Internal Network Pentest Report: Full Structure and Example (2026)

How Internal Network Reports Differ From Web App Reports

A web application pentest report documents vulnerabilities in a single application surface. An internal network pentest report documents an entire attack chain - often from an assumed-breach starting point through lateral movement to domain compromise.

The key differences are:

• Multiple hosts instead of one application
• Active Directory attack paths - Kerberoasting, Pass-the-Hash, DCSync
• Network segmentation gaps
• Lateral movement chains that span multiple findings
• Privilege escalation across machines, not just within one app
• Domain and forest level impact

This means your report needs to tell a story, not just list findings. The reader needs to follow the attack path from initial access to domain admin.

Recommended Structure for an Internal Network Pentest Report

1. Cover Page
2. Document Control
3. Executive Summary
4. Scope and Methodology
5. Network Overview
6. Attack Path Summary
7. Detailed Findings
8. Active Directory Risk Summary
9. Remediation Roadmap
10. Appendices

The attack path summary section is what separates strong internal network reports from weak ones.

Executive Summary for Internal Network Reports

The executive summary for an internal network report should answer four questions: starting access level, worst-case outcome, was domain compromise possible, and the top three risks in business terms.

Here is an example executive summary:

Scope and Methodology for Network Assessments

The scope section for an internal network assessment should include the starting access level, IP ranges and subnets tested, any excluded segments, physical access details, credential assumptions, and testing methodology.

Network Overview Section

The network overview gives the reader context before they dive into findings. Include the total number of live hosts discovered, the domain structure, key services running across the network, and any notable technology in use.

This section should be two to three paragraphs. Cover what the network looks like from an attacker perspective. How many hosts responded to scanning, what operating systems were present, what the Active Directory structure looked like, and what services were exposed internally.

The goal is to give the reader a mental map of the environment before they start reading individual findings.

Attack Path Summary

The attack path summary is the most important section in an internal network pentest report. It shows the full chain from initial access to the highest level of compromise achieved.

1. Discovered default credentials on HP printer at 10.0.1.45 via Nmap service scan
2. Accessed printer admin interface - retrieved LDAP credentials stored in config
3. Used LDAP credentials to authenticate to domain as svc-print service account
4. Enumerated domain with BloodHound - identified svc-print has local admin on WKSTN-014
5. Moved laterally to WKSTN-014 using Pass-the-Hash
6. Dumped credentials from LSASS on WKSTN-014 - recovered domain admin hash
7. Used domain admin hash to authenticate to domain controller DC01
8. Executed DCSync to extract all domain password hashes

This eight-step path from network access to full domain compromise was possible due to three root causes: default credentials, password reuse, and excessive service account permissions.

Example Finding: Kerberoastable Service Account

Description: The service account svc-sql was configured with a Service Principal Name (SPN) and a weak password, making it vulnerable to Kerberoasting. Any authenticated domain user can request a Kerberos service ticket for this account and crack the password offline without triggering account lockout.

Evidence:

$ python3 GetUserSPNs.py corp.example.com/jsmith:Password1 -request -outputfile kerberoast.txt
Impacket v0.10.0 - Copyright 2022 SecureAuth Corporation

ServicePrincipalName    Name     MemberOf  PasswordLastSet
----------------------  -------  --------  -------------------
MSSQLSvc/db01:1433      svc-sql            2024-01-15 09:23:11

$krb5tgs$23$*svc-sql$CORP.EXAMPLE.COM$MSSQLSvc/db01:1433*$a8f2...
[CRACKED] svc-sql : Summer2024!

Impact: An attacker with any valid domain credentials can extract and crack the svc-sql service account password. This account has local administrator access on the database server db01, which contains production customer data. Compromise of this account provides direct access to sensitive data and a lateral movement path deeper into the network.

Remediation:

1. Change the svc-sql password to a 30+ character randomly generated password
2. Configure the account as a Group Managed Service Account (gMSA) to enable automatic password rotation
3. Remove unnecessary SPNs from service accounts that do not require them
4. Implement monitoring for Kerberoasting activity by alerting on Event ID 4769 with RC4 encryption type

Active Directory Risk Summary

Include a dedicated section summarizing all Active Directory-related risks in one place. This gives the IT team a focused view of domain-level issues.

Remediation Roadmap for Internal Network Reports

Prioritize remediation by impact and effort. A roadmap table helps the client plan their response.

For tips on automating report generation and remediation tracking, see our guide on pentest report automation.

Speed Up Your Network Report Writing

Internal network reports take the longest to write because of the number of hosts, the attack path documentation, and the Active Directory analysis. PentestReportAI lets you paste in your findings and tool outputs and generates a structured report with CVSS scoring, executive summary, attack path documentation, and remediation roadmaps. Stop spending hours on formatting and focus on the testing.