Red Team Tools and Techniques

[Alex.exe]

Share your favorite tools and techniques for Red Teaming! 

[jubjub]

Idk how common this is but if you have a data structure, header or unique error message when probing a closed source service sometimes you can find stack overflow threads describing what you're looking at just by searching for the format or message.

[Graham]

One tip that I love is that if you are able to compromise (or spoof) the IP of the vulnerability scanner, you will likely bypass all detections. If an analyst does see your scanning, they'll see its coming from the vulnerability scanner and instantly close it as a false positive. 🙂

[gnugro]

I do adversary emulation and have a system with multiple IPs to randomize the attacker IP(s) when creating training scenarios. For apps that don't have an option to use a specific interface or IP, I use firejail. https://github.com/netblue30/firejail

[0xRokkr]

I was participating in a competition this past weekend as a red teamer and we made use of autovnet (https://gitlab.com/autovtools/autovrtfm/autovnet) and the red team leadership was very pleased with its performance.

[gnugro]

1 hour ago, 0xRokkr said:

I was participating in a competition this past weekend as a red teamer and we made use of autovnet (https://gitlab.com/autovtools/autovrtfm/autovnet) and the red team leadership was very pleased with its performance.

THIS IS STELLAR!  Thank you for this reference!!

[malware_marty]

Ive been on the blue team side of red teams using the authentication relay / Resource Based Constrained Delegation (RBCD) escalation path and have been captivated by it lately.

https://github.com/topotam/PetitPotam

https://posts.specterops.io/a-case-study-in-wagging-the-dog-computer-takeover-2bcb7f94c783

[Sh0ckFR]

I think the best tools are: 

https://getgophish.com/ for the phishing phase
A C2.
A good C2 loader.
https://github.com/BloodHoundAD/BloodHound and https://github.com/BloodHoundAD/SharpHound for active directory mapping (only if necessary)
https://github.com/SecureAuthCorp/impacket for the lateral movements
https://github.com/outflanknl/Dumpert for the lsass dumps or https://github.com/codewhitesec/HandleKatz

And PetitPotam, and others tools like that for relay.