The Engagement
As team lead of a group of IT Ninjas, I performed a full penetration test against a complex corporate environment under strict ethical constraints. The engagement covered everything from scope negotiation to final report delivery — treating the exercise as a real professional engagement with confidentiality, liability, and clear rules of engagement.
My Role: Team Lead
- Scope and Planning: Defined engagement scope, timeline, and target priority. Allocated team effort based on individual expertise and assigned Active Directory-focused attack tracks.
- Team Management: Coordinated parallel workstreams, consolidated findings, resolved conflicting results, and maintained a shared operational log throughout the engagement.
- Client Communication: Served as the primary contact for all outgoing communication. Managed information handling under a secure communication policy using Signal and BitLocker-encrypted storage.
- Decision Making: Adapted the attack strategy based on live findings and risk prioritization — pivoting from initial access vectors to AD escalation paths as the engagement progressed.
- Report Delivery: Consolidated all technical findings into a professional pentest report with executive summary, detailed finding write-ups, evidence, CVSS scores, and remediation guidance.
Methodology
Phase 01
Reconnaissance
Passive and active information gathering. Network enumeration via Nmap, service fingerprinting, initial AD topology mapping.
Phase 02
Initial Access
Exploitation of identified vulnerabilities for initial foothold. Credential capture via Responder (LLMNR/NBT-NS poisoning) and service exploitation.
Phase 03
AD Exploitation
BloodHound graph analysis to identify escalation paths. Privilege escalation through misconfigured AD permissions, delegation abuse, and lateral movement.
Phase 04
Reporting
Professional pentest report with executive summary, technical write-ups, evidence screenshots, reproduction steps, CVSS scoring, and prioritized remediation.
Example Findings
Critical — Active Directory
Credential Capture via LLMNR Poisoning
Responder captured NTLMv2 hashes from unauthenticated broadcast traffic on the internal network. Hashes were cracked offline and used for lateral movement to higher-privileged accounts.
High — Misconfiguration
Overly Permissive AD Delegation
Unconstrained Kerberos delegation identified on a service account with domain-level access. BloodHound graph visualized the escalation path from low-privilege user to Domain Admin in three hops.
Operational Security
The engagement was conducted under professional OpSec constraints reflecting real-world engagements:
- All client communication routed through Signal for encrypted messaging
- Evidence and findings stored on BitLocker-encrypted drives throughout the engagement
- Scope documentation signed before any active testing began
- All team members briefed on ethical and legal boundaries; no testing outside defined scope
- Sensitive data handled under a defined data retention and destruction policy post-delivery