Internal Pentest Requirement

Scope

• A way to connect to the internal network where we will perform the test, some ways to connect are the following:

  • On-premise via RDP, for this, we need some credentials and tool installation permissions.

  • A kalibox that is prepared to do the pentest.

  • Jumpbox, but we need installation permissions to install tools. This jumpbox can be accessed via SSH or RDP.

  • Azure Bastion: for this, we need Azure credentials.

  • We can also send a device (Micro-PC) to perform the test. In this case, we will need an address to receive the device.

• List of all targetable IPs or CIDR ranges or a list of critical target assets. This list will be the scope, and everything else will be ignored.

• If they have Active Directory, we may require a set of credentials depending on the nature of the test:

  • The Black-box Active Directory test does not require credentials, and the Active Directory will be tested without authentication. The tester will try to gain access using various attacks and techniques.

  • The White-Box Active Directory test will require credentials, and the active directory environment will be tested along with the hosts.

• In the case of a segmented environment, access to each network segment to be tested | Required

VPN, Jumpbox, Azure Bastion, or Virtual Machine

✅ Credentials and confirmation of access to all segments | Required

Red Sentry Device utilization

✅ Physical address or addresses to send devices | Required

✅ Indication of whether devices will need to be physically moved to access any segments | Required

On-site device remote access

✅ Credentials and confirmation of access to all segments | Required

✅ Indication of whether devices will need to be physically moved to access any segments | Required