Five Issues We Encounter Time and Again in Every Internal Penetration Test (and How You Can Prevent Them)
At our subsidiary, RedTeam Cybersecurity, we conduct numerous internal penetration tests each year at organizations throughout the Netherlands. Whether they are housing associations, government agencies, or financial service providers, the techniques used may differ, but the results are strikingly similar.
In fact, we often know even before the first scan that we’ll have access to sensitive information—or even domain privileges—within a few hours. This isn’t due to complex attacks, but rather to a handful of well-known vulnerabilities that keep cropping up. In this blog post, we’ll list five of these classic vulnerabilities, along with what you can do to address them systematically.
1. SMB signing not enforced
In many networks, SMB signing is not enforced on servers. As a result, authentication credentials can be intercepted and forwarded to systems that lack SMB signing, which can grant access to sensitive parts of the network.
What you need to do: Enable SMB signing on all servers, disable outdated protocols such as LLMNR and WPAD, and restrict access to sensitive endpoints.
What we often see: SMB signing isn't enforced, network services are left open unnecessarily, and there's no understanding of the impact of relaying.
2. Weak and reused passwords
Although many organizations believe that weak passwords are a thing of the past, in practice we still regularly encounter them during simple password spraying attacks. Think of combinations like `Welcome01`, `Summer2024`, `CompanyName01`, or `Admin123`. In addition, passwords are often reused across domain accounts and local administrator accounts—something that can easily be prevented with LAPS.
What you need to do: Strong password policy, unique passwords for each system, a password vault for administrators, MFA where possible, and LAPS enabled for local admin accounts.
What we often see: Reused passwords for domain and local accounts, weak password combinations in service accounts or Group Policy Objects (GPOs), and no lockouts on service accounts.
3. ADCS misconfigurations
Active Directory Certificate Services (ADCS) is increasingly being exploited within networks. Insecurely configured templates or insufficient access restrictions make it possible to obtain certificates that allow you to impersonate other users, including domain administrators. This often leads to a complete takeover of the domain.
What you need to do: Only verified users are allowed to request certificates; no exploitable templates are available; access controls on CA servers are strictly enforced.
What we often see: Templates with overly broad permissions, insufficient control over write permissions, and no monitoring of certificate usage.
4. Posts containing sensitive information
Open shares and SharePoint environments remain a goldmine for penetration testers. In addition to scripts containing passwords in plain text, we often find Excel files or documents here that contain shared login credentials, configurations, and sensitive business information. In many cases, regular domain users can view these without any restrictions.
What you need to do: Set sharing permissions based on the principle of least privilege; encrypt or secure sensitive files; and perform periodic scans for passwords and sensitive content.
What we often see: Everyone has read access to shares and SharePoint, there’s no control over content, and passwords are shared in documents, scripts, or exports.
5. Limited segmentation, monitoring, and response
Without proper network segmentation, it’s easy for an attacker to move laterally across the network. Combine that with insufficient logging and an unclear or absent incident response process, and you won’t know something’s wrong until it’s too late.
What you need to do: Internal segmentation between workstations, servers, and management systems; logging of authentication, lateral movement, and privilege escalation; clear procedures and responsibilities for following up on suspicious events.
What we often see: A flat or very limited segmented network, no filtering between segments, logging is enabled but not actively monitored, or only a limited number of attacks are visible, and incident response is either lacking or unknown within the organization.
Want to be better prepared for a penetration test?
- Verify that SMB signing is required on all servers.
- Perform a password audit, including service accounts, scripts, and local accounts (use LAPS).
- Scan your ADCS configuration for exploitable templates.
- Check share and SharePoint permissions for sensitive data.
- Segment your network, set up detection rules, and establish clear incident response processes.
Want to know how secure your network really is? Don’t rely on assumptions or default configurations. With our ethical hackers at OneXillium, we don’t just look at what’s on paper—we demonstrate in practice what an attacker can actually achieve.