Services

Example Reports Methodologies AI Assessment Methodology API penetration test methodology Essential Eight Assessment Methodology External penetration test methodology Internal penetration test methodology Mobile application penetration testing methodology Red team & Adversary simulation methodology Web application penetration test methodology Wireless penetration test methodology Penetration testing engagement guide Reporting Reporting process Writing a retest report Service catalogue Teams Phishing Engagement Guide Tools & Tricks Abusing WDAC to kill EDR Generating effective wordlists Internal Pentesting Trainee Guide Initial Access LDAP Anon Bind LLMNR Poisoning NAC Bypass NTLM Relay Relays SMB Null Sessions Low Priv Foothold ACL Abuse AD Enumeration ADCS (ESC1)AS-REP Roasting Coerced Auth Kerberoasting Pass the Password/Hash RBCD Shares Post Compromise NTDS.dit dump Paths to GA Mobile pentest: Getting started Physical Intrusion Kit Inventory Setting up a testing host in AWS Welcome Packs Penetration testing welcome pack Phishing Campaign Welcome Pack Remediation Test Welcome Pack What value does Volkis bring to penetration testing?

Operations

AI Usage Guidelines Asset Management Policy Data Retention Development Guidelines Ethical guidelines for Volkis partnerships Expenses How we use Notion How we use Resource Guru How we use Trello Internal security Acceptable usage policy Cryptography policy Data classification and protection policy Internal security overview Managing projects at Volkis Remote Working Policy Slack etiquette & usage guide Style guide Supplier Management Policy The life and times of a Project ID Third-party service providers Workflow automations & integration

People

Biographical data sheets Getting started in penetration testing Hiring / Job-seeker guidelines Industry presentations Internal Role Descriptions Onboarding guide & checklist Personal Security Policies Disciplinary Process Performance and Feedback Volkis People Benefits Trainee Handbook Shadowing Engagements Guidelines External shadowing introduction Internal shadowing introduction Web Application shadowing introduction

Company

Brand guidelines and press pack Company overview Policies Code of ethics Independence policy State of Volkis State of Volkis 2024 State of Volkis 2026 State of Volkis, February 2023 State of Volkis, January 2022 Volkis goodies Volkis values

Client Resources

Essential Eight Guidance for Schools Penetration testing and the Essential Eight

Sales

Partner pack Scoping guide

Marketing

Social Media Guidelines

Theme

Internal Pentesting Trainee Guide

Updated 29 Sept 2026Services✎ Suggest a change

On this page

What This Is Structure 1. Initial Access 2. Low Privilege Foothold 3. Post-Domain Compromise How to Use It

What This Is

This is a guide for associates doing their first internal pentest. It's not a step by step walkthrough, think of it more as a reference you flick back to when you're stuck or need a command reminder. Attack flow and commands, minimal fluff.

Structure

Three sections, following how an internal engagement usually plays out:

1. Initial Access

Figuring out what's actually on the network before you touch anything. Live hosts, services, SMB signing, null sessions, general attack surface. Point is to know what you're dealing with. Then turning that enumeration into credentials or a shell. LLMNR/NBT-NS poisoning, NTLM relay etc. Getting your first foot in the door.

2. Low Privilege Foothold

Escalating a basic foothold to access sensitive data or escalate privileges.

3. Post-Domain Compromise

Once you've got Domain Admin (or equivalent), what next. NTDS extraction, lateral movement, ADCS abuse, and objective-based stuff like mailbox access or sensitive data hunting depending on scope.

How to Use It

Every technique follows the same layout: attack flow, tool reference, commands, expected output.
You won't always go in order. Some environments hand you a foothold before you've finished enumerating, some need heaps of enum before anything bites. Use whatever section fits what's in front of you.
If a command or flag here doesn't quite match what you're seeing, check -help or the tool's docs first. This guide gets you moving, it's not exhaustive.

← Generating effective wordlists Initial Access →