Network Infrastructure VAPT: Step by Step Guide
A network infrastructure VAPT runs in five steps: agree scope and written authorisation, discover and assess the devices, try to exploit what you find, test what an attacker could reach next, then report with ranked findings and retest the fixes. The sequence follows the four-phase penetration testing model in NIST SP 800-115, with a separate step for post-exploitation.
VAPT stands for vulnerability assessment and penetration testing. For network infrastructure, it means testing the routers, switches, firewalls, VPN gateways and load balancers that carry your traffic, plus the services they expose. A vulnerability assessment finds and ranks weaknesses. A penetration test then tries to exploit them to show what an attacker could really do.
A scanner alone is not enough. NIST SP 800-115 says scanners cannot find weaknesses that appear only through combinations of attack patterns, and that penetration testing is a more reliable way to judge the risk of vulnerabilities in aggregate.
This guide sets out each step, what to agree before it starts and what to expect in the report. CyberSapiens delivers vulnerability assessment and penetration testing services, and we publish this guide so that buyers and testers share the same picture. The steps are general practice, so adapt them to your own environment and scope.
The Five Steps at a Glance
NIST SP 800-115 describes penetration testing as four phases: planning, discovery, attack and reporting, with reporting carried out alongside the others. We split the attack phase into exploitation and post-exploitation, because they carry different risks and often need different approvals. PTES also treats pre-engagement and reporting as their own parts of a test.
1. Scope and authorisation
Agree what is tested, how, when and who can stop it, in writing.
2. Discovery
Map devices and services, audit configuration and scan for known weaknesses.
3. Exploitation
Try to exploit what was found, within the rules of engagement.
4. Post-exploitation
Show what an attacker could reach next if one device falls.
5. Reporting and retest
Rank findings, give fix guidance and confirm fixes worked.
Step 1: Scope and Authorisation
No testing happens in this step. NIST SP 800-115 says the planning phase is where the rules are identified, management approval is documented and the goals are set, and that it sets the groundwork for a successful test.
Define the scope
List the devices, address ranges and sites in scope, such as routers, switches, firewalls, VPN gateways and load balancers, and list what is excluded. Decide whether testing is internal, external or both, and on site or remote.
Write the rules of engagement
Record the objectives, permitted tools and techniques, testing windows, acceptable downtime, emergency contacts and a stop condition. NIST notes that testers may be prohibited from using particular tools or techniques, depending on policy.
Get written authorisation
Obtain signed approval from someone with the authority to approve testing of those systems, including any third party that owns or hosts equipment in scope. Verbal agreement is not enough.
Plan for risk
NIST says penetration testing can damage systems or leave them inoperable, so agree backups, change windows and who to call if a device stops responding.
Note: Unauthorised access to computer systems is an offence in most countries. If you are the client, ask your tester for the scope, authorisation and rules of engagement documents before work starts. A provider that skips them is a warning sign.
Step 2: Discovery
Discovery covers information gathering, scanning and vulnerability analysis, as NIST describes it. For network infrastructure it usually has three parts.
Device discovery
Map live hosts, open ports and services such as SSH, SNMP and HTTP, and identify device types and versions.
Configuration auditing
Check for insecure protocols such as Telnet and outdated SSL/TLS versions, default credentials, unnecessary services and weak administrative access.
Vulnerability scanning
Scan for outdated firmware and missing patches, then check each result by hand.
Why verify: NIST SP 800-115 says scanners produce false positives and false negatives. A scan result is a lead for the tester, not a finding.
Step 3: Exploitation
Exploitation tries to use the weaknesses found in discovery, to confirm they are real and to see what they allow. NIST says successful attacks verify the vulnerability and show which safeguards work. Some techniques can disrupt production, so each should sit inside the rules of engagement.
| Technique | What it tests | Care needed |
|---|---|---|
| Credential attacks, such as brute force or dictionary attacks on administrative interfaces | Weak or default passwords and missing lockout | Account lockouts can lock out real administrators. Agree attempt limits first. |
| Firmware exploitation | Whether outdated firmware has a usable known flaw | A failed exploit can crash a device. Prefer a test window and a recovery plan. |
| Man-in-the-middle attacks, such as ARP spoofing or DNS poisoning | Whether traffic on the segment can be intercepted or redirected | These affect other users on the segment. Get explicit approval and limit the duration. |
| Protocol weaknesses, such as Telnet or SNMPv1 | Whether credentials or configuration can be read or changed over insecure protocols | Writing to a device through SNMP changes its configuration. Agree read-only unless stated. |
NIST also notes that crafted packets can trigger a denial of service, so such tests are best run at low-traffic times.
Step 4: Post-Exploitation
NIST describes penetration testing as an iterative process that uses minimal access to gain greater access. This step shows what one compromised device would give an attacker.
Privilege escalation
Whether low-level access to a device can become administrative control.
Lateral movement
Whether the tester can reach other segments or systems from the device, and whether segmentation holds.
Data exposure
What the device reveals, such as firewall rules, VPN credentials and routing information.
Persistence
Whether an attacker could keep access, for example through a rogue administrator account or changed configuration.
Approval needed: Persistence tests change the live environment. Agree them in advance, record every change and reverse it afterwards. Where there is doubt, describe the path in the report rather than create it.
Step 5: Reporting and Retest
NIST says reporting runs alongside the other phases, with logs and periodic updates to administrators or management, and ends with a final report that describes vulnerabilities, gives a risk rating and offers mitigation guidance.
What a good report contains
Executive summary
Plain-language findings, overall exposure and the actions that matter most.
Technical findings
Each finding with the affected device, evidence, steps to reproduce, and a severity rating.
Fix guidance
Specific steps, such as patching firmware, disabling insecure protocols, tightening passwords and limiting administrative access.
Prioritisation
Findings ranked by impact and likelihood, so the team knows what to fix first.
Severity and risk
Many reports use CVSS for severity. FIRST announced CVSS v4.0 in November 2023, and scores map to low, medium, high and critical levels. FIRST has said CVSS measures the severity of a vulnerability and should not be used alone to assess risk, so a good report adds context such as exposure, the value of the device and existing controls.
Retest
A retest checks that fixes worked and did not introduce new problems. Agree in the proposal whether a retest is included and for how long, because without one you cannot confirm the result.
Common Tools
These are tools testers commonly use for network work. The list is not complete, and the right choice depends on scope and rules of engagement.
| Tool | Commonly used for | Care needed |
|---|---|---|
| Nmap | Host discovery, port scanning and service detection | Aggressive scan settings can disrupt fragile devices. |
| Nessus and OpenVAS | Vulnerability scanning for known weaknesses and missing patches | Results include false positives and need manual checking. |
| Metasploit Framework | Exploiting known vulnerabilities to confirm they are real | Exploits can crash devices. Use only inside the agreed window. |
| Responder | Capturing credentials by answering name-resolution requests on a local network | Affects other users on the segment. Needs explicit approval. |
| Custom scripts | Vendor-specific checks, for example for Cisco, Juniper and Fortinet devices | Review and test scripts in a lab before use on live devices. |
Tools find leads and automate routine work. The judgement about what is real, what matters and what is safe to try comes from the tester.
Content Reviewed By
Ketki Tidke
Cyber Security and GRC Lead Auditor
ISO 27001 Lead Auditor
Ketki is a certified ISO 27001 Lead Auditor specialised in Governance, Risk and Compliance, with experience consulting public, private, and government clients. She evaluates threats, risk impacts, and regulatory requirements across multiple industry frameworks.
Network Infrastructure VAPT: Frequently Asked Questions
What is network infrastructure VAPT?
It is vulnerability assessment and penetration testing of the devices and services that carry your network traffic, such as routers, switches, firewalls and VPN gateways. It finds weaknesses and then tries to exploit them to show the real impact.
What are the steps of a network penetration test?
NIST SP 800-115 describes four phases: planning, discovery, attack and reporting. This guide splits the attack phase into exploitation and post-exploitation, giving five steps in total, followed by a retest.
What is the difference between a vulnerability scan and a penetration test?
A scan lists known weaknesses, usually with automated tools, and can include false positives. A penetration test is largely manual and shows which weaknesses can be exploited and how they chain together.
Do we need written permission before testing?
Yes. Get signed authorisation from someone with authority over the systems, including any third party that owns or hosts equipment in scope, and agree rules of engagement before any testing starts.
Can a network penetration test disrupt our systems?
It can. NIST says penetration testing can damage systems or leave them inoperable. Agree a test window, backups, attempt limits for password attacks and a stop condition beforehand.
How long does a network VAPT take and what does it cost?
Time and cost depend on scope: the number of devices and sites, internal or external testing, depth of manual work and whether a retest is included. Ask for a written scope and a quote against it.
How often should network infrastructure be tested?
At least annually and after significant changes such as new devices, major configuration changes or new connections. Some contracts and frameworks set their own frequency.
What should the report include?
An executive summary, technical findings with evidence and severity, fix guidance, prioritisation by impact and likelihood, and a retest result after the fixes.
Need a Network Infrastructure VAPT?
Talk to CyberSapiens about your network, scope and rules of engagement. We will help you decide what to test first and what the report should cover.
Email us
[email protected]Our head office
Lvl 1 206 Lorimer St, Port Melbourne, 3207
