#redteam-tools
22 resources
Results
- offensive-active-directory
Active Directory attack methodology for internal network red team engagements.
- offensive-bluetooth-ble
Bluetooth Low Energy (BLE) attack methodology — GATT enumeration, characteristic read/write without auth, pairing downgrade (Just Works…
- offensive-bluetooth-classic
Bluetooth Classic (BR/EDR) attack methodology — device discovery, service enumeration via SDP, LMP/L2CAP layer attacks, legacy PIN cracking (BlueBorne /…
- offensive-business-logic
Business logic vulnerability testing for web/mobile/API engagements.
- offensive-cloud
Cloud security attack methodology covering AWS, Azure, and GCP.
- offensive-deauth-disassoc
Deauthentication and disassociation attacks against 802.11 networks — targeted single-client deauth for handshake capture, broadcast deauth…
- offensive-evil-twin
Evil Twin / KARMA / Mana access point methodology — rogue AP construction with hostapd-mana / wifiphisher / airgeddon, KARMA universal probe response,…
- offensive-fuzzing
Practical offensive fuzzing methodology covering target identification, fuzzer selection (AFL++, libFuzzer, Honggfuzz, Boofuzz, syzkaller), harness…
- offensive-jwt
JWT attack methodology for penetration testers.
- offensive-krack-fragattacks
KRACK (CVE-2017-13077..082) and FragAttacks (CVE-2020-24586..588 + 26139-26147) — key reinstallation, fragmentation, and aggregation…
- offensive-lorawan-sub-ghz
LoRaWAN and sub-GHz (433 / 868 / 915 MHz) attack methodology — LoRaWAN ABP/OTAA join attack, network/session key reuse, frame counter…
- offensive-mobile
Mobile (Android + iOS) application penetration testing methodology.
- offensive-reporting
Penetration test and red team report writing methodology.
- offensive-shellcode
Shellcode development reference for offensive security engagements.
- offensive-wifi
Wireless / 802.11 attack methodology for red team engagements and wireless security assessments.
- offensive-wifi-recon
Wi-Fi reconnaissance methodology — adapter selection, monitor mode and packet injection setup, regulatory domain handling, multi-band…
- offensive-wpa-enterprise
WPA/WPA2/WPA3-Enterprise (802.1X / EAP) attack methodology — EAP method identification (PEAP-MSCHAPv2, EAP-TTLS, EAP-TLS, EAP-GTC, EAP-PWD,…
- offensive-wpa2-psk
WPA/WPA2-PSK attack methodology — four-way handshake capture via targeted deauthentication, PMKID attacks (no client required), hcxdumptool…
- offensive-wpa3-sae
WPA3 / SAE (Simultaneous Authentication of Equals) attack methodology — transition-mode (mixed WPA2/WPA3) downgrade, Dragonblood side-channel attacks…
- offensive-wps
WPS (Wi-Fi Protected Setup) PIN attack methodology — Pixie Dust offline attack against vulnerable chipsets (Ralink, Realtek, Broadcom, MediaTek), online…
- offensive-z-wave
Z-Wave attack methodology — sniffing with Z-Force / EZ-Wave / RTL-SDR + ZniffMobile, S0 (legacy) network-key derivation flaw and key reuse, S2 (modern)…
- offensive-zigbee-thread-matter
Zigbee, Thread, and Matter mesh-protocol attack methodology — IEEE 802.15.4 sniffing with TI CC2531 / CC2540 / Sonoff Zigbee Dongle E,…
