Perimeter defense alone is insufficient to protect sensitive enterprise data. Riptide Cybersecurity’s Internal Penetration Testing simulates an assumed breach or malicious insider scenario to evaluate what an attacker can achieve from within your corporate network.
Led by an OSEP, OSCP, and CRTO-certified offensive specialist, we execute real-world adversary emulation targeting the core identity infrastructure of your environment.
Attack Vectors & Offensive Tradecraft Tested
- Active Directory Attack Path Mapping: Leveraging BloodHound for deep graph analysis to uncover non-obvious ACL misconfigurations, nested group relationships, and high-privilege escalation pathways.
- Kerberos Protocol Exploitation: Kerberoasting (identifying weak service account passwords), AS-REP Roasting, and Delegation attacks (Unconstrained, Constrained, and Resource-Based Constrained Delegation / RBCD).
- Network Protocol Poisoning & Relay: Executing Responder and mitm6 for LLMNR/NBT-NS and IPv6 DNS takeover, combined with NTLM relay attacks to capture credentials without cracking passwords.
- Credential Access & Token Harvesting: LSASS memory inspection, SAM registry extraction, DPAPI credential recovery, and browser secret auditing on compromised endpoints.
- Privilege Escalation & Evasion: Exploiting unquoted service paths, binary misconfigurations, vulnerable kernel drivers, and abusing misconfigured sudo/GPO rules.
- Lateral Movement & Pivoting: Pass-the-Hash, Pass-the-Ticket, Overpass-the-Hash, WMI/WinRM remote execution, and network segmentation bypass testing.
Deliverables & Defensive Roadmap
- Adversary Attack Path Visuals: Visual attack graph illustrating the exact hops taken from a low-privilege standard user to Domain Administrator.
- Active Directory Hardening Plan: Concrete guidance to implement Tiered Administration Models, LAPS (Local Administrator Password Solution), and Protected Users groups.
- Detection & Telemetry Recommendations: Custom SIEM/Wazuh alert rules to detect protocol poisoning and Kerberos anomalies in real time.
