> ## Documentation Index
> Fetch the complete documentation index at: https://docs.d0pam1ne.blackhatethicalhacking.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Internal Attacks

> Step 3: evidence-driven attacks on what internal recon proved, through the pivot.

**Internal Attacks** take what [Internal Recon](https://docs.d0pam1ne.blackhatethicalhacking.com/beacon/internal-recon.md) proved and run the tools that apply to it, through the same beacon pivot. Open **Internal Pentest, Internal Attacks** and pick the beacon.

## What it needs first

The planner only runs on fresh evidence. It needs a completed [Discover Assets](https://docs.d0pam1ne.blackhatethicalhacking.com/beacon/discover-assets.md) sweep on the selected beacon, and a completed (or usable Partial) Internal Recon on that beacon and site from the last 24 hours with its service and live-web stages done. Existing assets in the project alone do not unlock a beacon: it needs its own sweep.

## What runs

* One broad **nuclei** HTTP template pass, so the same templates are not repeated across focused, all and KEV subsets.
* **Parameter DAST**, switched on separately.
* **ffuf** against a bounded path list.
* **testssl** as a targeted HTTPS follow-up.

Automated HTTP traffic crosses a scoped HTTP to SOCKS bridge through the selected pivot. Heavy injection suites, DNS and raw-socket, headless and code templates are left out of this first tier. Missing tools or wordlists link straight to the Tools page.

## Results

Findings land in **Needs Review**, tagged Internal and filed under the beacon's site, and out-of-band callbacks keep their evidence and network metadata. The page shares the recon run view (ticker, pipeline, meters, charts, elapsed time, Stop and JSON exports). Manual commands and their input files are available too: run them yourself and import the output as Internal for the beacon's site.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.