Internal Network Enumeration Post-Compromise

You have a stable foothold on an internal host. Plan a thorough internal network enumeration campaign to discover targets for lateral movement.

**Host Discovery**
- How do you discover live hosts on the local subnet without running noisy port scans?
- What do ARP tables, DNS cache, and /etc/hosts or Windows hosts file reveal?
- How do you use native tools for host discovery? (ping, arp, nslookup, net commands)

**Service & Role Discovery**
- How do you identify servers by role? (file server, mail server, database, DC, backup server)
- What does examining DHCP leases reveal about the network?
- How do you find web servers, databases, and internal portals without a scanner?

**Active Directory Discovery from a Member Host**
- What can `net.exe` commands reveal without LDAP access?
- How do you identify the Domain Controller address, domain name, and domain SID from a domain-joined machine?
- What does `dsquery` provide on a domain-joined host?

**Network Shares & File Discovery**
- How do you enumerate accessible network shares from your foothold?
- What does a share named "IT$", "backup", or "ADMIN$" typically contain?
- How do you search shares for sensitive files quickly?

**Internal Services Discovery**
- How do you find internal web applications that are not externally accessible?
- What indicators suggest a host runs MSSQL, Oracle, or other database services?
- How do you identify internal certificate authorities?

Output:
- Native tool enumeration commands (Windows + Linux)
- High-value target identification checklist
- Scan approach for minimal network noise