Internal Pentest Checklist: 20 Items Every Test Should Cover

An external penetration test shows what an attacker on the internet can reach. An internal one answers a harder question: what happens after someone is already inside? This internal pentest checklist gives you 20 items every test should cover, from scope through retest, so nothing important is skipped.

What Is an Internal Penetration Test?

An internal penetration test is a controlled attack launched from inside your network, simulating a compromised laptop, a malicious insider or a guest who has gained a foothold. Testers try to move through systems, escalate privileges and reach sensitive data, then report what they found and how to fix it.

Internal vs External Penetration Testing

External testing starts from the internet and targets public systems. Internal testing starts on the LAN or VPN. External and internal scanning find weaknesses; penetration testing tries to exploit them. A complete program needs both.

The 20-Item Internal Pentest Checklist (Summary Table)

#	Item	Area
1	Scope, objectives and in-scope IP ranges	Pre-test
2	Rules of engagement, authorization and emergency contacts	Pre-test
3	Starting position: assumed breach or network drop	Pre-test
4	Third-party hosted systems and notifications	Pre-test
5	Host and service discovery	Recon
6	Active Directory enumeration	Recon
7	Network segmentation and VLAN checks	Recon
8	Unpatched systems and services	Vulns
9	Default and weak credentials	Vulns
10	Insecure protocols (LLMNR, NBT-NS, SMBv1, unsigned SMB)	Vulns
11	Misconfigured shares and sensitive files	Vulns
12	Credential attacks (password spraying, poisoning and relay)	Exploit
13	Kerberoasting and AD attack paths	Exploit
14	Privilege escalation to domain admin	Exploit
15	Lateral movement between segments	Exploit
16	Access to critical data and crown jewels	Exploit
17	Did the SOC and EDR detect the test?	Detection
18	Evidence collection and cleanup	Close-out
19	Risk-rated report with remediation steps	Close-out
20	Remediation verification and retest	Close-out

Before the Test: Scoping and Rules of Engagement (Items 1-4)

1. Scope, Objectives and In-Scope IP Ranges

Agree what networks, domains and systems are in and out of scope, and what success looks like: domain admin, access to a specific database, or a defined set of objectives.

2. Rules of Engagement, Authorization and Emergency Contacts

Get written authorization from someone with the authority to approve testing. Set out allowed techniques, blackout windows, and who to call if a system becomes unstable.

3. Starting Position: Assumed Breach or Network Drop

Decide whether testers start with a standard user laptop (assumed breach) or with only a network jack and no credentials (network drop). Assumed breach is more common for Active Directory environments.

4. Third-Party Hosted Systems and Notifications

List managed services, cloud tenants and shared infrastructure that need the provider’s approval or prior notice before testing.

Reconnaissance and Discovery (Items 5-7)

5. Host and Service Discovery

Identify live hosts, open ports and services so the test covers the real estate, not just a sample of known servers.

6. Active Directory Enumeration

Map users, groups, computers, trusts, GPOs and service accounts. Most internal compromises follow AD paths.

7. Network Segmentation and VLAN Checks

Test whether user, server, guest and management networks are truly separated, or whether one foothold reaches everything.

Vulnerability Identification (Items 8-11)

8. Unpatched Systems and Services

Find missing OS and application patches, then prioritize them by exploitability and asset importance rather than severity alone.

9. Default and Weak Credentials

Test for default passwords on appliances, printers, cameras and management interfaces, and for weak or reused passwords on user and service accounts.

10. Insecure Protocols (LLMNR, NBT-NS, SMBv1, Unsigned SMB)

Legacy name resolution and file-sharing protocols often let attackers poison responses and capture or relay credentials.

11. Misconfigured Shares and Sensitive Files

Look for open file shares, passwords in scripts and documents, and backups that anyone can read.

Exploitation and Lateral Movement (Items 12-16)

12. Credential Attacks (Password Spraying, Poisoning and Relay)

Attempt controlled password spraying, name-resolution poisoning and credential relay where allowed by the rules of engagement.

13. Kerberoasting and AD Attack Paths

Request service tickets for accounts with SPNs, try to crack them offline and map paths that lead to high-privilege accounts.

14. Privilege Escalation to Domain Admin

Test whether a standard user can reach Domain Admin or equivalent control of the directory.

15. Lateral Movement Between Segments

Move from the starting segment into other VLANs, cloud connectors and management networks to show how far an attacker can go.

16. Access to Critical Data and Crown Jewels

Confirm whether testers can reach databases, file stores or applications that hold the organization’s most sensitive data.

Detection, Reporting and Retest (Items 17-20)

17. Did the SOC and EDR Detect the Test?

Compare the tester’s activity with what your security operations team and EDR tools logged. Missed activity is as important a finding as a technical exploit.

18. Evidence Collection and Cleanup

Testers should keep clear evidence of every finding and remove tools, accounts and persistence they created before leaving.

19. Risk-Rated Report with Remediation Steps

The report should rate each finding by business risk, explain how it was exploited and give practical remediation steps with owners.

20. Remediation Verification and Retest

After fixes are applied, verify the critical findings with a retest so you know the risk is really closed.

Common Internal Pentest Tools

Testers commonly use frameworks such as Metasploit, Impacket and BloodHound for Active Directory paths, plus scanners and credential tools. The tool list matters less than the coverage of the 20 items above. Agree in advance which tools are allowed.

How Often Should You Run an Internal Pentest? (PCI DSS, Cyber Essentials Plus, CREST and CHECK)

PCI DSS Requirement 11.4 expects internal and external penetration testing at least annually and after significant changes. NIST SP 800-115 describes technical testing methods organizations can use. In the UK, CREST and NCSC CHECK accreditation help buyers choose qualified providers. Cyber Essentials Plus is a technical audit with a vulnerability assessment, not a full penetration test; do not treat it as a substitute for one.

Closing the Loop on This Internal Pentest Checklist

This internal pentest checklist is only useful if findings turn into fixes. After every test:

1. Assign each high-risk finding to an owner with a deadline.
2. Fix detection gaps the SOC missed.
3. Schedule the retest before you close the project.
4. Feed lasting issues into your vulnerability management program.

For help scoping or running an internal penetration test, contact Cyber Security Solutions Ltd through our contact page.