RedTeaming_CheatSheet

Pentesting / RedTeaming cheatsheet with all the commands and techniques I learned during my learning journey. Will keep it up to date. If you have any recommendations for courses or links or have any questions feel free to dm me on discord. 0xjs#9027

Index

• General
• Coding
• Open Source Intelligence
• Python Dependancies
• Windows System Security
• Hashcracking
• Infrastructure
• Buffer overflow
• Enumeration
• Exploitation
• Privilege Escalation Windows
• Privilege Escalation Linux
• Post Exploitation
• Pivoting
• Windows AD
• Relaying
• Initial Access
• Host Reconnaissance
• Host Persistence
• Local privilege escalation
• Post-Exploitation
• Lateral Movement
• Domain Enumeration
• Domain Privilege Escalation
• Domain Persistence
• Defense Evasion
• General
• Endpoint Detection & Response
• Sysmon
• Driver Attacks
• WinDbg
• LSASS
• Evading Static Detection
• PowerShell
• Application Allowlisting
• Microsoft Defender & Firewall
• Cloud
• Recon \ OSINT
• Initial access attacks
• Cloud services
  • Azure
  • Amazon Web Services
  • Google Cloud Platform
• C2 Frameworks
• Cobalt Strike
• Covenant
• Metasploit

RedTeaming General

• Definition of Red Teaming by Joe Vest and James Tubberville:

  Red Teaming is the process of using tactics, techniques and procedures (TTPs) to emulate a real-world threat, with the goal of measuring the effectiveness of the people, processes and technologies used to defend an environment.

• OPSEC (Operations Security) is a process that identifies critical information to determine if actions can be observed by enemy intelligence, determines if information obtained by adversaries could be interpreted to be useful to them, and then executes selected measures that eliminate or reduce adversary exploitation of critical information. It's generally used to describe the "ease" by which actions can be observed by "enemy" intelligence.

Sources & Credits

Most of my knowledge is gathered from the following coures, so big thanks to them! If you like a specific topic I would recommend taking the courses from them!

• Cloud: CARTP and CARTE from Altered Security, breaching the cloud from antisyphon, OASP from Cloudbreach, GCRTS from cyberwarfare
• Windows: CRTP, CRTE, PACES from Altered Security, ECPTX from eLearnSecurity and CRTO from ZeroPointSecurity.
• Infra: OSCP, PNPT from TCM Security and Tiberius privesc courses
• OSINT: PNPT Course
• Coding: Pavel Yosifovich & Sektor7 Reenz0h

Misc

C2 frameworks overview

• Collection of C2 frameworks that leverage legitimate services to evade detection
• C2 Matrix

Data exfiltration simulation

• https://github.com/FortyNorthSecurity/Egress-Assess

Nuget Package Manager dependancies

• Open Tools --> NuGet Package Manager --> Package Manager Settings --> Package Sources
• Add a source. Name nuget.org and Source https://api.nuget.org/v3/index.json

AV / EDR Netblocks for deny listing

• https://github.com/her0ness/av-edr-urls/blob/main/AV-EDR-Netblocks