Infrastructure Pentest Checklist

Document all CIDR blocks, VLANs, and specific hosts included in the assessment.

Clarify whether denial-of-service, exploit execution, and credential dumping are permitted.

Review provided documentation about network topology and critical systems.

Verify connectivity to all in-scope network segments from the testing position.

Schedule intensive scans and exploitation attempts during agreed maintenance windows.

Run Nmap TCP/UDP scans with service version detection and OS fingerprinting.

Identify service versions, default pages, and protocol-specific information.

Map network devices and check for management interfaces accessible from the testing position.

Attempt AXFR zone transfers and enumerate internal hostnames through DNS.

Test for default and weak SNMP community strings on discovered devices.

Enumerate SMB shares, NFS exports, and FTP directories for sensitive data exposure.

Use Nessus, OpenVAS, or Qualys to identify known vulnerabilities and misconfigurations.

Identify unpatched systems vulnerable to known exploits like EternalBlue or PrintNightmare.

Check SSH, RDP, database, and management console logins for default or easily guessable passwords.

Test for weak ciphers, expired certificates, and protocol downgrade vulnerabilities.

Identify FTP, Telnet, HTTP, and LDAP (non-TLS) services handling credentials or sensitive information.

Use Metasploit, manual exploits, or credential attacks to compromise target systems.

Escalate from standard user to root/SYSTEM using kernel exploits, misconfigurations, or credential reuse.

Use harvested credentials, pass-the-hash, or network pivoting to access additional systems.

Dump SAM/NTDS.dit, /etc/shadow, or application database hashes for offline cracking.

Verify that segmentation prevents unauthorized traffic between network zones.

Test whether sensitive data can be extracted via DNS, HTTP, or other covert channels.

Visualize the chain of compromises from initial access to domain or critical asset compromise.

Provide a complete list of systems accessed and credentials obtained during testing.

Rank fixes by their effectiveness at breaking the most critical attack chains.

Recommend firewall rules, VLAN changes, and micro-segmentation strategies.

Thoroughly clean up all persistence mechanisms and tools deployed during the assessment.