[THUGS(red)]
login signup

Red teaming

Red teaming is not a penetration test with a scarier name. A pentest asks "what is broken on this system"; a red team asks "can the organisation detect and stop a determined adversary going after a specific objective". Different question, different engagement.

Authorisation first, always. Everything on this page assumes a signed scope, a named point of contact and an agreed rules-of-engagement document. Without those you are not a red team, you are a defendant.
how an engagement runs

1. Reconnaissance

Everything starts with attack surface. External footprint, DNS (including the dangling records nobody remembers owning), exposed services, third parties, and the people — names, roles, email formats, what they post. Our wardriving work fits here too: the wireless perimeter is part of the perimeter.

2. Initial access

Usually phishing, because it usually works. We build and operate our own infrastructure for this — see MailChumHum and CupATM — so the lures are realistic rather than a template the target has already trained against. Physical entry and rogue wireless are the other two routes; a Pineapple in a bag or a cloned badge from an RFID kit both skip the email step entirely.

3. Foothold and persistence

Get stable, get quiet, stay in. This is where an engagement is won or lost on tradecraft: the noisy option works today and burns the operation tomorrow. Drop devices — a Pi running Kali, or Bjorn for autonomous internal recon — earn their place when physical access is on the table.

4. Privilege escalation and lateral movement

Credentials, tickets, misconfigured trust relationships, and the service account somebody gave domain admin in 2019 "temporarily". The interesting finding is rarely a CVE; it is the path nobody drew on the architecture diagram.

5. Objective and exfiltration

The objective is agreed in advance: a specific dataset, a specific system, proof of a specific capability. Demonstrate it, prove it cleanly, and do not take a copy of anything you were not asked to take.

6. Reporting and replay

The deliverable is not the flag, it is the timeline. What we did, when, what fired, what did not, and what the blue team would need in order to catch it next time. A red team engagement that does not improve detection was a waste of everyone's budget — which is why we publish detection rules too.

opsec basics
  • Separate infrastructure per engagement. Shared infrastructure links clients to each other.
  • Log everything you do. When the client asks "was that you?" at 03:00, you need the answer in seconds.
  • Have a stop condition. Agreed in advance, in writing, with a phone number attached.
  • Do not break production to prove a point. Access demonstrates the risk; damage just makes an enemy.
  • Clean up. Every implant, account and rule you added comes back out, and appears in the report.