Network Penetration Testing Report — Sample

This is a fictional, illustrative sample of a network penetration testing report. It demonstrates how TMG Security structures and documents a professional external and internal network security assessment — from scope and PTES/NIST SP 800-115-informed methodology through network segmentation testing, Active Directory security review, network device assessment, wireless and cloud/hybrid testing, findings, and remediation guidance. The full sample report contains 46 illustrative findings drawn from 152 fictional test cases, executed against a fictional enterprise environment spanning 13 internal network zones. NorthStar Financial Services, Inc. does not exist; every finding, test case, host, and figure in this sample is fictional and constructed to show TMG's reporting standard, not to describe any real organization's security posture.

This fictional assessment was performed against NorthStar Financial Services, Inc., a fictional financial services / fintech organization, combining an external black-box/grey-box assessment of the internet-facing perimeter with an internal assumed-breach assessment starting from a standard user-tier foothold.

Scope for this fictional assessment covered the full external perimeter and eight internal network zones, plus wireless and cloud/hybrid connectivity, exercised over the assessment period against 152 fictional test cases.

Out of scope: any production system, network, or data belonging to a real organization; denial-of-service testing of any kind; physical security testing; social engineering campaigns; destructive exploitation; third-party vendor infrastructure; and cloud provider infrastructure below the fictional tenant/management layer.

TMG Security's network testing approach is conceptually informed by PTES (the Penetration Testing Execution Standard) and NIST SP 800-115. Testing proceeded through the following phases:

TMG Security is not affiliated with, endorsed by, reviewed by, or certified by PTES, NIST, or any standards body. References to PTES and NIST SP 800-115 describe the testing methodology used and do not imply any official certification of NorthStar Financial Services or TMG Security.

The fictional NorthStar environment is organized into 13 internal network zones, spanning user, server, application, database, identity, backup, management, security tooling, wireless, and cloud/hybrid segments. This sample report shows how TMG documents network architecture as the baseline for segmentation and lateral-movement testing.

TMG Security enumerated and tested nine fictional internet-facing systems comprising NorthStar's external attack surface.

Internally, NorthStar's fictional environment separates user, server, application, database, identity, backup, management, and security-tooling traffic across dedicated VLANs, with three wireless SSIDs — Corporate (NSF-CORP), Guest (NSF-GUEST), and Management (NSF-WLAN-MGMT) — and a dedicated Security Tooling VLAN hosting vulnerability scanning and EDR management infrastructure. A Cloud/Hybrid Connectivity segment terminates a fictional site-to-site VPN and hosts the hybrid identity synchronization server and cloud management interface bridging the on-premises domain to the fictional cloud tenant.

TMG Security tested documented zone-to-zone pairs from the segmentation matrix against the traffic actually permitted on the live network, comparing expected policy against observed reachability. A representative selection of results is shown below; the complete segmentation matrix is included in the full sample PDF.

TMG Security assessed NorthStar's fictional single-domain, single-forest Active Directory design — two domain controllers (NS-DC01, NS-DC02) — covering privileged group membership, service account hygiene, password policy, LDAP, Kerberos, SMB signing, SYSVOL, Group Policy security, administrative pathways, and monitoring. Domain Admins membership was found to exceed the minimum required for genuine Tier-0 activity, including several accounts used for routine application support. The Default Domain Policy enforces only an 8-character minimum password length with no banned-password-list screening. Several SPN-registered service accounts use stale, non-rotated passwords vulnerable to Kerberoasting, and a Domain Admin-equivalent service account credential was recoverable from a legacy Group Policy Preferences (SYSVOL) artifact.

TMG Security assessed NorthStar's fictional firewalls (external and internal), core switch, distribution switches, wireless LAN controller, and network management platform, covering management protocols, SNMP configuration, administrator access, ACLs, management-plane segmentation, configuration backups, logging, and firmware lifecycle. HTTPS/SSH were observed for device management with no Telnet exposure. Default vendor administrative credentials were not rotated on the core switch and internal firewall, and management-plane ACLs are missing on the core switch and internal firewall and overly broad on distribution switches. Automated configuration backups are stored unencrypted on a broadly-accessible general IT share, and the wireless LAN controller was running outdated firmware.

TMG Security assessed NorthStar's three fictional wireless SSIDs. The Corporate SSID (NSF-CORP) uses WPA2-Enterprise with 802.1X/PEAP-MSCHAPv2, but retains a legacy shared-PSK fallback for IoT-style devices that has not been rotated in over two years. The Guest SSID (NSF-GUEST) uses WPA2-Personal with correctly configured client isolation from the corporate network. The Management SSID (NSF-WLAN-MGMT) uses WPA2-Personal for wireless LAN controller control-plane traffic; an overly broad firewall rule permits Corporate SSID clients to reach the Management VLAN.

TMG Security reviewed NorthStar's fictional site-to-site VPN connectivity and hybrid identity synchronization server bridging the on-premises Active Directory domain to a fictional cloud tenant and cloud management interface.

This fictional assessment identified 46 illustrative findings across NorthStar's external perimeter, internal network, Active Directory, network devices, wireless, and cloud/hybrid connectivity, drawn from 152 fictional test cases. Every finding, severity rating, and evidence reference is fictional and specific to this network penetration test.

All four Critical findings from this fictional assessment are shown in full below.

All nine High findings from this fictional assessment are shown below.

The full sample report walks through two illustrative, fictional attack chains showing how individually-rated findings combine into realistic compromise scenarios.

Attack Path 1 — External to domain-level impact: starting from the internet, an attacker exploits the legacy VPN authentication bypass (NET-001) to obtain network access using only a single valid credential. From the User Workstation VLAN, the insufficient segmentation gap (NET-002) provides direct reachability to the Database VLAN. Independently, the SYSVOL credential exposure (NET-003) provides a Domain Admin-equivalent credential to any authenticated user, completing a path to full domain-level impact.

Attack Path 2 — Assumed-breach lateral movement: starting from a compromised User VLAN workstation (the internal assumed-breach starting point), internal enumeration discovers SMB and LDAP configuration weaknesses (NET-005, NET-006) that expose credential material via Kerberoasting (NET-013). The recovered credential is used for lateral movement to a privileged administrative server reachable via improperly segmented RDP (NET-010), from which the exposed management plane (NET-004) provides a path to network device compromise.

These attack-chain narratives are illustrative of TMG's reporting approach and do not describe any real exploitation — no real network, device, or credential was involved.

Every finding in the full sample report carries an owning fictional role, a target remediation date, and a status, grouped into a phased roadmap: immediate action on the four Critical findings, a 31–60 day phase for the nine High findings, a 90-day phase for the fourteen Medium findings, and an ongoing hardening and governance program tracking the nine Low and ten Informational items.

The full sample report's retest methodology follows a structured approach: each remediation claim is validated against the original finding's proof of concept, retesting occurs only after confirmation that remediation is complete, and a final retest report documents closure status for every finding.

This fictional assessment was scoped to the systems and network segments explicitly listed in the scope section above; testing did not extend to physical security, third-party infrastructure, or denial-of-service techniques. Findings reflect point-in-time observations only, and this sample does not represent a complete or exhaustive test of every possible network attack surface.

NorthStar's fictional network demonstrates foundational security controls but requires prioritized remediation of four Critical and nine High findings, concentrated in network segmentation, Active Directory credential hygiene, and management-plane access control, before a stronger trust posture is achieved.

Beyond the sections summarized on this page, the complete sample PDF includes a full set of supporting appendices, and the complete finding register is reproduced below:

This sample shows how TMG Security structures an external and internal network penetration test. TMG also provides Offensive Security & Penetration Testing, API Security Testing, Web Application Security Testing, and Mobile Application Security Testing for organizations that need an actual assessment of a real environment.