ASSESS · UNDERSTAND · IMPROVE

Network Security Assessment

A Practitioner's Handbook

One training path from the fundamentals of networking to expert command of every assessment domain: network, wireless, web, API, cloud and directory. Methodology, tools, worked scenarios, a protocol and attack reference, and the complete specification of an open-source host assessment toolkit. Written so a competent engineer can be brought to operating standard from it alone.

Read online Download the PDF (138 pages) The toolkit on GitHub

19 parts · grounded in NIST SP 800-115, PTES, OWASP and MITRE ATT&CK · Creative Commons BY 4.0

The online edition

Full-text search across every section (press /)
Collapsible contents panel that follows where you are
Click any diagram to enlarge it
Copy button on every command block
Previous and next links at the end of each part
Link to any section from its heading
Light and dark theme, reading progress bar
Keyboard: [ and ] move between parts, t switches theme

What's inside

PART IFoundations of networkingDevices, addressing, ports, how data moves, segmentation, IPv6 and DMZ design. PART IIAssessment, standards and the engagement lifecycleScan versus assessment versus pentest; NIST 800-115, PTES, OWASP; rules of engagement. PART IIIDelivery architectureWhere you test from: on-site device, secure connectivity, evidence return. PART IVNetwork penetration testingDiscovery, enumeration, services, Active Directory, segmentation, what to run and why. PART VWireless assessmentThree layers: on the computer, in the air, on the controller. PART VIWeb, API and cloud assessmentApplication testing, APIs, cloud, mobile, containers and OT. PART VIIThe host assessment toolkit: full specification45 evidence sources, 45 rules, the patch engine, deployment, validation. Open source. PART VIIIEngagement managementMethod, validation, deliverables, retests, compliance mapping, writing a finding. PART IXWorked scenariosReal-shaped engagements walked through end to end. PART XDesk referenceThe tables you reach for during an engagement. PART XILessons from the fieldTen years of network testing, distilled. PART XIIA first engagement, walked throughWhat a junior should do on day one, in order. PART XIIIProtocols in depthThe language of the wire, Windows versus Linux. PART XIVNetwork attacks and vulnerabilitiesThe catalogue, with the control each one tests. PART XVDatabases on the networkHow database engines expose themselves and how to assess them. PART XVITools in depthWhat to run, and when. PART XVIIHow real client networks are builtEnterprise and banking networks, and how you get access. PART XVIIIUse cases and mini-scenariosEighteen short situations and the right test for each. PART XIXResources and further readingVerified primary sources, grouped by topic.

The companion tool: PostureKit

The host assessment toolkit specified in Part VII is published as open source (MIT). A PowerShell collector reads 45 evidence sources from an authorised Windows host and seals them with SHA-256; a Python analyzer evaluates 45 rules and the patch state against Microsoft's free vulnerability data; importers add wireless, hardening-audit and network-scan planes. It identifies, it never exploits, and it never assigns severity on its own.

PostureKit on GitHub Read the specification (Part VII)

Use only within an authorised assessment or an isolated training environment. Adapt examples to your scope and verify tool behaviour before use.