The same handful of weaknesses appear in internal penetration test reports year after year, and most of them are configuration and credential problems rather than exotic vulnerabilities. This list draws on the joint NSA and CISA advisory AA23-278A, which summarised the most common misconfigurations found by their red teams, blue teams and hunt and incident response teams across more than a thousand assessed network enclaves, mostly Windows and Active Directory estates. For each finding it explains what testers see, why it matters, how it is usually found and what fixes it for good. It is written for security leads who commission tests, the engineers who remediate them, and testers who want a common reference for reporting.
The Top 10 at a glance
The ten most common penetration test findings, how testers find them and how to fix them for good, mapped to ATT&CK, NIST SP 800-53 and CIS Controls. Each item is explained below with what to fix first.
| # | Finding | Typical consequence in a test | MITRE ATT&CK |
|---|---|---|---|
| 1 | Default and vendor credentials | Admin access to devices, consoles or apps | T1078.001 |
| 2 | Name resolution poisoning and NTLM relay | Captured hashes, relayed sessions to servers | T1557.001 |
| 3 | Kerberoastable service accounts | Offline cracking of privileged service passwords | T1558.003 |
| 4 | Weak and crackable passwords | Large share of domain hashes cracked quickly | T1110.002 |
| 5 | Credentials in shares, scripts and files | Cleartext service and admin passwords found | T1552.001, T1135 |
| 6 | Excessive privilege and shared local admin | Lateral movement with one hash | T1550.002, T1078 |
| 7 | Vulnerable AD CS templates and web enrolment | Certificates that authenticate as a domain admin | T1649 |
| 8 | Unpatched and unsupported systems | Remote code execution or local privilege escalation | T1190, T1068 |
| 9 | Flat networks | Unrestricted reach from a user VLAN to servers and OT | Enables most of the above |
| 10 | Broken access control in web apps and APIs | Reading or changing other users' data | T1190 |
1. Default and vendor credentials
The issue: network devices, printers, management consoles, databases and web applications still accept the credentials they shipped with, or a predictable variant such as admin/admin.
Why it matters: AA23-278A notes that default credentials are easy to find through a web search, and that printers and scanners often hold privileged domain accounts that can then be reused. In the Nissan source code leak, a Git server left on admin/admin exposed around 20GB of code.
How testers find it: service discovery followed by checks against vendor default lists on every login page and management protocol found.
What to do: make "change default credentials" a build gate for every device and appliance, inventory management interfaces, and audit them quarterly. See the Default Credential Breaches Lessons Guide.
2. Name resolution poisoning and NTLM relay
The issue: LLMNR and NBT-NS are left enabled and SMB signing is not required on servers and workstations.
Why it matters: a tester on the user network answers broadcast name lookups, captures NTLM authentication and either cracks it or relays it to a host that does not require signing. It is usually the first foothold in an internal test.
How testers find it: passive listening for broadcast name queries, then a check of which hosts accept unsigned SMB sessions.
What to do: disable LLMNR (Group Policy "Turn off multicast name resolution") and NetBIOS over TCP/IP; require signing with "Microsoft network server: Digitally sign communications (always)" and the matching client policy (RequireSecuritySignature = 1). Microsoft notes that signing binds the sender and recipient identities, which is what defeats relay. On Windows 11 24H2 and later, audit mode logs clients and servers that cannot sign before enforcement. See LLMNR and NBT-NS Poisoning and the NTLM Relay Guide.
3. Kerberoastable service accounts
The issue: user accounts with a service principal name (SPN), human-set passwords and membership of privileged groups.
Why it matters: any domain user can request a service ticket encrypted with the account's password hash and crack it offline. AA23-278A describes Kerberoasting as one of the most time-efficient ways to escalate privilege, and service accounts with elevated rights as a recurring finding.
How testers find it: an LDAP query for user objects with an SPN, then offline cracking of the returned tickets.
What to do: convert service accounts to group managed service accounts (gMSA) with long, automatically rotated passwords, remove privileged group membership, enforce AES-only encryption types, and retire unused SPNs. See the Kerberoasting and AS-REP Roasting Defence Guide and How to convert AD service accounts to gMSA.
4. Weak and crackable passwords
The issue: short or predictable passwords that survive complexity rules, such as season and year combinations.
Why it matters: AA23-278A reports one assessment team cracking more than 80% of a domain's user passwords within 12 hours, and highlights passwords under 15 characters as a common weakness. Weak passwords also undermine MFA where smart card accounts keep a static, usable password hash.
How testers find it: with domain admin rights, hashes are extracted and cracked offline against breach wordlists; before that, careful password spraying.
What to do: follow NIST SP 800-63B: at least 15 characters for single-factor passwords, no composition rules, no forced periodic change, and checks against a blocklist of compromised and common values. Move privileged users to phishing-resistant MFA. See the Password Policy Guide (NIST-aligned) and the Password Spraying and Credential Stuffing Defence Guide.
5. Credentials in shares, scripts and files
The issue: file shares readable by all domain users that hold scripts, configuration files, backups or spreadsheets with cleartext passwords.
Why it matters: the advisory describes shares containing cleartext service account and domain admin credentials, found with automated share crawling tools. These credentials are usually non-human: service accounts, database logins and API keys that nobody rotates.
How testers find it: share enumeration as an ordinary user, then automated search of readable files for credential patterns.
What to do: remove "Everyone" and "Domain Users" from share ACLs, run the same share crawl internally on a schedule, move secrets into a vault, and rotate anything found. See the Developer Secret Scanning Triage guide and the Active Directory ACL and Delegation Hygiene Guide.
6. Excessive privilege and shared local admin
The issue: administrators using privileged accounts for email and browsing, too many members of Domain Admins, and the same local administrator password on every workstation.
Why it matters: one compromised workstation yields a hash that works everywhere (pass the hash), and privileged sessions on ordinary endpoints leave credentials for collection. AA23-278A lists both privilege creep and day-to-day use of elevated accounts.
How testers find it: attack path mapping of group memberships and sessions, then reuse of a local admin hash across hosts.
What to do: deploy Windows LAPS, which rotates and backs up a unique local admin password per device to Active Directory or Microsoft Entra ID; separate admin accounts used only from privileged access workstations; a tiered admin model. See How to find service accounts with Domain Admin rights, the BloodHound and Active Directory Attack Path Guide and the Privileged Access Workstations Guide.
7. Vulnerable AD CS templates and web enrolment
The issue: certificate templates that let the requester supply the subject name and allow client authentication, overly broad enrolment rights, and HTTP web enrolment exposed to NTLM relay.
Why it matters: AA23-278A calls out AD CS misconfiguration as a route to fraudulent certificates and domain escalation. A certificate issued for a domain admin authenticates as that admin and survives password resets.
How testers find it: enumeration of templates, enrolment permissions and CA web endpoints with standard AD CS auditing tools.
What to do: remove "Supply in the request" from authentication templates or require manager approval, restrict enrolment to the groups that need it, require HTTPS with Extended Protection for Authentication on web enrolment or remove it. See the AD CS Security Guide.
8. Unpatched and unsupported systems
The issue: internet-facing applications with known exploited vulnerabilities, and legacy Windows hosts that cannot be patched.
Why it matters: the advisory cites exploited Telerik (CVE-2019-18935), Log4Shell in VMware Horizon (CVE-2021-44228) and Zimbra flaws, and unsupported Windows systems missing MS17-010 and MS08-067. In the ShinyHunters FBI breach claim, an unpatched PeopleSoft server is alleged to have been the way in.
How testers find it: version fingerprinting matched against vulnerability data, with safe validation of the most severe issues.
What to do: prioritise CISA Known Exploited Vulnerabilities, isolate systems that cannot be patched, and measure patch latency by exposure. See the Patch Management Guide.
9. Flat networks
The issue: user workstations can reach server management ports, databases, backup systems and sometimes OT networks directly.
Why it matters: segmentation failures turn every finding above into domain compromise. AA23-278A also notes OT networks reached through forgotten connections in environments described as air-gapped.
How testers find it: port scans from a standard user segment towards server, management and OT ranges.
What to do: restrict SMB, RDP, WinRM and database ports to admin jump hosts, separate backup infrastructure, and test the rules after every change. See the Network Segmentation Guide.
10. Broken access control in web apps and APIs
The issue: the server trusts identifiers sent by the client, so a user can read or change another user's records (insecure direct object references), or call admin functions without the right role.
Why it matters: it is the leading web application risk category in the OWASP Top 10 (2021, A01) and the leading API risk in the OWASP API Security Top 10 2023 (API1 Broken Object Level Authorization). The McHire incident combined a default password with an IDOR to expose millions of applications.
How testers find it: two test accounts at different privilege levels, swapping object IDs and replaying requests across roles.
What to do: enforce authorisation server-side on every object access, deny by default, and add cross-user tests to CI. See the API Penetration Testing Guide.
Mapping to OWASP, ATT&CK and NIST
| Finding | OWASP | NIST SP 800-53 Rev. 5 | CIS Controls v8.1 |
|---|---|---|---|
| 1. Default credentials | Top 10 2021 A07 | IA-5, CM-6 | Control 4 |
| 2. Poisoning and relay | Not applicable | CM-6, CM-7 | Control 4 |
| 3. Kerberoasting | Not applicable | IA-5, AC-6 | Control 5 |
| 4. Weak passwords | Top 10 2021 A07 | IA-5 | Control 5 |
| 5. Credentials in files | Not applicable | IA-5, AC-6 | Controls 3 and 5 |
| 6. Excessive privilege | Not applicable | AC-6, AC-6(5) | Controls 5 and 6 |
| 7. AD CS | Not applicable | CM-6, IA-5 | Control 4 |
| 8. Unpatched systems | Top 10 2021 A06 | SI-2, RA-5 | Control 7 |
| 9. Flat networks | Not applicable | SC-7 | Controls 12 and 13 |
| 10. Broken access control | Top 10 2021 A01; API1:2023 | AC-3 | Control 16 |
Penetration testing itself maps to NIST SP 800-53 CA-8 and CIS Control 18; remediation tracking maps to CA-5 (plan of action and milestones) and NIST CSF 2.0 ID.IM-02, which covers improvements identified from security tests. See the CIS Control 18 Penetration Testing Guide.
Where to start
- Remove the free first footholds: disable LLMNR and NBT-NS, require SMB signing in audit then enforce mode, and sweep for default credentials. These are cheap and break the opening move of most internal tests.
- Fix the service accounts: list SPN-bearing accounts, move them to gMSA, and strip privileged group membership. This addresses findings 3, 5 and 6 at once.
- Deploy LAPS and separate admin accounts: unique local passwords and admin-only workstations stop one hash becoming the whole estate.
- Audit AD CS: one template change can close a direct path to domain admin.
- Measure the repeat rate: track which findings reappear between tests. A finding seen twice is a process failure, not a technical one, and should go to the risk register with an owner.
- Ask testers for detection notes: AA23-278A also lists insufficient internal monitoring; record which test actions the SOC saw, and feed the gaps to detection engineering.
For turning findings into tracked work, see Reading and Acting on a Penetration Test Report Guide and the Penetration Test Remediation Tracker Template.
Standards and references
- NSA and CISA: AA23-278A Top Ten Cybersecurity Misconfigurations
- NIST: SP 800-63B Authentication and Authenticator Management
- NIST: SP 800-53 Rev. 5
- Microsoft: Overview of SMB signing
- Microsoft: Windows LAPS overview
- MITRE ATT&CK: Name Resolution Poisoning and SMB Relay
- MITRE ATT&CK: Kerberoasting
- OWASP: API Security Top 10 2023
Related NHI Mgmt Group resources: Penetration Testing Guide, Active Directory Security Checklist, Top 10 Identity Audit Findings, Penetration Test Scoping Checklist.