Home > Network Pentesting

Internal Network Mapping

Internal network mapping is the first and most important step during pivoting and lateral movement. Once an attacker gains access to an internal host—through a foothold, VPN access, SMB exploit, web shell, or rogue device—they must understand the internal network structure. Internal mapping reveals reachable subnets, live hosts, open ports, services, authentication paths, Active Directory layout, and potential lateral movement routes. This phase transforms incomplete access into a full internal attack map.

Why Internal Network Mapping Matters

Internal networks are rarely flat. They contain:

  • Multiple subnets

  • VLANs

  • Firewalled segments

  • Domain controllers

  • File servers

  • Application servers

  • Printers and IoT devices

Mapping these areas helps attackers:

  • Identify high-value targets

  • Discover pathways between subnets

  • Understand trust relationships

  • Locate weak systems

  • Prepare for privilege escalation

  • Plan lateral movement routes

Without mapping, pivoting becomes blind and inefficient.

Step 1: Identify Local Host Information

Start by gathering details about the compromised host.

Check Local IP and Subnet

ip addr

Check Routing Table

ip route

This reveals:

  • Subnet ranges

  • Default gateway

  • Additional reachable networks

Check ARP Cache

arp -a

The ARP table often identifies nearby active hosts.

Step 2: Discover Internal Subnets

Compromised hosts often have routes to multiple networks.

View Network Interfaces

ip -4 addr show

Look for:

  • Corporate VLANs

  • Management networks

  • DMZ segments

Check for Additional Routes

route -n

Unexpected routes expose pivoting opportunities.

Step 3: Identify Live Hosts

Use ping sweeps and ARP-based discovery.

Simple Ping Sweep

for i in {1..254}; do ping -c 1 10.10.10.$i | grep "64 bytes"; done

ARP Discovery (Stealthy)

sudo arp-scan -l

Nmap Host Discovery

sudo nmap -sn 10.10.10.0/24

Live hosts form the initial attack landscape.

Step 4: Identify Key Roles and Servers

Look for critical services:

  • Domain Controller

  • DNS servers

  • DHCP servers

  • File servers (SMB)

  • Database servers

  • Web servers

  • Backup systems

Detect Domain Controllers

nslookup -type=srv _ldap._tcp.dc._msdcs.<domain>

Domain controllers are primary targets for lateral movement.

SMB Service Scan

sudo nmap -p445 --script smb-os-discovery 10.10.10.0/24

SMB reveals OS versions, domains, and shares.

Step 5: Enumerate Open Ports on Live Hosts

Scanning reveals attack surface.

Basic Port Scan

sudo nmap -sV 10.10.10.0/24

Fast Scan (Stealthier)

sudo nmap -T4 -F 10.10.10.0/24

Full TCP Scan (Deep)

sudo nmap -p- -sV 10.10.10.5

Open ports show how each system communicates internally.

Step 6: Identify Internal Services and Applications

Internal services often expose sensitive information.

Service Fingerprinting

sudo nmap -sV --version-intensity 9 10.10.10.5

HTTP Service Inspection

If internal web services exist:

curl http://10.10.10.5

Look for:

  • Admin portals

  • Internal dashboards

  • Default credentials

  • Misconfigurations

Applications often reveal internal architecture details.

Step 7: Identify Trust Relationships

Trust relationships allow lateral movement.

Check SMB Shares

smbclient -L //10.10.10.5 -N

Check RDP Accessibility

sudo nmap -p3389 10.10.10.0/24

Check WinRM (PowerShell Remoting)

sudo nmap -p5985,5986 10.10.10.0/24

Systems with remote admin services are ideal lateral movement targets.

Step 8: Identify Active Directory Structure

If the network uses AD, enumerate the domain.

Enumerate Domain Info (Linux with Impacket)

python3 enum4linux-ng.py -A 10.10.10.5

Using Net Commands (Windows Foothold)

net group "domain admins" /domain

AD structure reveals privilege escalation pathways.

Step 9: Investigate Internal DNS

DNS reveals internal hostnames and hidden subnets.

DNS Zone Transfer Attempt

dig axfr <domain> @<dns_server>

If successful, this provides a complete map.

Query Common Internal Services

nslookup fileserver.<domain>

DNS discoveries guide scanning and pivoting.

Step 10: Begin Mapping Pivot Points

Identify systems that have access to multiple networks.

Indicators include:

  • Multiple interfaces

  • VPN connections

  • Server VLAN access

  • Routing roles

  • Shared credentials

  • RDP accessible machines

These systems form bridges to additional subnets.

Why Internal Mapping Matters

Internal mapping gives attackers the “blueprint” of the network.
It reveals:

  • High-value systems

  • Weak hosts

  • Flat networks

  • Segmented networks

  • Credential reuse patterns

  • Domain structure

  • Lateral movement paths

This information is essential for effective pivoting and privilege escalation.

Intel Dump

  • Internal mapping starts with local IP, routes, ARP, and subnets

  • Tools: arp-scan, nmap, curl, Impacket, enum4linux-ng

  • Identify domain controllers, SMB shares, RDP/WinRM, internal web apps

  • DNS, trust relationships, and network roles reveal attack paths

  • Mapping enables structured pivoting and lateral movement

HOME LEARN COMMUNITY DASHBOARD