The interview question that trips up junior red teamers: what do you check before Mimikatz?

An interview for a junior red team or pentest role, somewhere past the resume small talk: "You're dropped onto a Windows workstation on an internal network with valid low-privilege creds. Walk me through the first ten minutes."

A lot of candidates answer with a tool. Mimikatz to dump credentials, Responder to poison LLMNR, BloodHound to map the domain. All real tools, all wrong as a first answer, because every one of them assumes you already know things you haven't checked yet: is this even a domain-joined box, where's the DC, is there a domain at all versus a flat workgroup network.

Confirm the domain before attacking it. A quick systeminfo check and the domain environment variable tell you in seconds whether you're looking at Active Directory or a standalone workgroup, and that changes almost everything downstream. Skipping this and assuming "internal network" means "Active Directory" is a common beginner mistake, and it's the kind of gap an interviewer notices immediately.

Passive before active, every time. Checking the local ARP cache on the box you already have access to costs nothing and reveals what else is on the segment without a single packet you didn't already have a legitimate reason to send. DNS cache, existing SMB sessions, what's already cached in memory, all of it is recon you get for free before you touch a tool that generates traffic a defender's SIEM will notice.

Anonymous and null sessions still matter. A null SMB session or unauthenticated LDAP bind against the DC, when it's still open, hands over user lists, password policy and group membership without a single authentication attempt logged against a real account. Less common on a hardened domain than it used to be, but checking costs nothing.

Only then does Responder or Mimikatz make sense. Poisoning LLMNR on a network you haven't mapped is loud and can trip an alert before you've learned anything useful. Dumping credentials before confirming what a box actually has access to burns your one shot at looking quiet, for information you might not even need yet.

The honest interview answer isn't a tool name, it's a sequence: confirm the domain, do the recon that costs nothing, check what's already open before you touch what makes noise.

Codelivly's Red Team Book for Beginners builds exactly this recon-before-action discipline into its labs: https://resources.codelivly.com/product/red-team-operator-l1/. The free Recon & Enumeration Tools learning path and Active Directory Fundamentals room are a good place to drill the enumeration half first: https://codelivly.com/learning-paths/recon-enumeration-tools