> ## Documentation Index
> Fetch the complete documentation index at: https://journal.daudaldi.my.id/llms.txt
> Use this file to discover all available pages before exploring further.

# 101 - Red Teaming

> Short overview about what is red-teaming

# Red Teaming 101

> **"Think like an attacker to defend like a pro."**

Red teaming is basically the practice of simulating real-world attacks against an organization, from the outside, or sometimes from within, to find out what an actual adversary could do before they actually do it. It's not just running a scanner and calling it a day. It's a structured, goal-driven exercise where the objective is to test the **people, processes, and technology** that make up an organization's defenses.

The term originally comes from military and intelligence communities, where a "red team" was a group tasked with thinking adversarially. In cybersecurity, it's evolved into a discipline of its own.

## What Red Teamers Actually Do

At its core, red teaming is about **emulating realistic threat actors**. Not just finding vulnerabilities, but chaining them together the way an attacker would, from initial access, all the way to the objective (data theft, ransomware deployment, lateral movement to crown jewels, etc.).

Day-to-day responsibilities typically include:

* **Reconnaissance** - Gathering intel about the target: domains, employees, tech stack, exposed services, leaked credentials, social media footprints.
* **Initial Access** - Getting a foothold through phishing, exploiting exposed services, password spraying, or physical intrusion.
* **Lateral Movement** - Moving through the internal network after initial compromise.
* **Privilege Escalation** - Going from a low-privileged user to admin or domain controller.
* **Persistence** - Setting up mechanisms to maintain access even if the initial foothold is discovered.
* **Objective Achievement** - Actually reaching the thing the "attacker" is after (a specific database, internal system, sensitive files).
* **Reporting** - Documenting everything: what worked, what didn't, how defenders responded, and concrete recommendations.

A good red team engagement is measured not just by what they breached, but by the **quality of the narrative** they produce. The business needs to understand the story, not just a list of CVEs.

## Scope & What You're Actually Testing

Red team engagements vary a lot depending on the organization's goals. Common scopes include:

| Type                          | What it covers                                                                         |
| ----------------------------- | -------------------------------------------------------------------------------------- |
| **External Network**          | Internet-facing assets: web apps, VPNs, mail servers, exposed ports                    |
| **Internal Network**          | Assumes a foothold already exists, focuses on lateral movement and escalation          |
| **Application**               | Deep-dive into a specific app (web, mobile, API)                                       |
| **Physical**                  | On-site intrusion: tailgating, badge cloning, social engineering in person             |
| **Social Engineering**        | Phishing, vishing, smishing campaigns against employees                                |
| **Full Adversary Simulation** | End-to-end attack simulation tied to a specific threat actor profile (e.g., APT group) |

### What Makes It Different from Pentesting?

Penetration testing is usually time-boxed and scope-limited, you look for vulnerabilities in a specific system. Red teaming is broader, more covert, and more focused on **whether the defenders catch you** and how far you can actually get. It's less about the vulnerability list and more about the attack chain.

## Key Areas to Understand

If you're getting started in red teaming, these are the foundational domains you'll want to wrap your head around:

### Adversary Tradecraft & Frameworks

* **MITRE ATT\&CK** - The industry-standard framework documenting real-world adversary tactics, techniques, and procedures (TTPs). Learn this one by heart.
* **Cyber Kill Chain** (Lockheed Martin) - Classic model for thinking about attack stages.
* **TIBER-EU / CBEST** - Threat intelligence-based red teaming frameworks used in regulated industries (especially finance).

### Technical Skills

* Network fundamentals (TCP/IP, DNS, Active Directory)
* Web application security basics (OWASP Top 10 is a good starting point)
* Scripting - Python and PowerShell are practically mandatory
* Understanding Windows internals and Active Directory attacks (Kerberoasting, Pass-the-Hash, DCSync, etc.)
* Basic malware development / payload crafting

### Soft Skills

* Report writing that non-technical stakeholders can actually understand
* Communication during engagements (especially full purple team exercises)
* Thinking creatively and not just running through a checklist

## Essential Tools to Know

You don't need to master all of these right away, but knowing what they are and what they do is a solid starting point.

### Reconnaissance

| Tool                            | What it's for                              |
| ------------------------------- | ------------------------------------------ |
| **Nmap**                        | Port scanning and service enumeration      |
| **Amass / Subfinder**           | Subdomain enumeration                      |
| **Shodan / Censys**             | Finding internet-exposed assets            |
| **theHarvester**                | Email, domain, and employee info gathering |
| **LinkedIn + OSINT techniques** | Social engineering prep                    |

### Exploitation & Post-Exploitation

| Tool               | What it's for                                                     |
| ------------------ | ----------------------------------------------------------------- |
| **Metasploit**     | Exploit framework, great for learning the basics                  |
| **Cobalt Strike**  | Industry-standard C2 platform (expensive, but worth knowing)      |
| **Sliver / Havoc** | Open-source C2 alternatives                                       |
| **BloodHound**     | AD attack path visualization - an absolute must for internal ops  |
| **Impacket**       | Python library for Windows protocol attacks (SMB, Kerberos, etc.) |
| **Mimikatz**       | Credential dumping from Windows - classic tool                    |
| **Responder**      | LLMNR/NBT-NS poisoning for credential capture                     |

### Web Application

| Tool                 | What it's for                                               |
| -------------------- | ----------------------------------------------------------- |
| **Burp Suite**       | The go-to web proxy for app testing                         |
| **SQLMap**           | SQL injection automation                                    |
| **Nikto**            | Basic web server scanner                                    |
| **ffuf / gobuster**  | Directory and endpoint fuzzing                              |
| **Projectdiscovery** | Suite of open source tools tailored for offensive security. |

### Phishing / Social Engineering

| Tool                                 | What it's for                                    |
| ------------------------------------ | ------------------------------------------------ |
| **GoPhish**                          | Phishing campaign management                     |
| **SET (Social Engineering Toolkit)** | Broad social engineering attack toolkit          |
| **Evilginx2**                        | Adversary-in-the-middle phishing with 2FA bypass |

## Certifications Worth Looking At

If you're building a red team career, these certs are well-regarded in the industry:

* **OSCP** (Offensive Security Certified Professional) - The gold standard for pentesting. Hands-on, no multiple choice.
* **CRTE / CRTO** - Focused specifically on Active Directory and red team operations
* **PNPT** (Practical Network Pentesting by TCM Security) - Budget-friendly, practical, great for beginners
* **eCPTX** (eLearnSecurity) - Advanced pentesting, good breadth of coverage
* **GPEN / GXPN** (GIAC) - Well-recognized, especially in enterprise environments

## Where to Practice

Theory only gets you so far. You need labs and hands-on time.

* **Hack The Box** - Best community for realistic machine challenges
* **TryHackMe** - More beginner-friendly, great guided learning paths
* **PentesterLab** - Focused on web application vulnerabilities
* **VulnHub** - Download-and-run vulnerable VMs locally
* **GOAD (Game of Active Directory)** - A full vulnerable AD lab you can spin up yourself. Highly recommended for Windows/AD practice.

## A Note on Ethics and Legality

This one's non-negotiable: **everything you do as a red teamer must be authorized in writing**. Rules of Engagement (RoE) define the boundaries of every engagement, what's in scope, what's off-limits, emergency contacts, and what to do if you stumble onto something you weren't supposed to find.

Working without authorization isn't red teaming - it's a crime.

Most professional engagements involve:

* A signed Statement of Work (SoW)
* A Rules of Engagement document
* A defined escalation path if critical vulnerabilities are found during the engagement

## Good Starting Points

* [MITRE ATT\&CK](https://attack.mitre.org/) - Start here.
* [HackTricks](https://book.hacktricks.xyz/) - Community-maintained red team playbook
* [Red Team Development and Operations (Joe Vest & James Tubberville)](https://www.amazon.com/Red-Team-Development-Operations-pragmatic/dp/B083XVG633) - Practical book on building and running a red team
* [TCM Security YouTube](https://www.youtube.com/@TCMSecurityAcademy) - Free, high-quality content
* [0xdf blog](https://0xdf.gitlab.io/) - Detailed walkthroughs of HTB machines

***

*Red teaming is one of those fields where the learning never really stops - the attackers evolve, and so does the defender's landscape. The goal isn't to know everything; it's to think well under pressure and stay curious.*