Infrastructure Pentest

What is an infrastructure pentest?

An infrastructure pentest is an attack on your network and system infrastructure. We test what is reachable from the internet (external) and what an attacker who is already inside can do (internal). The goal of a test: mapping all vulnerabilities within your network.

This is not a network scan. Where Nessus or Qualys report known CVEs and leave it at that, we go further: we exploit vulnerabilities, move laterally through the network, escalate privileges and demonstrate real impact. We test the full attack path, not just individual points.

External versus internal

• External pentest: everything reachable from the internet - public IPs, VPN endpoints, mail servers, web servers, cloud services. We scan with Nmap and Masscan, test for outdated software, weak TLS configurations and publicly reachable management interfaces.
• Internal pentest: we start from a position inside your internal network, for example a connected laptop in the office. LLMNR/NBT-NS poisoning, relay attacks, ARP spoofing, VLAN hopping, and then the path towards Domain Admin.

Why should you get an infrastructure pentest?

One firewall misconfiguration, one forgotten test server, one weak service-account password - that is the difference between secure and fully compromised:

• Ransomware prevention: most ransomware attacks start with initial access via the network, followed by lateral movement towards domain controllers. We show whether that path is open.
• Validate segmentation: many organisations think they are segmented. We prove whether that is the case, or whether VLANs and firewall rules contain holes.
• Discover shadow IT: in almost every pentest we find forgotten systems - test servers, unauthorised services, systems outside the view of IT management.
• Compliance: NIS2, ISO 27001 and BIO require periodic checks of your technical security.

Our approach

We test like a real attacker, but in a controlled and documented way. We share findings directly via short lines - you do not have to wait for the final report.

1. External reconnaissance - mapping your attack surface: IP ranges, DNS records, SSL certificates, publicly reachable services.
2. Port scanning & service enumeration - Nmap, Masscan and manual verification of all reachable ports and services.
3. Exploitation - getting in via discovered vulnerabilities: outdated software, default credentials, misconfigurations or known exploits.
4. Lateral movement - pass-the-hash, Kerberoasting, LLMNR poisoning, relay attacks, SMB shares with weak permissions. We move through the network the way ransomware groups do.
5. Privilege escalation - towards Domain Admin via AD misconfigurations, delegation abuse or credential harvesting.
6. Reporting - the full attack path documented with screenshots, commands and impact analysis. Every finding contains a concrete recommendation. Retest available on request.

What does an infrastructure pentest cost?

Our hourly rate is €175 per hour. The investment depends on:

• Scope: number of external IPs, size of internal network, number of locations.
• Depth: external only, or also internal with full domain compromise as the goal.
• Complexity: multi-domain AD, complex segmentation, OT/IT separation.

After a scoping call you receive a fixed quote.