Red Team Resources Cheatsheet

Disclaimer

IMPORTANT: This resource is for educational and authorized testing purposes only. Unauthorized use of these techniques is illegal and unethical. Always obtain proper permissions before conducting any security testing.

Introduction

Red teaming is an advanced penetration testing methodology that simulates real-world adversary behaviors to comprehensively assess an organization’s security posture.

Reconnaissance

Information Gathering Tools

  • OSINT Tools:
    • Maltego
    • Recon-ng
    • theHarvester
    • Shodan
    • Censys
    • Netlas.io
    • Google Dorks

Network Scanning

  • Scanning Tools:
    • Nmap
    • Zmap
    • Masscan
    • Netcat
    • Fierce DNS enumeration
    • Good ol’ Python

Social Media & Email Reconnaissance

  • People Tracking:
    • LinkedIn Sales Navigator
    • Hunter.io
    • Clearbit Connect
    • Social-Searcher
    • linkedin2username

Resource Development

Infrastructure Setup

  • Anonymous Infrastructure:
    • VPS Providers (DigitalOcean, Vultr)
    • Domain Generation Algorithms (DGA)
    • Domain Fronting techniques
    • Tor Network
    • VPN Services
    • Domain Categorization

Payload Development

  • Payload Creation Tools:
    • Metasploit Framework
    • Veil-Evasion
    • SharpShooter
    • Unicorn
    • Shellter
    • ScareCrow
    • Inceptor

Initial Access

Phishing Techniques

  • Phishing Frameworks:
    • Gophish
    • SET (Social Engineering Toolkit)
    • King Phisher
    • Evilginx2

Exploitation Vectors

  • Initial Access Methods:
    • Spear Phishing
      • Direct Send
    • Microsoft Teams
    • Vishing
    • Watering Hole Attacks
    • Credential Harvesting
    • Drive-by Downloads
    • Exploit Kits

Execution

Payload Execution Strategies

  • Execution Techniques:
    • Living off the Land (LOLBins)
    • PowerShell Empire
    • Cobalt Strike
    • Meterpreter
    • WMI Execution

Persistence

Maintaining Access

  • Persistence Mechanisms:
    • Registry Modifications
    • Scheduled Tasks
    • WMI Event Subscriptions
    • Service Creation
    • Startup Folder Manipulation
    • SSH Authorized Keys

Privilege Escalation

Elevation Techniques

  • Windows Escalation:

    • Kernel Exploits
    • Misconfigured Services
    • Unquoted Service Paths
    • Token Manipulation
    • RunAs

  • Linux Escalation:

    • SUID Binaries
    • Sudo Misconfigurations
    • Kernel Exploits
    • Cron Job Hijacking

Defense Evasion

Avoiding Detection

  • Evasion Techniques:
    • Antivirus Bypass
    • Obfuscation
    • Process Injection
    • Memory-Based Attacks
    • Sandbox Detection
    • Rootkit Techniques

Tools

  • Veil-Evasion
  • Shellter
  • Metasploit Encoders
  • Phantom-Evasion

Credential Access

Credential Harvesting

  • Windows:

    • Mimikatz
    • PowerSploit
    • Windows Credential Editor
    • LaZagne

  • Linux:

    • Mimipenguin
    • LaZagne
    • ProcDump

Discovery

Network & System Enumeration

  • Enumeration Tools:
    • PowerView
    • BloodHound
    • ADRecon
    • Enum4linux
    • Windows Sysinternals Suite

Lateral Movement

Spreading Techniques

  • Movement Methods:
    • Pass-the-Hash
    • WMI
    • PSExec
    • RDP Hijacking
    • SSH Tunneling
    • Remote Code Execution

Collection

Data Gathering

  • Collection Techniques:
    • Keylogging
    • Screen Capturing
    • Network Sniffing
    • Browser History Extraction
    • Document Harvesting

Command and Control (C2)

C2 Frameworks

  • Cobalt Strike
  • Empire
  • Metasploit
  • Covenant
  • Merlin
  • AsyncRAT

C2 Communication Strategies

  • DNS Tunneling
  • HTTPS Beaconing
  • Domain Fronting
  • Encrypted Channels

Exfiltration

Data Extraction Methods

  • Exfiltration Techniques:
    • HTTPS/DNS Tunneling
    • FTP/SFTP
    • Email Exfiltration
    • Cloud Storage Uploads
    • Steganography

Impact

Final Objectives

  • Potential Impact Scenarios:
    • Data Destruction
    • System Compromise
    • Business Interruption
    • Reputation Damage
    • Financial Loss Simulation
  • Always obtain written permission
  • Follow ROE (Rules of Engagement)
  • Maintain strict confidentiality
  • Document all activities
  • Provide comprehensive reporting

Remember: Continuous learning and ethical practice are key in red teaming.