This document outlines a 9 level roadmap for developing red team skills. It includes recommendations for learning programming, networking, operating systems, tools like Kali Linux, Metasploit, and techniques like vulnerability assessment, buffer overflows, lateral movement, and active directory attacks at the initial levels. More advanced levels include recommendations for privilege escalation, defensive evasion, and writing custom offensive tools. The document emphasizes practical learning through courses, capture the flag exercises, and ultimately developing one's own command and control frameworks and malware.
This document outlines a 9 level roadmap for developing red team skills. It includes recommendations for learning programming, networking, operating systems, tools like Kali Linux, Metasploit, and techniques like vulnerability assessment, buffer overflows, lateral movement, and active directory attacks at the initial levels. More advanced levels include recommendations for privilege escalation, defensive evasion, and writing custom offensive tools. The document emphasizes practical learning through courses, capture the flag exercises, and ultimately developing one's own command and control frameworks and malware.
This document outlines a 9 level roadmap for developing red team skills. It includes recommendations for learning programming, networking, operating systems, tools like Kali Linux, Metasploit, and techniques like vulnerability assessment, buffer overflows, lateral movement, and active directory attacks at the initial levels. More advanced levels include recommendations for privilege escalation, defensive evasion, and writing custom offensive tools. The document emphasizes practical learning through courses, capture the flag exercises, and ultimately developing one's own command and control frameworks and malware.
This document outlines a 9 level roadmap for developing red team skills. It includes recommendations for learning programming, networking, operating systems, tools like Kali Linux, Metasploit, and techniques like vulnerability assessment, buffer overflows, lateral movement, and active directory attacks at the initial levels. More advanced levels include recommendations for privilege escalation, defensive evasion, and writing custom offensive tools. The document emphasizes practical learning through courses, capture the flag exercises, and ultimately developing one's own command and control frameworks and malware.
Gaining access to a client workstation or a server is only the first step in a typical penetration test. Once we gain initial access, our goal is to compromise more of the organization’s assets, either to obtain more privileged access, or gain access to confidential information.
CRTP/CRTPE (Pentest Academy Courses) & Active directory Attacks and lateral movement (TCM Security courses) Stolen credentials Some command, options, modules need Privilege local Admin such as Dumping Hashes, persistence, lateral movement, Example: add user to group admin, need local admin privilege and some enumeration required admin local. Also Enable and disable some production need admin local.
- Local Administrator Snapshot SAM
- Local Administrator LAPS
Mimikatz
Processing Credentials Offline
Lateral Movement Some command, options, modules need Privilege local Admin such as Dumping Hashes, persistence, lateral movement, Example: add user to group admin, need local admin privilege and some enumeration required admin local. Also Enable and disable some production need admin local.
There are only a few known lateral movement techniques against
Windows that reuse stolen credentials such as PsExec, WMI, DCOM, and PSRemoting
Some require clear text credentials and others work with a password hash like crackmapexec
they all require local administrator access to the target machine.
Pass The hash / password 3
Token Impersonation
Attacks
Local Network Attacks: LLMNR and NBT-NS Poisoning
SMB Relay Attack
IPv6 Attacks (Fake DHCP Server)
Kerberos Delegation Attacks
Spoofing SSDP and UPnP Devices with EvilSSDP
Post-Compromise Enumeration But before performing any attack using those credentials, it is possible and necessary to perform advanced enumeration, based on the privileges of the obtained vectors
include Privilege's Escalation and Lateral movement and AD
Level 5
Book 1: Red Team Development and Operation (SANS SEC564 Red Team Operation) .هذا الكتاب هو تتويج لسنوات من الخبرة في مجال تكنولوجيا المعلومات والأمن السيبراني توجد مكونات هذا الكتاب كملاحظات تقريبية وأفكار وعمليات رسمية طورها المؤلفون تم.واعتمدوها أثناء قيادتهم وتنفيذ ارتباطات الفريق الأحمر على مدار سنوات عديدة استخدام المفاهيم الموضحة في هذا الكتاب للتخطيط الناجح وتقديم وتنفيذ مشاركات تم توثيق بعض هذه المفاهيم ودمجها.الفريق الأحمر الاحترافية بجميع الأحجام والتعقيدات .في عمليات إدارة الفريق الأحمر
ENGAGEMENT PLANNING
Roles and responsibilities
Rules of Engagement (ROE)
Thread planning
ENGAGEMENT EXECUTION
Execution's concept
Command and control server (C2)
ENGAGEMENT CULMINATION
ENGAGEMENT REPORTING
Book 2: Hands_On_Red_Team_Tactics_A_practical_guide_to_mastering_Red_Team. (Red team practices with Command and control server)
Level 6
Before Sektor7 courses i highly recommended to read this books:
First Book: Malware Analysis And Detection Engineering
Second book: Learning Malware Analysis Explore the concepts, tools, and techniques
sektor7 about RED team and malware developmen
Write your own offensive Tools and bypass defenders
Process Injection and Code Injections
DLL Injection / Reflected DLL Injection
Write Your own Dropper
Process Unhooking
API hooking
Module Stomping / PPID Spoof / Command line Spoof
Detected Debuggers / dynamic analysis sandboxs
anti-static & API hashing
Level 7
Cobalt Strike Course: Raphael Mudge Cobalt strike red team course Red Team Ops with Cobalt Strike (1 of …
Level 8
zeropointsecurity course red team OPS I and Red Team OPS II
Zero-Point Security
RED TEAM OPS I
Command and control
Initial Compromise
Host reconnaissance
Host persistence
Host privilege escalation
and a lot of things .......
RED TEAM OPS II
Defensive Evasion
EDR Evasion
C2 infrastructure
Process Injection Level 9
Exploit Development
Exploits shellcode handbook Book and gray hat book and the hacking art of exploit book, and OSED course. for finding and writing your own exploits (3 Books and OSED Course)
Level 10
read Sparc Flow books "How to hack like a legend & how to hack like a pornstar"
