Hands-On Red Team Tactics : A practical guide to mastering Red Team Operations

Description

Table of Contents Preface Chapter 1: Red-Teaming and Pentesting Pentesting OWASP Open Source Security Testing Methodology Manual (OSSTMM) Information Systems Security Assessment Framework (ISSAF) Penetration Testing Execution Standard (PTES) Pre-engagement interactions Intelligence gathering Threat modeling Vulnerability analysis Exploitation Post-exploitation Reporting A different approach Methodology How is it different? Summary Questions Further reading Chapter 2: Pentesting 2018 Technical requirements MSFvenom Payload Creator Resource file Koadic Installation Why use MSHTA as the dropper payload? Terminology Stager establishment Payload execution Running Implants Pivoting Summary Questions Further reading Chapter 3: Foreplay - Metasploit Basics Technical requirements Installing Metasploit Running Metasploit Auxiliaries Exploits Payloads Encoders Meterpreter Armitage and team server Metasploit with slack Armitage and Cortana scripts Summary Questions Further reading Chapter 4: Getting Started with Cobalt Strike Technical requirements Planning a red-team exercise Cyber kill chain (CKC) Reconnaissance Weaponization Delivery Exploitation Installation Command and Control Server Actions Objective and goal Rules of Engagement (RoE) Scenario/strategy Deliverables Introduction to Cobalt Strike What is a team server? Cobalt Strike setup Cobalt Strike interface Toolbar Connecting to another team server Disconnecting from the team server Configure listeners Session graphs Session table Targets list Credentials Downloaded files Keystrokes Screenshots Payload generation – stageless Windows executable Payload generation – Java signed applet Payload generation – MS Office macros Scripted web delivery File hosting Managing the web server Server switchbar Customizing the team server Summary Questions Further reading Chapter 5: ./ReverseShell Technical requirement Introduction to reverse connections Unencrypted reverse connections using netcat Encrypted reverse connections using OpenSSL Introduction to reverse shell connections Unencrypted reverse shell using netcat Encrypted reverse shell for *nix with OpenSSL packages installed Encrypted reverse shell using ncat Encrypted reverse shell using socat Encrypted reverse shell using cryptcat Reverse shell using powercat reverse_tcp reverse_tcp_rc 1reverse_https reverse_https with a custom SSL certificate Meterpreter over ngrok Reverse shell cheat sheet Bash reverse shell Zsh reverse shell TCLsh/wish reverse shell Ksh reverse shell Netcat reverse shell Telnet reverse shell (G)awk reverse shell R reverse shell Python reverse shell Perl reverse shell Ruby reverse shell Php reverse shell Lua reverse shell Nodejs reverse shell Powershell reverse shell Socat reverse shell over TCP Socat reverse shell over UDP Socat reverse shell over SSL (cert.pem is the custom certificate) Summary Questions Further reading Chapter 6: Pivoting Technical requirements Pivoting via SSH Meterpreter port forwarding Pivoting via Armitage Multi-level pivoting Summary Further reading Chapter 7: Age of Empire - The Beginning Technical requirements Introduction to Empire Empire setup and installation Empire fundamentals Phase 1 – Listener Initiation Phase 2 – Stager Creation Phase 3 – Stager Execution Phase 4 – Acquiring Agent Phase 5 – Post Module Operations Empire post exploitation for Windows Empire post exploitation for Linux Empire post exploitation for OSX Popping up a Meterpreter session using Empire Slack notification for Empire agents Summary Questions Further reading Chapter 8: Age of Empire - Owning Domain Controllers Getting into a Domain Controller using Empire Automating Active Directory exploitation using the DeathStar Empire GUI Summary Questions Further reading Chapter 9: Cobalt Strike - Red Team Operations Technical requirements Cobalt Strike listeners Foreign-based listeners Cobalt Strike payloads Beacons The beacon menu Explore menu Beacon console Pivoting through Cobalt Strike Aggressor Scripts Summary Questions Further reading Chapter 10: C2 - Master of Puppets Technical requirements Introduction to C 8Cloud-based file sharing using C 8Using Dropbox as the C 9Using OneDrive as the C 9C2 covert channels TCP UDP HTTP(S) DNS ICMP Summary Questions Further reading Chapter 11: Obfuscating C2s - Introducing Redirectors Technical requirements Introduction to redirectors Obfuscating C2 securely Short-term and long-term redirectors Redirection methods Dumb pipe redirection Filtration/smart redirection Domain fronting Summary Questions Further reading Chapter 12: Achieving Persistence Technical requirements Persistence via Armitage Persistence via Empire Persistence via Cobalt Strike Summary Further reading Chapter 13: Data Exfiltration Technical requirements Exfiltration basics Exfiltration via Netcat Exfiltration via OpenSSL Exfiltration with PowerShell CloakifyFactory Running CloakifyFactory on Windows Data exfiltration via DNS Data exfiltration via Empire Summary Questions Further reading Assessment Other Books You May Enjoy Index