You get the call: initial access is granted, a low-privilege domain user account and a jump box, go find out what a real attacker could do from here. First internal engagement. The temptation is immediate and it's the same one almost everyone has: dump credentials, pass the hash, chase domain admin as fast as possible, because that's the finding that makes the report look impressive and the client remember your name.
That impatience is exactly how internal assessments go wrong, in one of two ways. The first: you find a credential fast and pivot on it before you've mapped what it can actually reach, so you spend hours chasing a path that dead-ends, while the route that actually leads to domain admin, an over-permissioned service account nobody remembers exists, a GPO nobody's audited in years, sits completely unmapped for the entire engagement because you never looked for it. The second: you run a well-known dumping tool or an obvious lateral movement technique before you've built any real picture of what's actually being monitored, and you trip EDR or SIEM alerting on hour one of a multi-day engagement, burning both the foothold and the element of surprise the rest of the assessment depended on.
The discipline that actually works runs in the opposite order: enumerate before you touch anything that changes state. Map trust relationships, group memberships, who has local admin where, what's genuinely reachable from the current foothold, before a single credential-dumping tool runs. That mapping is the difference between "I have a domain user account" and "I know the three-hop path from this box to domain admin, and I know which of those three hops a real attacker would actually take, because it's the one nobody's watching." It's slower at the start. It's also the only version of the engagement that reliably finds the path that matters instead of the path that was easiest to find first.
And then there's the part beginners underrate the most: the report. A pentest that lands domain admin and hands the client a screenshot of whoami /priv and a wall of raw tool output is a pentest that gets skimmed, filed, and forgotten, because nobody on the client's side can turn "we got domain admin" into a fixed environment without someone doing the translation work: which specific misconfiguration enabled which specific step, in an order their engineers can actually act on and remediate. The technical win and the useful deliverable are not the same thing, and the gap between them is where a surprising amount of the actual value of an internal pentest lives.
Codelivly's Internal Network Penetration Testing Book + Labs walks the full arc in that order, enumeration, lateral movement, then turning what you found into a report a client can actually use, instead of leaving that discipline for you to learn the hard way on your first real engagement.
