Red Team
Red team simulates attacks. The goal is to find vulnerabilities before real attackers do. Red teamers think like adversaries - they chain exploits, bypass defenses, and see how far they can get.
What Red Team Does
- Reconnaissance - Gather information about the target (OSINT, DNS enumeration, subdomain discovery)
- Scanning - Identify live hosts, open ports, running services (nmap, masscan)
- Enumeration - Deep-dive into services to find versions, configs, and potential attack vectors
- Exploitation - Use vulnerabilities to gain access (Metasploit, manual exploits, CVE-specific attacks)
- Privilege Escalation - Move from low-privilege user to root/admin (SUID abuse, misconfigured sudo, kernel exploits)
- Lateral Movement - Pivot from one compromised machine to others in the network (pass-the-hash, SMB relay, RDP)
- Persistence - Maintain access across reboots and password changes (cron jobs, registry keys, web shells)
- Exfiltration - Steal data without being detected (DNS tunneling, HTTPS beacons, encrypted archives)
Methodologies
PTES (Penetration Testing Execution Standard)
Seven phases: pre-engagement, intelligence gathering, threat modeling, vulnerability analysis, exploitation, post-exploitation, reporting. The classic pentest framework.
MITRE ATT&CK
Knowledge base of adversary tactics and techniques. Not a methodology itself, but a framework for understanding and categorizing attacks. Each technique has a unique ID (e.g., T1059 Command and Scripting Interpreter).
Cyber Kill Chain
Lockheed Martin's seven-stage model: recon, weaponize, deliver, exploit, install, command and control, actions on objectives. Older than ATT&CK and less granular, but still widely referenced.
Tools
| Tool | Purpose | Example |
|---|---|---|
| nmap | Network scanning and enumeration | nmap -sV -sC -p- 10.10.10.5 |
| Metasploit | Exploitation framework | use exploit/windows/smb/ms17_010_eternalblue |
| Burp Suite | Web application testing | Intercept requests, fuzz parameters |
| gobuster | Directory and subdomain brute force | gobuster dir -u http://target -w wordlist.txt |
| sqlmap | SQL injection automation | sqlmap -u "http://target/page?id=1" --dump |
| Hashcat | Password cracking | hashcat -m 1000 hashes.txt wordlist.txt |
| LinPEAS | Linux privilege escalation enumeration | ./linpeas.sh |
| BloodHound | Active Directory attack path mapping | Map paths from user to Domain Admin |
Practice Sites
- Hack The Box - Machines, Pro Labs, certification exams
- HTB Pro Labs - Full network simulations (Dante, RastaLabs, Zephyr) that require lateral movement and persistence
- HTB Academy - Structured modules covering each red team phase with interactive exercises
- PortSwigger Web Security Academy - Free web vulnerability labs (OWASP Top 10, business logic, advanced XSS)
Key Concepts
Living Off the Land (LOTL)
Attackers use built-in system tools instead of dropping malware. PowerShell, WMI, certutil, bitsadmin - all legitimate admin tools that attackers abuse. This makes detection harder because the tools are supposed to be there.
Indicators of Compromise (IOC)
Artifacts that indicate an attack happened. IP addresses, file hashes, domain names, registry keys, suspicious log entries. IOCs are useful but perishable - attackers change IPs and recompile malware to change hashes.
Behavioral Detection
Instead of looking for specific IOCs (which change), look for behaviors. "PowerShell downloading and executing a script from the internet" is a behavior that works regardless of which IP or domain the attacker uses. This is why MITRE ATT&CK focuses on techniques rather than indicators.
Next Steps
- Learn the tools
- Understand fundamentals
- See how red and blue work together in purple team
- Prepare for the CJCA