Cybersecurity Project · Penetration Testing

Internal Network Penetration Testing

Authorised security assessment of an intentionally vulnerable lab environment covering reconnaissance, enumeration, web vulnerabilities, controlled exploitation, post-exploitation analysis, and remediation.

Authorised technical lab project

Context & Authorisation

This assessment was performed only against an intentionally vulnerable laboratory environment with authorisation to conduct penetration testing. It did not target a real organisation, production system, or unauthorised third-party infrastructure.

Objective

Follow a structured penetration-testing workflow from reconnaissance and enumeration through vulnerability validation, controlled exploitation, impact assessment, post-exploitation analysis, and remediation.

Assessment Approach

Performed network reconnaissance and service discovery using Nmap.
Investigated SMB exposure and performed account and service enumeration using appropriate lab tooling.
Assessed web-application behaviour with Burp Suite and identified SQL-injection weaknesses.
Used controlled exploitation techniques to validate the impact of identified vulnerabilities.
Investigated vulnerable Webmin functionality associated with Webmin 1.984 and CVE-2022-0824.
Performed controlled post-exploitation and persistence-risk analysis after obtaining elevated access.
Documented remediation recommendations for identified weaknesses and attack paths.

Key Findings

SMB services exposed information useful for account and service enumeration.
The Kings Module Directory contained a SQL-injection weakness.
Weak password-policy controls increased account-security risk.
The lab exposed vulnerable Webmin 1.984 functionality associated with CVE-2022-0824.
Controlled exploitation demonstrated remote code execution and reverse-shell capability.
The assessment demonstrated root-level compromise inside the intentionally vulnerable lab.
Post-exploitation analysis demonstrated persistence-related risk and supported remediation recommendations.

Assessment Evidence

Selected evidence from the authorised, intentionally vulnerable laboratory assessment. Detailed exploitation material remains in the technical repository.

Nmap service discovery against the intentionally vulnerable penetration-testing lab — Initial reconnaissance and exposed-service discovery against the authorised laboratory target.

SQL injection validation performed against the authorised vulnerable web application — Controlled validation of the identified SQL-injection weakness inside the intentionally vulnerable lab.

Webmin version and login interface identified during authorised vulnerability assessment — Webmin service identification and version evidence used during vulnerability assessment.

Authorisation & Safety Boundary

All testing was confined to an authorised, intentionally vulnerable lab. This portfolio summary intentionally omits unnecessary exploit commands and operational attack instructions; deeper technical evidence remains in the associated project documentation.

Security Relevance

The project demonstrates structured vulnerability assessment, network and SMB enumeration, web-application testing, validation of exploit impact, privilege-impact analysis, controlled post-exploitation, security reporting, and remediation-focused thinking.