offensive-advanced-redteam

Name: offensive-advanced-redteam
Author: SnailSploit

2.8kstars447forks

How to install offensive-advanced-redteam?

snailsploit/claude-red/offensive-advanced-redteam

$npx -y skills add SnailSploit/Claude-Red --skill offensive-advanced-redteam

Installs into the current project.

Summary

When this skill is active: 1. Load and apply the full methodology below as your operational checklist 2. Follow steps in order unless the user specifies otherwise 3. For each technique, consider applicability to the current target/context 4. Track which checklist items have been

Files · 1

View on GitHub

SKILL.md

1	# SKILL: Advanced Redteam Ops
2
3	## Metadata
4	- Skill Name: advanced-redteam-ops
5	- Folder: offensive-advanced-redteam
6	- Source: https://github.com/SnailSploit/offensive-checklist/blob/main/Advanced%20red-team%20operations%20for%20dummies.md
7
8	## Description
9	Practical advanced red team operations guide: OPSEC discipline, C2 infrastructure design, living-off-the-land techniques, lateral movement, persistence, data exfiltration, and evading modern defenses. Use for planning advanced red team engagements or understanding APT TTPs.
10
11	## Trigger Phrases
12	Use this skill when the conversation involves any of:
13	`advanced red team, red team operations, OPSEC, C2 infrastructure, living off the land, LOTL, lateral movement, persistence, exfiltration, APT, advanced threat, red team for dummies`
14
15	## Instructions for Claude
16
17	When this skill is active:
18	1. Load and apply the full methodology below as your operational checklist
19	2. Follow steps in order unless the user specifies otherwise
20	3. For each technique, consider applicability to the current target/context
21	4. Track which checklist items have been completed
22	5. Suggest next steps based on findings
23
24	---
25
26	## Full Methodology
27
28	## Redirectors
29	Your CStrike, BRC4, etc., team server should ONLY bind locally. NEVER bind to 0.0.0.0 or an external-facing interface; always bind locally and have a redirector/tunnel expose it to the outside world.
30
31	On Cloudflare, you can use `Zero Trust` to create a tunnel.
32	Here's how to host your CStrike teamserver behind a redirector.
33	1. Start your server on your VPS:
34	`./TeamServerImage -Dcobaltstrike.server_port=50050 -Dcobaltstrike.server_bindto=127.0.0.1 -Djavax.net.ssl.keyStore=./cobaltstrike.store -Djavax.net.ssl.keyStorePassword=0123456 teamserver 127.0.0.100 lovestrange` ; change lovestrange with your PW. This will bind CS to 127.0.0.1:50050.
35
36	2. CStrike teamservers and clients (not beacons) use raw TCP. We can't host that directly behind Cloudflare, so we smuggle it within WebSocket traffic with `websocat`:
37	1. `websocat -E -b ws-l:SOURCE tcp:DESTINATION &`
38	2. source = where `websocat` will listen/where you will point your tunnel. i.e., 127.0.0.1:40000
39	3. destination = teamserver's IP + port
40	4. final cmd: `websocat -E -b ws-l:127.0.0.1:40000 tcp:127.0.0.1:50050 &`
41	3. Now, point your tunnel at this address.
42	1. For a temporary tunnel, use `cloudflared`:
43	1. `cloudflared tunnel --url http://127.0.0.1:40000 --no-autoupdate`
44	2. Otherwise, use a named Cloudflare tunnel within Zero Trust, point it to your domain + a specific path (long UUIDs are best), and point it to `http://127.0.0.1:40000`.
45	VPS part is done! Do the following on your machine before starting Cobalt Strike:
46	4. `websocat -E -b tcp-l:127.0.0.1:2222 ws://mytunnel.domain.com/lovestrange &` ; replace `/lovestrange` with the path you just set OR replace the domain with the link `cloudflared` gave you.
47	5. Start your Cobalt Strike client and connect to 127.0.0.1:2222.
48	6. Done :)
49
50	If your origin traffic is HTTPS you can skip the websocat part and directly point your Cloudflare tunnel to your service. you can either use Cloudflare's TLS certificate (best) or tell CF not to check origin's TLS cert
51
52	Benefits of this: much better OPSEC. A lot of team servers get taken down because they listen eternally and get scanned through Shodan then taken down. You can also use `ngrok` temporary tunnels. Tunneling HTTP is the easiest thing to do.
53	- The teamserver ↔ operator channel is raw TCP (hence `websocat`).
54	- The beacon ↔ teamserver channel is whatever your Malleable profile says (HTTP/S, DNS, etc.) and can live behind the same domain; just use different subdomains/paths.
55	Diagram:
56	```
57	Operator ──(raw TCP)──► websocat ──(WS)──► cloudflared ──► Internet ──► Cloudflare edge ──► teamserver 127.0.0.1:50050
58
59	Beacon ──(HTTPS Malleable)──► same domain/different path ──► Cloudflare edge ─(TLS terminates)─► nginx ──► teamserver 127.0.0.1:443
60	```
61
62	## Beacon Profiles
63	EDIT THE BASE PROFILE! (you can text me on TG for a good profile)
64
65	Never use the default CStrike profile; always edit it as much as you can.
66	- Disable Staging: Unless absolutely necessary for standard shellcode injection, set `host_stage = false`
67	- Staged payloads are noisy, easier to signature and unnecessary if you are using loaders.
68	- CStrike's staged payload is super detected anyway.
69	- Mimic Real Traffic: If you can, don't just randomize; profile legitimate traffic (e.g., Microsoft Teams, standard Azure API chatter) and clone it closely—matching URIs, headers, and User-Agents.
70	- Memory Obfuscation: Ensure your profile includes `set sleep_mask "true";` (encrypts heap while sleeping) and `set obfuscate "true";` (to avoid generic signature scanning in memory). Look at the sleep mask guides for CStrike.
71	- Certificate Opsec: If using HTTPS, never use the default self-signed certs. Use valid certificates (Let's Encrypt is fine) and ensure your C2 profile's `https-certificate` block matches the real cer

People who liked this also viewed

6 picks

Type

offensive-advanced-redteam

2.8kstars447forks

View on GitHub

How to install offensive-advanced-redteam?

snailsploit/claude-red/offensive-advanced-redteam

$npx -y skills add SnailSploit/Claude-Red --skill offensive-advanced-redteam

Installs into the current project.

Summary

Files · 1

View on GitHub

SKILL.md

1	# SKILL: Advanced Redteam Ops
2
3	## Metadata
4	- Skill Name: advanced-redteam-ops
5	- Folder: offensive-advanced-redteam
6	- Source: https://github.com/SnailSploit/offensive-checklist/blob/main/Advanced%20red-team%20operations%20for%20dummies.md
7
8	## Description
9	Practical advanced red team operations guide: OPSEC discipline, C2 infrastructure design, living-off-the-land techniques, lateral movement, persistence, data exfiltration, and evading modern defenses. Use for planning advanced red team engagements or understanding APT TTPs.
10
11	## Trigger Phrases
12	Use this skill when the conversation involves any of:
13	`advanced red team, red team operations, OPSEC, C2 infrastructure, living off the land, LOTL, lateral movement, persistence, exfiltration, APT, advanced threat, red team for dummies`
14
15	## Instructions for Claude
16
17	When this skill is active:
18	1. Load and apply the full methodology below as your operational checklist
19	2. Follow steps in order unless the user specifies otherwise
20	3. For each technique, consider applicability to the current target/context
21	4. Track which checklist items have been completed
22	5. Suggest next steps based on findings
23
24	---
25
26	## Full Methodology
27
28	## Redirectors
29	Your CStrike, BRC4, etc., team server should ONLY bind locally. NEVER bind to 0.0.0.0 or an external-facing interface; always bind locally and have a redirector/tunnel expose it to the outside world.
30
31	On Cloudflare, you can use `Zero Trust` to create a tunnel.
32	Here's how to host your CStrike teamserver behind a redirector.
33	1. Start your server on your VPS:
34	`./TeamServerImage -Dcobaltstrike.server_port=50050 -Dcobaltstrike.server_bindto=127.0.0.1 -Djavax.net.ssl.keyStore=./cobaltstrike.store -Djavax.net.ssl.keyStorePassword=0123456 teamserver 127.0.0.100 lovestrange` ; change lovestrange with your PW. This will bind CS to 127.0.0.1:50050.
35
36	2. CStrike teamservers and clients (not beacons) use raw TCP. We can't host that directly behind Cloudflare, so we smuggle it within WebSocket traffic with `websocat`:
37	1. `websocat -E -b ws-l:SOURCE tcp:DESTINATION &`
38	2. source = where `websocat` will listen/where you will point your tunnel. i.e., 127.0.0.1:40000
39	3. destination = teamserver's IP + port
40	4. final cmd: `websocat -E -b ws-l:127.0.0.1:40000 tcp:127.0.0.1:50050 &`
41	3. Now, point your tunnel at this address.
42	1. For a temporary tunnel, use `cloudflared`:
43	1. `cloudflared tunnel --url http://127.0.0.1:40000 --no-autoupdate`
44	2. Otherwise, use a named Cloudflare tunnel within Zero Trust, point it to your domain + a specific path (long UUIDs are best), and point it to `http://127.0.0.1:40000`.
45	VPS part is done! Do the following on your machine before starting Cobalt Strike:
46	4. `websocat -E -b tcp-l:127.0.0.1:2222 ws://mytunnel.domain.com/lovestrange &` ; replace `/lovestrange` with the path you just set OR replace the domain with the link `cloudflared` gave you.
47	5. Start your Cobalt Strike client and connect to 127.0.0.1:2222.
48	6. Done :)
49
50	If your origin traffic is HTTPS you can skip the websocat part and directly point your Cloudflare tunnel to your service. you can either use Cloudflare's TLS certificate (best) or tell CF not to check origin's TLS cert
51
52	Benefits of this: much better OPSEC. A lot of team servers get taken down because they listen eternally and get scanned through Shodan then taken down. You can also use `ngrok` temporary tunnels. Tunneling HTTP is the easiest thing to do.
53	- The teamserver ↔ operator channel is raw TCP (hence `websocat`).
54	- The beacon ↔ teamserver channel is whatever your Malleable profile says (HTTP/S, DNS, etc.) and can live behind the same domain; just use different subdomains/paths.
55	Diagram:
56	```
57	Operator ──(raw TCP)──► websocat ──(WS)──► cloudflared ──► Internet ──► Cloudflare edge ──► teamserver 127.0.0.1:50050
58
59	Beacon ──(HTTPS Malleable)──► same domain/different path ──► Cloudflare edge ─(TLS terminates)─► nginx ──► teamserver 127.0.0.1:443
60	```
61
62	## Beacon Profiles
63	EDIT THE BASE PROFILE! (you can text me on TG for a good profile)
64
65	Never use the default CStrike profile; always edit it as much as you can.
66	- Disable Staging: Unless absolutely necessary for standard shellcode injection, set `host_stage = false`
67	- Staged payloads are noisy, easier to signature and unnecessary if you are using loaders.
68	- CStrike's staged payload is super detected anyway.
69	- Mimic Real Traffic: If you can, don't just randomize; profile legitimate traffic (e.g., Microsoft Teams, standard Azure API chatter) and clone it closely—matching URIs, headers, and User-Agents.
70	- Memory Obfuscation: Ensure your profile includes `set sleep_mask "true";` (encrypts heap while sleeping) and `set obfuscate "true";` (to avoid generic signature scanning in memory). Look at the sleep mask guides for CStrike.
71	- Certificate Opsec: If using HTTPS, never use the default self-signed certs. Use valid certificates (Let's Encrypt is fine) and ensure your C2 profile's `https-certificate` block matches the real cer

People who liked this also viewed

6 picks

Type