Awesome-Red-Teaming - List of Awesome Red Teaming Resources

项目说明

This List is no longer updated.

Awesome Red Teaming

List of Awesome Red Team / Red Teaming Resources

This list is for anyone wishing to learn about Red Teaming but do not have a starting point.

Anyway, this is a living resources and will update regularly with latest Ad Tactics and Techniques based on Mitre ATT&CK

You can help by sending Pull Requests to add more information.

Table of Contents
=================

* Initial Access
* Execution
* Persistence
* Pri Escalation
* Defense E
* Credential Access
* Discovery
* Lateral Mo
* Collection
* Exfiltration
* Command and Control
* Embedded and Peripheral Devices Hacking
* Misc
* RedTeam Gadgets
* Ebooks
* Training
* Certification

↑ Initial Access

* The Hitchhiker’s Guide To Initial Access
* How To: Empire’s Cross Platform Office Macro
* Phishing with PowerPoint
* PHISHING WITH EMPIRE
* Bash Bunny
* OWASP Presentation of Social Engineering - OWASP
* USB Drop Attacks: The Danger of “Lost And Found” Thumb Drives
* Weaponizing data science for social engineering: Automated E2E spear phishing on Twitter - Defcon 24
* Cobalt Strike - Spear Phishing documentation
* Cobalt Strike Blog - What's the go-to phishing technique or exploit?
* Spear phishing with Cobalt Strike - Raphael Mudge
* EMAIL RECONNAISSANCE AND PHISHING TEMPLATE GENERATION MADE SIMPLE
* Phishing for access
* Excel macros with PowerShell
* PowerPoint and Custom Actions
* Macro-less Code Exec in MSWord
* Multi-Platform Macro Phishing Payloads
* Abusing Microsoft Word Features for Phishing: “subDoc”
* Phishing Against Protected View
* POWERSHELL EMPIRE STAGERS 1: PHISHING WITH AN OFFICE MACRO AND E AVS
* The PlugBot: Hardware Botnet Research Project
* Luckystrike: An E Document Generator
* The Absurdly Underestimated Dangers of CS
* Macroless DOC malware that avoids detection with Yara rule
* Phishing between the app whitelists
* Executing Metasploit & Empire Payloads from MS Office Document Properties (part 1 of 2)
* Executing Metasploit & Empire Payloads from MS Office Document Properties (part 2 of 2)
* Social Engineer Portal
* 7 Best social Engineering attack
* Using Social Engineering Tactics For Big Data Espionage - RSA Conference Europe 2012
* USING THE DDE ATTACK WITH POWERSHELL EMPIRE
* Phishing on Twitter - POT
* Microsoft Office – NTLM Hashes
* Defense-In-Depth write-up
* Spear Phishing 101

↑ Execution

* Research on CMSTP.exe,
* Windows oneliners to download remote payload and execute arbitrary code
* Executing Commands and Bypassing AppLocker with PowerShell Diagnostic Scripts
* WSH Injection: A Case Study
* Gscript Dropper

↑ Persistence

* A View of Persistence
* hiding registry keys with psreflect
* Persistence using RunOnceEx – Hidden from Autoruns.exe
* Persistence using GlobalFlags in Image File Execution Options – Hidden from Autoruns.exe
* Putting data in Alternate data streams and how to execute it – part 2
* WMI Persistence with Cobalt Strike
* Le INF-SCT Fetch & Execute Techniques For Bypass, E, & Persistence
* Le INF-SCT Fetch & Execute Techniques For Bypass, E, & Persistence (Part 2)
* : Abusing the Shadow Service for E, Persistence, and Acti Database Extraction

↑ Pri Escalation

User Account Control Bypass

* First entry: Welcome and fileless UAC bypass,
* Exploiting En in Scheduled Tasks for UAC Bypass,
* Reading Your Way Around UAC in 3 parts:
Part 1.
Part 2.
Part 3.
* Bypassing UAC using App Paths,
* "Fileless" UAC Bypass using sdclt.exe,
* UAC Bypass or story about three escalations,
* "Fileless" UAC Bypass Using e.exe and Registry Hijacking,
* Bypassing UAC on Windows 10 using Disk Cleanup,
* Using IARPUninstallStringLauncher COM interface to bypass UAC,
* Fileless UAC Bypass using sdclt
* E File-less UAC Bypass CNA
* Windows 7 UAC whitelist

Escalation

* Windows Pri Escalation Checklist
* From Patch Tuesday to DA
* A Path for Pri Escalation

↑ Defense E

* Window 10 Device Guard Bypass
* App Locker ByPass List
* Window Signed Binary
* Bypass Application Whitelisting Script Protections - Regsvr32.exe & COM Scriptlets (.sct files)
* Bypassing Application Whitelisting using MSBuild.exe - Device Guard Example and Mitigations
* Empire without powershell
* Powershell without Powershell to bypass app whitelist
* MS Signed mimikatz in just 3 steps
* Hiding your process from sysinternals
* code signing certificate cloning attacks and defenses
* userland api monitoring and code injection detection
* In memory e
* Bypassing AMSI via COM Ser
* process doppelganging
* Week of E Microsoft ATA - Announcement and Day 1 to Day 5
* AES ENCRYPTED HTTPKEY REQUEST: SAND-BOX E
* Putting data in Alternate data streams and how to execute it
* AppLocker – Case study – How insecure is it really? – Part 1
* AppLocker – Case study – How insecure is it really? – Part 2
* Harden Windows with AppLocker – based on Case study part 2
* Harden Windows with AppLocker – based on Case study part 2
* Office 365 Safe links bypass
* Windows Defender Attack Surface Reduction Rules bypass
* Bypassing Device guard UMCI using CHM – C
* Bypassing Application Whitelisting with BGInfo
* Cloning and Hosting E Portals using a Wifi PineApple
*
* Executing Commands and Bypassing AppLocker with PowerShell Diagnostic Scripts
* ma.exe Functionality Deconstructed

↑ Credential Access

* Windows Access Tokens and Alternate credentials
* Bringing the hashes home with reGeorg & Empire
* Intercepting passwords with Empire and winning
* Local Administrator Password Solution (LAPS) Part 1
* Local Administrator Password Solution (LAPS) Part 2
* USING A SCF FILE TO GATHER HASHES
* Remote Hash Extraction On Demand Via Host Security Descriptor Modification
* Offensi Data Storage
* Practical guide to NTLM Relaying
* Dump Clear-Text Passwords for All Admins in the Domain Using Mimikatz DCSync
* Dumping Domain Password Hashes

↑ Discovery

* Red Team Operating in a Modern En
* My First Go with BloodHound
* Introducing BloodHound
* A Red Teamer’s Guide to GPOs and OUs
* Automated Deri Administrator Search
* A Pentester’s Guide to Group Scoping
* Local Group Enumeration
* The PowerView PowerUsage Series #1 - Mass User Profile Enumeration
* The PowerView PowerUsage Series #2 – Mapping Computer Shortnames With the Global Catalog
* The PowerView PowerUsage Series #3 – Enumerating GPO edit rights in a foreign domain
* The PowerView PowerUsage Series #4 – Finding cross-trust ACEs
* Aggressor PowerView
* Lay of the Land with BloodHound
* Scanning for Acti Pri & Pri Accounts
* Microsoft LAPS Security & Acti LAPS Configuration Recon
* Trust Direction: An Enabler for Acti Enumeration and Trust Exploitation
* SPN Discovery

↑ Lateral Mo

* A Citrix Story
* Jumping Network Segregation with RDP
* Pass hash pass ticket no pain
* Abusing DNSAdmins pri for escalation in Acti
* Using SQL Server for attacking a Forest Trust
* Extending BloodHound for Red Teamers
* OPSEC Considerations for beacon commands
* My First Go with BloodHound
* Kerberos Party Tricks: Weaponizing Kerberos Protocol Flaws
* Lateral mo using excel application and dcom
* Lay of the Land with BloodHound
* The Most Dangerous User Right You (Probably) Ha Heard Of
* Agentless Post Exploitation
* A Guide to Attacking Domain Trusts
* Pass-the-Hash Is Dead: Long LierPolicy
* Targeted Kerberoasting
* Kerberoasting Without Mimikatz
* Abusing GPO Permissions
* Abusing Acti Permissions with PowerView
* Roasting AS-REPs
* Getting the goods with CrackMapExec: Part 1
* Getting the goods with CrackMapExec: Part 2
* DiskShadow: The Return of , Persistence, and Acti Database Extraction
* Abusing Exported Functions and Exposed DCOM Interfaces for Pass-Thru Command Execution and Lateral Mo
* a guide to attacking domain trusts
* Outlook Home Page – Another Ruler
* Outlook Forms and Shells
* Abusing the COM Registry Structure: CLSID, LocalServer32, & InprocServer32
* LethalHTA - A new lateral mo technique using DCOM and HTA
* Abusing DCOM For Yet Another Lateral Mo Technique

↑ Collection

* Accessing clipboard from the lock screen in Windows 10 Part 1
* Accessing clipboard from the lock screen in Windows 10 Part 2

↑ Exfiltration

* DNS Data exfiltration — What is this and How to use?
* DNS Tunnelling
* sg1: swiss army knife for data encryption, exfiltration & covert communication
* Data Exfiltration over DNS Request Covert Channel: DNSExfiltrator
* DET (extensible) Data Exfiltration Toolkit
* Data Exfiltration Injection Part1

↑ Command and Control

Domain Fronting

* Empre Domain Fronting
* Escape and E Egressing Restricted Networks - Tom Steele and Chris Patten
* Finding Frontable Domain
* TOR Fronting – Utilising Hidden Services for Privacy
* Simple domain fronting PoC with GAE C2 server
* Domain Fronting Alternate Domains
* Finding Domain frontable Azure domains - thoth / Fionnbharr ()
* Google Groups: Blog post on finding 2000+ Azure domains using Censys
* Red Team Insights on HTTPS Domain Fronting Google Hosts Using Cobalt Strike
* SSL Domain Fronting 101
* How I Identified 93k Domain-Frontable CloudFront Domains
* CloudFront SSL Domains
* CloudFront Hijacking
* CloudFrunt GitHub Repo

Connection Proxy

* Redirecting Cobalt Strike DNS Beacons
* Apache2Mod Rewrite Setup
* Cobalt Strike HTTP C2 Redirectors with Apache mod_rewrite
* High-reputation Redirectors and Domain Fronting
* Cloud-based Redirectors for Distributed Hacking
* Combatting Incident Responders with Apache mod_rewrite
* Operating System Based Redirection with Apache mod_rewrite
* Invalid URI Redirection with Apache mod_rewrite
* Strengthen Your Phishing with Apache mod_rewrite and Mobile User Redirection
* mod_rewrite rule to evade sandboxes
* Expire Phishing Links with Apache RewriteMap
* Serving random payloads with NGINX
* Mod_Rewrite Automatic Setup
* Hybrid Cobalt Strike Redirectors
* Expand Your Horizon Red Team – Modern SAAS C2
* RTOps: Automating Redirector Deployment With Ansible

Web Services

* C2 with Dropbox
* C2 with gmail
* C2 with twitter
* Office 365 for Cobalt Strike C2
* Red Team Insights on HTTPS Domain Fronting Google Hosts Using Cobalt Strike
* A stealthy Python based Windows backdoor that uses Github as a C&C server
* External C2 (Third-Party Command and Control)
* Cobalt Strike o C2 – beacon home in the most obscure ways
* External C2 for Cobalt Strike
* External C2 framework for Cobalt Strike
* External C2 framework - GitHub Repo
* Hiding in the Cloud: Cobalt Strike Beacon C2 using Amazon APIs
* Exploring Cobalt Strike's ExternalC2 framework

Application Layer Protocol

* C2 WebSocket
* C2 WMI
* C2 Website
* C2 Image
* C2 Ja
* C2 WebInterface
* C2 with DNS
* C2 with https
* C2 with webdav
* Introducing Merlin — A cross-platform post-exploitation HTTP/2 Command & Control Tool
* InternetExplorer.Application for C2

Infrastructure

* Automated Red Team Infrastructure Deployment with Terraform - Part 1
* Automated Red Team Infrastructure Deployment with Terraform - Part 2
* Red Team Infrastructure - AWS Encrypted EBS
* 6 RED TEAM INFRASTRUCTURE TIPS
* How to Build a C2 Infrastructure with Digital Ocean – Part 1
* Infrastructure for Ongoing Red Team Operations
* Attack Infrastructure Log Aggregation and Monitoring
* Randomized Malleable C2 Profiles Made Easy
* Migrating Your infrastructure
* ICMP C2
* Using WebDA as a covert channel
* Safe Red Team Infrastructure
* EGRESSING BLUECOAT WITH COBALTSTIKE & LET'S ENCRYPT
* Command and Control Using Acti
* A for Distributed Red Team Operations
* Designing Effecti Red Team Attack Infrastructure
* Serving Random Payloads with Apache mod_rewrite
* Mail Servers Made Easy
* Securing your Empire C2 with Apache mod_rewrite
* Automating Gophish Releases With Ansible and Docker
* How to Write Malleable C2 Profiles for Cobalt Strike
* How to Make Communication Profiles for Empire
* A Brave New World: Malleable C2
* Malleable Command and Control

↑ Embedded and Peripheral Devices Hacking

* Gettting in with the Proxmark3 & ProxBrute
* Practical Guide to RFID Badge copying
* Contents of a Physical Pentester Backpack
* MagSpoof - credit card/magstripe spoofer
* Wireless Keyboard Sniffer
* RFID Hacking with The Proxmark 3
* Swiss Army Knife for RFID
* Exploring NFC Attack Surface
* Outsmarting smartcards
* Reverse engineering HID iClass Master keys
* Android Open Pwn Project (AOPP)

↑ Misc

* Red Tips of Vysec
* Cobalt Strike Tips for 2016 ccde red teams
* Models for Red Team Operations
* Planning a Red Team exercise
* Raphael Mudge - Dirty Red Team tricks
* introducing the ad resilience methodology part 1
* introducing the ad resilience methodology part 2
* Responsible red team
* Red Teaming for Pacific Rim CCDC 2017
* How I Prepared to Red Team at PRCCDC 2015
* Red Teaming for Pacific Rim CCDC 2016
* Responsible Red Teams
* Awesome-CobaltStrike
* RedTeaming from Zero to One Part-1 Part-2

↑ RedTeam Gadgets

#### Network Implants
* LAN Tap Pro
* LAN Turtle
* Bash Bunny
* Key Croc
* Packet Squirrel
* Shark Jack
#### Wifi Auditing
* WiFi Pineapple
* Alpha Long range Wireless USB
* Wifi-Deauth Monster
* Crazy PA
* Signal Owl
#### IoT
* BLE Key
* Proxmark3
* Zigbee Sniffer
* Attify IoT Exploit kit
#### Software Defined Radio - SDR
* HackRF One Bundle
* RTL-SDR
* YARD stick one Bundle
* Ubertooth
#### Misc
* Key Grabber
* Magspoof
* Poison tap
* keysweeper
* USB Rubber Ducky
* Screen Crab
* O.MG Cable
* Keysy
* Dorothy for Okta SSO

↑ Ebooks

* Next Generation Red Teaming
* Targeted Cyber Attack
* Ad Penetration Testing: Hacking the World's Most Secure Networks
* Social Engineers' Playbook Practical Pretexting
* The Hacker Playbook 3: Practical Guide To Penetration Testing
* How to Hack Like a PORNSTAR: A step by step process for breaking into a BANK

↑ Training ( Free )

* Tradecraft - a course on red team operations
* Ad Threat Tactics Course & Notes
* FireEye - a whiteboard session on red team operations

#### Home Lab
* Building an Effecti Directory Lab En for Testing
* Setting up DetectionLab
* - Script to make your home AD Lab

↑ Certification

* CREST Certified Simulated Attack Specialist
* CREST Certified Simulated Attack Manager
* SEC564: Red Team Operations and Threat Emulation
* ELearn Security Penetration Testing eXtreme
* Certified Red Team Professional
* Certified Red Teaming Expert
* PentesterAcademy Certified Enterprise Security Specialist (PACES)

项目信息

开发语言：未知

Star 数：8118

技术要点

该项目属于红蓝攻防方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕List of Awesome Red Teaming Resources展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。

从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。

使用与学习建议

1. 下载源码压缩包，解压到本地环境。

2. 根据项目类型准备对应的运行环境与依赖。

3. 按照 README 中的步骤完成配置与部署。

4. 在隔离的测试环境中运行验证，避免影响生产系统。

免责声明

本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。