary

04 Overall Risk Assessment

05 Scope and Rules of Engagement

06 Assessment Limitations

07 Assessment Methodology

08 Environment Overview

09 Asset Inventory

10 Network Architecture

11 Service Exposure Summary

12 Vulnerability Assessment Summary

13 Authentication Assessment

14 Windows Security Assessment

15 Linux Security Assessment

16 Infrastructure Assessment

17 Network Traffic Assessment

18 Segmentation Assessment

19 Attack-Path Analysis

20 Findings Summary

21 Detailed Findings

22 Positive Security Controls

23 Root-Cause Analysis

24 Remediation Roadmap

25 Retest Guidance

26 Conclusion

27 Appendices

Capstone Detailed Finding Template

## SEG-01 — User Network Can Access Database Service Directly

**Severity:** High
**Confidence:** High
**Category:** Network Segmentation
**Affected Asset:** DB01
**Affected Service:** TCP/3306

### Description

### Evidence

### Technical Impact

### Business Impact

### Attack-Path Context

### Recommendation

### Retest Criteria

### References

Capstone Executive Dashboard

Create:

ENTERPRISE NETWORK PENTEST SUMMARY

Assets Assessed:

TCP Services Identified:

UDP Services Identified:

Validated Vulnerabilities:

High-Risk Findings:

Medium-Risk Findings:

Low-Risk Findings:

Observations:

False Positives:

Segmentation Gaps:

Attack Paths:

Broken Attack Paths:

Positive Controls:

Highest-Risk Asset:

Highest-Risk Network Path:

Primary Root Cause:

Highest-Priority Remediation:

Capstone Mission Challenge

Complete the following without relying on the answer from a previous lab.

CAPSTONE INFORMATION

Assessment:
Enterprise Network Penetration Test

Assessment Date:

Investigator:

Authorized Network:

Assessment Window:


SCOPE

Authorized Assets:

Excluded Assets:

Authorized Techniques:

Prohibited Techniques:

Stop Conditions:


DISCOVERY

Expected Assets:

Discovered Assets:

Unexpected Assets:

Missing Assets:


TCP SERVICES

Linux:

Windows:

Database:

Infrastructure:

Unexpected TCP Services:


UDP SERVICES

DNS:

NTP:

SNMP:

Other:


ENUMERATION

SSH:

HTTP/HTTPS:

SMB:

DNS:

NFS:

RPC:

Database:

Other:


VULNERABILITY ASSESSMENT

Scanner Candidates:

Validated Findings:

False Positives:

Inconclusive Items:


AUTHENTICATION

Remote Services:

Supplied Test Identities:

MFA:

Administrative Exposure:

Privilege Concerns:


WINDOWS ASSESSMENT

SMB Version:

SMB Signing:

Shares:

Permissions:

Guest / Anonymous:

Administrative Exposure:


LINUX ASSESSMENT

Listening Services:

Remote Services:

Bindings:

Service Accounts:

NFS:

Unexpected Services:


INFRASTRUCTURE

DNS Role:

DNS Recursion:

NTP:

SNMP:

Management Plane:


TRAFFIC ANALYSIS

Protocols Observed:

Plaintext Protocols:

Encrypted Protocols:

Sensitive Information Visible:

Unexpected Communication:


SEGMENTATION

User → Web:

User → SSH:

User → RDP:

User → Database:

Guest → Internal:

Management → Servers:

Application → Database:

Unexpected Allowed Paths:


ATTACK PATHS

Attack Path 01:

Starting Position:

Confirmed Steps:

Conditional Steps:

Target:

Impact:

Breaking Control:


Attack Path 02:

Starting Position:

Confirmed Steps:

Conditional Steps:

Target:

Impact:

Breaking Control:


FINDINGS

Critical:

High:

Medium:

Low:

Observations:


POSITIVE CONTROLS

Control 01:

Control 02:

Control 03:


ROOT CAUSES

Root Cause 01:

Root Cause 02:

Root Cause 03:


REMEDIATION

Priority 01:

Priority 02:

Priority 03:


FINAL ASSESSMENT

Highest-Risk Finding:

Highest-Risk Attack Path:

Most Critical Asset:

Most Important Segmentation Gap:

Most Important Authentication Concern:

Most Important Permission Issue:

Best Existing Security Control:

Most Valuable Remediation:

Report Ready:
Yes / No

Evidence Requirements

Your capstone should contain, at minimum:

signed/defined scope
rules of engagement
assessment journal
asset register
network map
security-zone inventory
TCP Service Register
UDP Service Register
Service Enumeration Register
Vulnerability Candidate Register
Validated Vulnerability Register
False Positive Register
Authentication Surface Register
Windows Security Profile
Linux Security Profile
Infrastructure Security Profile
Communication Matrix
Protocol Security Register
Segmentation Validation Matrix
Trust Relationship Register
Attack-Path Register
Attack-Path diagrams
Chokepoint Register
Control-Break Matrix
Positive Control Register
Final Findings Register
Root Cause Register
Remediation Roadmap
Retest Register
Executive Summary
Final Pentest Report

Final Deliverables

Deliverable 01 — Rules of Engagement

Clear scope and testing restrictions.

Deliverable 02 — Asset Inventory

All validated hosts and roles.

Deliverable 03 — Network Architecture Diagram

Zones, assets, and major communication relationships.

Deliverable 04 — Service Inventory

TCP and UDP services.

Deliverable 05 — Enumeration Register

Detailed service characteristics.

Deliverable 06 — Vulnerability Register

Validated, false-positive, and inconclusive items.

Deliverable 07 — Authentication Assessment

Remote access, role, privilege, and network restrictions.

Deliverable 08 — Windows Assessment

SMB and Windows network-service profile.

Deliverable 09 — Linux Assessment

Linux service, binding, and exposure profile.

Deliverable 10 — Infrastructure Assessment

DNS, NTP, SNMP, and management-plane analysis.

Deliverable 11 — Traffic Security Assessment

Protocol and communication analysis.

Deliverable 12 — Segmentation Matrix

Expected vs observed network flows.

Deliverable 13 — Attack-Path Analysis

Validated and conditional attack paths.

Deliverable 14 — Findings Register

Final professional findings.

Deliverable 15 — Remediation Roadmap

Prioritized fixes based on risk and attack-path reduction.

Deliverable 16 — Executive Summary

Leadership-focused assessment overview.

Deliverable 17 — Final Pentest Report

Complete professional deliverable.

Capstone Report Template

# Enterprise Network Penetration Test Report

## Document Control

## Executive Summary

## Overall Security Posture

## Key Risk Themes

## Assessment Scope

## Rules of Engagement

## Assessment Limitations

## Assessment Methodology

## Network Architecture

## Asset Inventory

## Network Discovery Results

## TCP Service Assessment

## UDP Service Assessment

## Service Enumeration

## Vulnerability Assessment

## Authentication & Remote Access Assessment

## Windows Network Security Assessment

## Linux Network Security Assessment

## DNS & Infrastructure Assessment

## Network Traffic & Protocol Assessment

## Segmentation & Access Control Assessment

## Attack-Path Analysis

## Findings Summary

### Critical
### High
### Medium
### Low
### Informational

## Detailed Findings

### Finding 01
### Finding 02
### Finding 03

## Positive Security Controls

## Root Cause Analysis

## Remediation Roadmap

### Immediate
### Near Term
### Strategic

## Retest Criteria

## Conclusion

## Appendix A — Asset Register

## Appendix B — Port & Service Register

## Appendix C — Evidence Register

## Appendix D — False Positives

## Appendix E — Inconclusive Items

Capstone Knowledge Check

Question 1 — What should happen before any scanning begins?

Scope and authorization must be confirmed.

Question 2 — Does a discovered host automatically become an authorized target?

No.

Discovery and authorization are separate.

Question 3 — Does an open service prove vulnerability?

No.

It proves exposure.

Question 4 — What turns a scanner alert into a valid finding?

Applicability, manual validation, evidence, and context.

Question 5 — Why assess authentication separately from network exposure?

Because a service can be reachable while still enforcing strong authentication, and authentication cannot replace network least privilege.

Question 6 — Why compare local Linux listeners with remote exposure?

Because a locally running service may be loopback-bound or filtered from the network.

Question 7 — Why test segmentation from different source zones?

Because access controls should vary according to source trust and business requirements.

Question 8 — What is the purpose of attack-path analysis?

To understand how multiple validated conditions and trust relationships can increase attacker reach toward high-value assets.

Question 9 — What is the value of positive-control reporting?

It demonstrates which defenses successfully interrupt attack paths and operate as intended.

Question 10 — What makes a professional pentest report defensible?

Every important claim is tied to reproducible evidence and clearly distinguishes confirmed facts from assumptions.

Skills Achieved

After completing the capstone, you should be able to demonstrate:

rules-of-engagement development
pentest scope management
network asset discovery
TCP/UDP service mapping
service enumeration
vulnerability assessment
manual vulnerability validation
false-positive analysis
authentication assessment
Windows network assessment
Linux network assessment
infrastructure assessment
packet/protocol analysis
network segmentation assessment
trust-boundary analysis
attack-path modeling
control-break analysis
severity assessment
confidence assessment
root-cause analysis
remediation prioritization
executive communication
technical reporting
evidence preservation
retest planning

Final Professional Takeaway

A beginner may approach network pentesting as:

Scan
 ↓
Find Ports
 ↓
Find Vulnerabilities
 ↓
Run Exploits

An enterprise penetration tester approaches the same engagement as:

Understand the Business
        ↓
Confirm Authorization
        ↓
Understand the Architecture
        ↓
Discover Assets
        ↓
Map Exposure
        ↓
Understand Services
        ↓
Validate Weaknesses
        ↓
Assess Identity and Trust
        ↓
Validate Network Boundaries
        ↓
Model Attack Paths
        ↓
Understand Business Impact
        ↓
Prioritize Control Improvements
        ↓
Produce Defensible Evidence
        ↓
Communicate Clearly

Always remember:

Host Discovered
      ≠
Authorized Target

Port Open
      ≠
Vulnerability

Scanner Finding
      ≠
Validated Finding

Service Reachable
      ≠
Service Compromised

Valid Credentials
      ≠
Excessive Privilege

Authentication Works
      ≠
Segmentation Works

Potential Attack Path
      ≠
Confirmed Compromise Chain

High CVSS
      ≠
Highest Business Risk

Many Findings
      ≠
Successful Pentest

The final question of the entire Network Pentesting Lab track is:

“Can you conduct an authorized network penetration test from initial scope through executive reporting using a repeatable, evidence-driven methodology while making only the claims your evidence actually supports?”

If the answer is yes, you have completed the Network Pentesting Labs track.