https://blog.lameiro0x.com/tags/dmz/Recent content in DMZ on Miguel Lameiro | Cybersecurity Blog & Security WriteupsHugo -- 0.161.1en-usFri, 01 May 2026 00:00:00 +0000https://blog.lameiro0x.com/notes/exploitation/attacking-enterprise-networks/Fri, 01 May 2026 00:00:00 +0000https://blog.lameiro0x.com/notes/exploitation/attacking-enterprise-networks/<h1 id="introduction">Introduction</h1> <h2 id="scope-assumptions-and-recon-strategy">Scope, Assumptions, and Recon Strategy</h2> <p>An enterprise network assessment usually starts with far less certainty than a lab writeup suggests. In this scenario, the client wanted to know what an anonymous internet user could reach from the DMZ and whether that access could eventually lead to internal compromise, including Active Directory impact. No VPN, web application, or domain credentials were provided, so the attack path had to begin with discovery, validation, and careful prioritization. That is important because an external penetration test is not the same thing as a full web application assessment: the goal is to find realistic footholds and high-impact attack paths, not spend the entire week cataloging every missing security header.</p>