Post-exploitation and Lateral Movement
This chapter covers what happens after a system is compromised. You will learn lateral movement and pivoting, persistence, data-exfiltration concepts, and the essential cleanup and restoration that ends a responsible engagement.
Lateral movement and pivoting
After compromising one host, a tester often uses it as a foothold to reach systems that were not directly accessible, a technique called lateral movement or pivoting. This may involve tunneling traffic through the compromised host to internal segments. Demonstrating lateral movement shows how far an attacker could reach, which informs network segmentation and monitoring improvements.
Persistence
Persistence is the ability to maintain access to a compromised system over time, for example surviving reboots or credential changes. In a test, establishing persistence demonstrates the potential impact of a breach, but every persistence mechanism must be carefully documented so it can be fully removed afterward, leaving no new weakness behind.
Data exfiltration concepts
Testers may demonstrate, within scope, how data could be moved out of an environment to show the business impact of a compromise. This is done carefully and only with authorization, using representative rather than genuinely sensitive data where possible. Understanding exfiltration paths helps defenders deploy monitoring and data-loss controls.
Cleanup and restoration
A responsible engagement ends by returning the environment to its original state. Cleanup removes tools, test accounts, persistence mechanisms, and other artifacts the tester introduced, so no new exposure is left behind. Thorough restoration, documented and confirmed with the client, is a professional obligation distinct from the client's own work to remediate the vulnerabilities that were found.