bluscreenofjeff/Red-Team-Infrastructure-Wiki

Features

• Red Teaming Frameworks - Provides a framework and technical resources for designing resilient, stealthy red team infrastructure.
• Deployment Automation - Uses orchestration tools to automate the deployment of complex offensive environments for consistency and speed.
• Multi-Provider Asset Distribution - Distributes operational infrastructure across multiple cloud providers and regions to avoid blanket blocks.
• Operational Redirectors - Provides blueprints for deploying intermediary redirector hosts to conceal primary control servers and allow rapid replacement of compromised assets.
• PaaS-Based Redirectors - Provides blueprints for proxying control traffic through trusted static PaaS subdomains to increase perceived legitimacy.
• HTTP Traffic Camouflaging - Implements web request redirection based on user agents, URIs, or IP addresses to masquerade traffic and evade detection.
• Traffic Routing Proxies - Utilizes intermediary hosts as redirectors to conceal primary control servers and allow rapid asset replacement.
• Domain Fronting - Implements domain fronting by routing network traffic through high-reputation domains to bypass security controls.
• Traffic Obfuscation - Hides command and control communications using redirectors and domain fronting to blend into network traffic.
• Network Credential Capturers - Implements proxy systems that route traffic through public fronts to capture session tokens and credentials in transit.
• Infrastructure Obscuration - Implements techniques to modify traffic patterns and server headers to hide control servers from network-based discovery.
• Traffic Obfuscation - Provides methods for modifying network traffic patterns to impersonate legitimate applications and evade detection.
• Domain Fronting - Implements domain fronting to hide control traffic by routing requests through high-reputation domains.
• Reputation-Based Traffic Obfuscation - Implements strategies to evade security filters by leveraging the existing domain reputation of trusted third-party content platforms.
• Reputation Inheriting Platforms - Leverages trusted user-generated content sites to inherit domain reputation and evade security filters.
• Operational Server Hardening - Offers a manual of standards for securing control servers and masking traffic patterns.
• Infrastructure Hardening - Provides comprehensive guidelines for securing operational servers to prevent discovery by incident responders.
• Adversary Simulation - Provides technical playbooks for emulating real-world attack techniques and evading detection.
• Phishing Campaign Orchestrators - Orchestrates the deployment of mail servers and landing pages with managed reputations for credential capture.
• Mail Server Deployments - Provides tools for deploying full mail server stacks including configurations and DNS records for phishing operations.
• Phishing - Provides architectural blueprints for deploying mail servers and credential capture proxies.
• Resilient Infrastructure - Ships architectural guidelines for building stable, stealthy operational environments that maintain continuity during security engagements.
• Immutable File Attributes - Applies immutable system attributes to critical directories to prevent unauthorized modifications by root users.
• Network Traffic Filtering - Implements firewall rule management to filter incoming and outgoing traffic and block unwanted IP ranges.
• Secure Remote Access - Secures server entry points using enforced public-key authentication and multi-factor authentication.
• Security Operations Automation - Automates the rapid deployment and replacement of distributed assets across multiple cloud regions.
• Immutable File Attributes - Implements immutable system file hardening to protect critical directories from unauthorized modification by root users.
• Infrastructure Role Segregation - Provides architectural patterns to separate operational roles across distinct servers, ensuring the detection of one asset does not compromise the environment.
• Security Alert Triggers - Implements real-time security alert triggers that notify operators via APIs when high-value milestones or credential captures occur.
• Centralized Logging Systems - Provides systems for collecting and forwarding logs from distributed assets to a single location for consolidated monitoring.
• Related Awesome Lists - Hardening resources for red team infrastructure.
• Penetration Testing Toolkits - Documentation for building and managing red team infrastructure.
• Red Team Operations - Resources for hardening red team operational infrastructure.
• Red Teaming Tools - Guide for building and managing red team infrastructure.

Star history