#redteam
47 resources
Results
- active-directory-attack
- Attacking Windows domain environments after gaining any domain foothold (creds, hash, or unauth network position) - Kerberos exploitation: Kerberoasting, AS-REP roasting, delegation (RBCD/constrained/unconstrained), ticket forgery - Coerc
- ai-agent-redteam
Offensive testing of autonomous LLM agents — systems that combine model reasoning with tools, memory, retrieval, and multi-step planning.
- cicd-supply-chain
CI/CD Pipeline Poisoning & Supply-Chain Attacks
- crypto-analysis
- Auditing TLS/SSL/SSH configurations and X.509 PKI (cipher suites, downgrade, protocol flaws) - Reviewing crypto implementations in source code or captured traffic - Attacking weak RSA/ECC keys (CTF and real-world weak-key hygiene) - Recov
- exploit-development
End-to-end weaponization: turn a confirmed bug class into a reliable, version-pinned PoC, then a primitive chain (leak -> R/W -> control flow), against current mitigations.
- malware-analysis
- Triaging an unknown binary/script: identity, packing verdict, capability map, IOCs, go/no-go for detonation.
- mobile-pentest
- Android/iOS application security assessment, bug-bounty mobile triage, or app-store reconnaissance - Need to intercept TLS traffic (SSL/cert pinning, Android 14/15 Conscrypt-APEX trust store, Flutter/RN stacks) - Bypass root/jailbreak or
- network-attack
- Internal network pentest from an unauthenticated wire position or initial foothold - Layer-2/3 poisoning to capture credentials (LLMNR/NBT-NS/mDNS, ARP/DHCP, IPv6 mitm6) - Coercion + NTLM relay from the network (signing/EPA mapping, CVE-2
- privesc-linux
- Gained an initial unprivileged shell on a Linux host and need root or a higher-privileged account - Post-exploitation lateral/vertical movement on Linux servers, workstations, CI runners, or appliances - Container / Kubernetes pod foothol
- privesc-windows
- Gained an initial shell / foothold on Windows and need to reach Administrator or NT AUTHORITY\SYSTEM - Shell runs as a service account (IIS APPPOOL, MSSQL, Local/Network Service) holding SeImpersonatePrivilege - Standard-user → admin vi
- recon-osint
- A new engagement begins and you need a full external attack-surface map for a set of root domains / ASNs.
- reverse-engineering
- Triaging an unknown compiled binary (ELF/PE/Mach-O) or stripped/obfuscated sample for vulns or capability.
- threat-hunting
- Hypothesis-driven hunting across endpoint, network, cloud, and identity telemetry - Writing & shipping detections (Sigma + correlation) as version-controlled code in CI - Mapping & measuring coverage against MITRE ATT&CK v18 (Detection St
- vulnerability-analysis
Every vulnerability you miss is one an attacker finds first.
- web-pentest
- Web application security assessment (black/grey/white box) - API security testing (REST, GraphQL, WebSocket) - Authentication & session management testing (JWT, OAuth/OIDC, SAML) - Business-logic and race-condition hunting - WAF/CSP bypas
- windows-boundaries
- Planning a privilege-escalation path that crosses a Windows security boundary (integrity level, AppContainer/LPAC, PPL, or the kernel/user line) - Sandbox-escape research: browser renderer (Chromium/Edge Mojo), Office WebView, packaged ap
- windows-mitigations-bypass
Defeating both exploit mitigations (ASLR/DEP/CFG/XFG/CET/ACG) and platform security controls (WDAC, ASR, AMSI/ETW, PPL/LSA Protection, VBS/HVCI).
- coding-mastery
- Writing exploit code, PoCs, or security tools - Developing automation scripts for pentesting workflows - Implementing network protocols or custom C2 - Building security analysis tools - Cryptographic implementation or analysis - Performan
- engagement-memory
Engagement Memory (cross-engagement learning)
- threat-model-discipline
You cannot test what you have not modeled. A threat model names the assets, entry points, trust boundaries, relevant ATT&CK techniques, and existing mitigations — so coverage is deliberate, not accidental.
- edr-evasion
- Planning EDR bypass during red team engagements - Researching AV/EDR evasion techniques - Developing implants that must survive endpoint detection - Testing detection capabilities of security products
- engagement-flow
A pentest/red-team engagement is a phased pipeline with gates, not a pile of techniques run ad hoc.
- shellcode-dev
- Writing custom x86/x64 shellcode - Implementing position-independent code (PIC) - Building shellcode loaders for implant delivery - Evading AV/EDR static detection - Converting PE files to shellcode - Cross-platform shellcode development
- using-offensive-claude
<SUBAGENT-STOP> If you were dispatched as a subagent to execute a specific task, skip this skill.
- writing-offensive-skills
Conventions for authoring skills in this repo so the dispatcher can find them and operators can trust them.
- offensive-active-directory
Active Directory attack methodology for internal network red team engagements.
- offensive-bluetooth-ble
Bluetooth Low Energy (BLE) attack methodology — GATT enumeration, characteristic read/write without auth, pairing downgrade (Just Works…
- offensive-bluetooth-classic
Bluetooth Classic (BR/EDR) attack methodology — device discovery, service enumeration via SDP, LMP/L2CAP layer attacks, legacy PIN cracking (BlueBorne /…
- offensive-business-logic
Business logic vulnerability testing for web/mobile/API engagements.
- offensive-cloud
Cloud security attack methodology covering AWS, Azure, and GCP.
- offensive-deauth-disassoc
Deauthentication and disassociation attacks against 802.11 networks — targeted single-client deauth for handshake capture, broadcast deauth…
- offensive-evil-twin
Evil Twin / KARMA / Mana access point methodology — rogue AP construction with hostapd-mana / wifiphisher / airgeddon, KARMA universal probe response,…
- offensive-fuzzing
Practical offensive fuzzing methodology covering target identification, fuzzer selection (AFL++, libFuzzer, Honggfuzz, Boofuzz, syzkaller), harness…
- offensive-jwt
JWT attack methodology for penetration testers.
- offensive-krack-fragattacks
KRACK (CVE-2017-13077..082) and FragAttacks (CVE-2020-24586..588 + 26139-26147) — key reinstallation, fragmentation, and aggregation…
- offensive-lorawan-sub-ghz
LoRaWAN and sub-GHz (433 / 868 / 915 MHz) attack methodology — LoRaWAN ABP/OTAA join attack, network/session key reuse, frame counter…
- offensive-mobile
Mobile (Android + iOS) application penetration testing methodology.
- offensive-reporting
Penetration test and red team report writing methodology.
- offensive-shellcode
Shellcode development reference for offensive security engagements.
- offensive-wifi
Wireless / 802.11 attack methodology for red team engagements and wireless security assessments.
- offensive-wifi-recon
Wi-Fi reconnaissance methodology — adapter selection, monitor mode and packet injection setup, regulatory domain handling, multi-band…
- offensive-wpa-enterprise
WPA/WPA2/WPA3-Enterprise (802.1X / EAP) attack methodology — EAP method identification (PEAP-MSCHAPv2, EAP-TTLS, EAP-TLS, EAP-GTC, EAP-PWD,…
- offensive-wpa2-psk
WPA/WPA2-PSK attack methodology — four-way handshake capture via targeted deauthentication, PMKID attacks (no client required), hcxdumptool…
- offensive-wpa3-sae
WPA3 / SAE (Simultaneous Authentication of Equals) attack methodology — transition-mode (mixed WPA2/WPA3) downgrade, Dragonblood side-channel attacks…
- offensive-wps
WPS (Wi-Fi Protected Setup) PIN attack methodology — Pixie Dust offline attack against vulnerable chipsets (Ralink, Realtek, Broadcom, MediaTek), online…
- offensive-z-wave
Z-Wave attack methodology — sniffing with Z-Force / EZ-Wave / RTL-SDR + ZniffMobile, S0 (legacy) network-key derivation flaw and key reuse, S2 (modern)…
- offensive-zigbee-thread-matter
Zigbee, Thread, and Matter mesh-protocol attack methodology — IEEE 802.15.4 sniffing with TI CC2531 / CC2540 / Sonoff Zigbee Dongle E,…
