redteam

A collection of 30 posts

tool

OmniProx: Multi-Cloud IP Rotation Made Simple

TLDR: If you want to use the tool without reading the post here's the GitHub: GitHub - ZephrFish/OmniProx: IP Rotation from different providers - Like FireProx but for GCP, Azure, Alibaba and CloudFlareIP Rotation from different providers - Like FireProx but for GCP, Azure, Alibaba and CloudFlare

ldap

pyLDAPGui - How It was Born

pyLDAPGui is an app I've been playing about with for a few months but it wasn't until recently that I decided, probably a good idea to release it in a proof of concept form for people to play about. The concept came about while working on

redteam Featured

Expanding on ChunkyIngress - Clippy Goes Rogue (GoClipC2)

GoClipC2: A covert Windows clipboard-based C2 channel for VDI/RDP environments. Bypasses network monitoring with encrypted Base64 messaging.

redteam Featured

LOLCLOUD - Azure Arc - C2aaS

Exploring Azure Arc’s overlooked C2aaS potential. Attacking and Defending against its usage and exploring usecases.

redteam Featured

Commit Stomping

Manipulating Git Histories to Obscure the Truth

redteam

Adversarial SysAdmin - The Key to Effective Living off the Land

Introducing Living off the Land Searches (LOLSearches), using advanced search operators with SharePoint and Explorer to help in Red Teams.

Research Featured

Side-by-Side with HelloJackHunter: Unveiling the Mysteries of WinSxS

This post explores Windows Side-by-Side (WinSxS) and DLL hijacking, deep-diving some tooling I've written and some of the fun along the way.

cti Featured

Offensive Threat Intelligence

CTI isn’t just for blue teams. Used properly, it sharpens red team tradecraft, aligns ops to real-world threats, and exposes blind spots defenders often miss. It’s not about knowing threats, it’s about becoming them long enough to help others beat them.

pentesting Featured

WebSockets are a Pain - A Journey in Learning and Leveraging

Before I dive in and show examples of implementations that worked, it is worth doing a quick explainer on what WebSockets are, how they work, what a typical request handshake looks like, and how to troubleshoot when things don't go the way you want them to.

redteam Featured

BYODC - Bring Your Own Domain Controller

BYODC or bring your own domain controller is a post-exploitation technique and another option for performing a DCSync in a more opsec safe manner.

redteam

Multiple Paths to Compromise An Environment

Attack paths and compromising systems are something we, as attackers, thrive in. Many areas of system weakness can be attacked and leveraged to gain a foothold or an upper hand within an environment.

azure Featured

Azure Attack Paths: Common Findings and Fixes (Part 1)

This post will walk through various services within the Azure catalogue and look at potential attack paths.

redteam Featured

Understanding Cobalt Strike Profiles - Updated for Cobalt Strike 4.6

A deep dive into specifics around cobalt strike malleable c2 profiles and key information that is new in cobalt strike 4.6

redteam Featured

Chasing the Silver Petit Potam to Domain Admin

Exploiting Petit Potam in a different way to force some downgrade and protocol attacks.

redteam Featured

Tunnelling For Offensive Security

One thing that comes up a lot when it comes to red teaming, penetration testing and breaching a network is being able to proxy traffic into multiple environments.

honeypoc Featured

AutoPoC - Validating the Lack of Validation in PoCs

HoneyPoC was a project to look at how popular CVE PoCs could be. AutoPoC took that concept and enabled the mass creation of disinformation. Also, Data is beautiful.

redteam

ADExplorer Exporting Quick Tip

Working with ADExplorer as a Red Teamer is really useful for seeing the whole domain in a single snapshot that can be looked at offline. There is minimal tooling out there for parsing ADExplorer or even exporting things and the closest I could find was ADEGrab [https://github.com/stufus/

redteam

Social Profiling - OSINT for Red/Blue

One of the areas that I love when it comes to red/purple engagements is profiling organizations on LinkedIn and GitHub, looking for crucial information that can lead to more juicy enumeration.

redteam Featured

Old but Gold - Attack and Defend the Sys Admins

Older techniques used in a sysadmin space, weaponised for red teaming and how to detect them from a blue team perspective.

redteam Featured

Paving The Way to DA - Complete Post (Pt 1,2 & 3)

As this series is a three part and dives into how to get domain admin in a windows estate using different techniques I found it useful to link them altogether in one flowing post, yes it is a straight pull of the other posts into one continuous post but it

redteam

Pass the Way to DA

Pass the X attacks originate from having a piece of information, in these examples this will be a hash, a set of credentials or a Kerberos ticket and then leveraging them for lateral movement throughout a network.

redteam Featured

Certified Red Team Operator (CRTO) aka RTO I - Red Team Ops I Review

Red Team Ops (RTOI) Review

redteam

ZeroLogon(CVE-2020-1472) - Attacking & Defending

A handy walkthrough of CVE-2020-1472 from both a red and blue team perspective, how to detect, patch and hack ZeroLogon

redteam Featured

WTF is Rainbow Teaming?

Alternative Title: 50 Shades of Teams Red Team, Blue Team, Purple Team, Black Team… Rainbow team? What are all of these things and what do they all mean? Is this a new case of a new found buzzword bingo or do they have a place and a purpose? The coloured

redteam Featured

Roasting your way to DA - Build-Break-Defend-Fix

Dive into both Kerberoasting and ASREP Roasting, looking at how they work, how to introduce them into an environment and how to fix them or where possible monitor and defend against them.