---
name: rt-exploit-network
description: "Authorized network penetration testing workflow for service discovery, exposure validation, segmentation review, identity controls, evidence handling, and remediation planning."
---

# rt-exploit-network - Network Security Testing

> Network testing can affect availability. Confirm scope, scan windows, rate limits, and emergency contacts before any active validation.

## Overview

This skill covers internal and external network assessment from inventory through risk validation. It is designed to produce a controlled map of exposed services, weak configurations, segmentation issues, and identity/control gaps without turning the engagement into uncontrolled exploitation.

## Prerequisites

- In-scope CIDRs, hostnames, and excluded ranges.
- Approved source IPs and scan windows.
- Contact path for SOC/NOC notifications.
- Tool rate limits and packet restrictions.
- Permission level: external, internal unauthenticated, or internal authenticated.

## Skill Levels

| Level | Activities |
|---|---|
| BEGINNER | Asset inventory, banner review, TLS/port exposure summary. |
| INTERMEDIATE | Service validation, weak protocol checks, segmentation review. |
| ADVANCED | Attack-path modeling from network exposure to business impact. |
| EXPERT | Architecture-level recommendations and detection engineering notes. |

## Workflow

### Step 1 - Scope and Safety

Create a test card:

| Field | Value |
|---|---|
| CIDR/Host | [value] |
| Source IP | [value] |
| Window | [value] |
| Rate Limit | [value] |
| Exclusions | [value] |
| Emergency Stop | [contact] |

### Step 2 - Inventory

Start with the least intrusive method available:

- Existing asset inventory from the client.
- Passive DNS and cloud inventory.
- Approved lightweight host discovery.
- Approved service enumeration.

Record host, port, protocol, service, version confidence, owner, and exposure.

### Step 3 - Prioritization

Prioritize:

- Internet-exposed administrative services.
- Legacy protocols such as SMBv1, Telnet, FTP, old TLS, SNMP community exposure.
- Weak remote access controls.
- Unauthenticated data services.
- Flat network paths between user zones and server/admin zones.
- Services with known critical CVEs.

### Step 4 - Validation

Validate safely:

- Confirm service identity.
- Confirm authentication requirement.
- Confirm encryption posture.
- Confirm version if reliable.
- Confirm whether compensating controls exist.

Avoid disruptive checks unless explicitly approved.

### Step 5 - Segmentation Review

Build a matrix:

| Source Zone | Destination Zone | Allowed? | Expected? | Risk |
|---|---|---|---|---|
| User LAN | Server VLAN | [yes/no] | [yes/no] | [notes] |

### Step 6 - Findings

Common finding families:

- Exposed management service.
- Weak or deprecated protocol.
- Missing network segmentation.
- Unauthenticated service access.
- Excessive firewall allow rules.
- Insecure remote administration.
- Missing logging and alerting.

## Evidence

Use screenshots, service banners, TLS reports, packet captures when approved, and redacted tool output.

## Remediation

- Restrict management ports by VPN/jump host.
- Enforce MFA for remote access.
- Disable legacy protocols.
- Patch externally exposed services first.
- Segment user, server, admin, and backup zones.
- Add alerting for scanning and authentication anomalies.

## Autodoc

```bash
python _rtexit/scripts/autodoc_engine.py log --skill rt-exploit-network --phase exploitation --cmd "[network validation summary]" --output "[redacted output]"
```

