Internal reconnaissance
Internal reconnaissance is the process of understanding the systems, network visibility, configurations, and constraints available from an internal foothold. Internal reconnaissance should be treated as a deliberate step and does not include privilege escalation or lateral movement.
Strategic context
Once an internal foothold is established, many of the assumptions developed externally no longer apply. The focus now shifts to identifying visibility and reachability for internal systems. Effective internal reconnaissance reduces guesswork and prevents blind privilege escalation attempts.
It helps operators understand:
Privilege level of current host and identity
Network segmentation
Host relationships
Security controls
Configuration details
Successful internal reconnaissance should inform decisions about whether to escalate privileges locally, pivot to other systems, or to pursue identity based attack paths.
For security leaders, this phase demonstrates how an internal foothold can lead to greater internal awareness and attack path mapping. Disciplined segmentation and access controls are crucial in limiting the amount of awareness attackers can gain.
Execution examples
Internal reconnaissance typically begins with understanding the context of the current host and expands outward to network and configuration details.
Host context
Understanding the foothold host provides insight into privilege level and the environment.
# Windows
whoami /all (user and privileges)
systeminfo (system information)
net user (local users)
net localgroup (local groups)Network visibility
Depending on the engagement type, you may also choose to perform internal host discovery using nmap.
Configuration and artifacts
Common mistakes
Escalating privileges before understanding the environment
Ignoring segmentation
Scanning without objectives
Running noisy enumeration immediately after gaining access
These mistakes increase the risk of detection and reduce effectiveness.
Operator notes
Firmly establish your foothold before expanding access
Use a structured and disciplined approach
Evaluate all options before pursuing additional exploitation
Last updated