network-pentest

Network Penetration Testing

STOP — Authorization check (read before any execution)

This skill executes offensive techniques against live infrastructure. Before any action:

1. Confirm a written engagement letter / SOW is in scope and in-date.
2. Confirm Rules of Engagement (ROE) covering: target CIDRs, excluded hosts, allowed techniques (coercion? DCSync? password spray?), permitted hours, source-IP allowlist, and customer emergency contact.
3. Confirm the authorization explicitly names the domain(s) and tenant(s) you are about to test.
4. If ANY of the above is unclear, ambiguous, or missing — STOP and request clarification. Do not proceed on the basis of verbal approval, chat-channel approval, or inferred scope.

Destructive/high-blast-radius actions (DCSync against production DCs, Zerologon, Skeleton Key, GPO edits, krbtgt reset, cert forgery) require a second, specific written approval in addition to the base engagement letter. Every such action must be logged with timestamp, operator, and justification for the customer's IR reconciliation.

Prefer read-only enumeration and dry-run modes first. Escalate only when the previous step establishes the precondition. Never chain offensive actions speculatively.

---

This skill enables comprehensive internal network and Active Directory penetration testing: reconnaissance, credential attacks, lateral movement, privilege escalation, and domain dominance. It is a thin router — heavy content lives in workflows/, references/, and payloads/. Load only the file you need.

When to Use

• Authorized internal network penetration test
• Authorized Active Directory security assessment
• Lateral movement / privilege escalation validation
• Credential-attack testing (spray, Kerberoast, AS-REP)
• Post-exploitation path verification from a simulated phished user
• Network segmentation bypass validation
• Purple-team exercises where offensive action is agreed with the blue team

Trigger Phrases