Hey [name], you've got an internal engagement coming up. A couple of things to sort out beforehand, some kit worth having and some technical areas worth brushing up on so you're not walking in cold.
What to grab (and expense)
- A mouse. Testing on a trackpad for hours gets old fast, and it makes a real difference during long sessions
- Ethernet cables, at least one short and one longer one.
- A charger for your laptop, ideally one you leave in your bag permanently so it's never the thing you forget
- A wifi adapter with an external antenna. Handy for wireless assessments or when you need better range or signal than your laptop's built in adapter can manage
- A portable second screen if you feel you need more then one window, amazon sells these for a decent price
How to expense it
- Keep it practical, buy what you'll actually use rather than stocking up all at once
- Hang on to your receipts
- Submit through xero, flag your manager or buddy if you're not sure what counts
- If you're unsure whether something's worth buying before your first job, ask your buddy
Technical areas worth brushing up on
Internal engagements lean heavily on Active Directory and Windows domain concepts, so it's worth having a rough grip on these before you start:
- Kerberos authentication, the basic flow (AS-REQ/AS-REP, TGT, TGS), and common attacks like Kerberoasting and AS-REP roasting
- NTLM authentication and why it's still relevant even in Kerberos heavy environments, including NTLM relay basics
- Active Directory structure, domains, forests, trusts, OUs, group policy, just enough to understand what you're looking at when you pull data on a domain
- Common enumeration tools, things like BloodHound, PowerView, and tools like NetExec, so you know what's available and roughly what each one gives you
- LLMNR/NBT-NS poisoning and why it's such a common quick win on internal networks
- SMB and null sessions + share enumeration
You don't need to master all of this before your first internal job, just have enough of a mental map that when something comes up you're not hearing the term for the first time on site. If any of these feel shaky, flag it to your buddy beforehand, better to get a quick refresher than guess your way through it.