Internal Network Assessment

Tool Chain

Steps

1. Internal Network Reconnaissance Scattershot3

   Internal port scanning, service enumeration, SMB/SNMP/SSH probes, web tech fingerprinting.

   Input	Internal IP ranges / CIDRs
   Output	findings.json, summary.json, evidence/
   Usage	scattershot3.py -t <targets> -o <output_dir> -c <client> -s int
   Notes	Run from inside the client network. Use int scope for internal-specific checks.

2. IoT / OT Device Auditing Gearbox

   IoT/OT device enumeration, traffic capture, protocol analysis, DHCP/DNS/SNMP auditing, firmware analysis.

   Input	Device IP ranges from SS3, network interfaces
   Output	gearbox.db, findings.json, traffic captures (.pcap)
   Usage	gearbox.py -t <targets> -o <output_dir> [module flags]
   Notes	Trawler auto-invoked on pcap captures. Manage via Gauntlet for real-time monitoring.

3. Authentication Detection AuthProbe

   Detect auth methods on internal web apps and APIs.

   Input	Internal web app URLs from SS3
   Output	AuthProbe results (JSON)
   Usage	authprobe.py <url> [--rendered] [--json]
   Notes	Internal apps may use NTLM, Kerberos, or form auth.

4. Internal Web Application Testing Fracture

   OWASP Top 10 testing against internal web applications.

   Input	Internal web app URLs + auth config
   Output	findings.json, evidence/
   Usage	fracture.py -t <target> -o <output_dir> [auth flags]
   Notes	Internal apps often have weaker security posture.

5. Internal API Testing Siphon

   API security testing on internal APIs and microservices.

   Input	Internal API URLs + specs
   Output	findings.json, api_inventory.json
   Usage	siphon.py -t <api_url> -o <output_dir> [flags]
   Notes	Internal APIs may expose admin endpoints.

6. Configuration Audit Bastion

   Firewall configuration audit: policy violations, shadowed rules, compliance gaps.

   Input	Firewall configuration exports
   Output	findings.json
   Usage	bastion.py -c <config_file> -o <output_dir>
   Notes	Request firewall configs from network team before engagement.

7. Reporting Prometheus

   Merge all internal assessment findings into unified report.

   Input	All preceding tool run directories
   Output	Unified report suite
   Usage	prometheus.py -i <run_dirs...> -o <report_dir> -c <client>
   Notes	Internal scope produces separate report section.