The Lazy Pentester's Guide to Coasting Through Internals

Matthew Fisher, a security consultant with years of internal testing behind him, presents a shortcut-oriented approach to internal penetration tests. He frames the talk as an 80% solution rather than a comprehensive methodology or a set of new techniques. His central argument is that broad enumeration produces overwhelming output, so testers should prioritize collecting credentials and ask whether each action expands their network access.

The middle of the talk covers the credential sources he relies on most. Poisoning name resolution with Responder and abusing IPv6 DNS through mitm6 can yield NTLM challenge-response hashes that are cracked offline or relayed to hosts without SMB signing. Null sessions and statistically likely usernames help build a validated user list for slow, policy-aware password spraying. He also walks through default or unauthenticated printer and web interfaces, MS17-010 on legacy hosts, LSA secrets and LSASS dumps, PowerShell history, share mining, ADCS template abuse, Kerberoasting of old service accounts, and reusing recovered passwords across accounts.

He closes by condensing the approach into a workflow that starts unauthenticated and builds outward, reusing each new local admin or domain credential to repeat collection. He also notes that AI tools can help draft report text if sensitive data stays out of prompts and outputs are checked. The takeaway for practitioners is that prioritizing credentials and privilege paths can reach domain admin quickly, and that recurring findings point to client gaps such as missing LAPS, uneven EDR coverage, unmanaged IPv6 and weak service account policy.