Assessment

Chapter 1: Red-Teaming and Pentesting

1. OWASP, OSSTMM, ISSAF.
2. Different phases of PTES are:
   • Reconnaissance
   • Compromise
   • Persistence
   • Command and control
   • Privilege escalation
   • Pivoting
   • Reporting and cleanup

3. Difference between red-teaming and pentesting is:
   
   • Red-teaming involves finding and exploiting only those vulnerabilities that help to achieve our goal, whereas pentesting involves finding and exploiting vulnerabilities in the given scope, which is limited to digital assets.
   • Red-teaming has an extremely flexible methodology, whereas, pentesting has fixed static methods.
   • During red-teaming, the security teams of the organizations have no information about it, whereas during pentesting, security teams are notified.
   • Red-teaming attacks can happen 24/7, while pentesting activities are mostly limited to office hours.
   • Red-team is more about measuring the business impact of the vulnerabilities...

Chapter 2: Pentesting 2018

1. When generating a simple payload in msfvenom, you need to include many options in it. This is definitely a confusing and time-consuming process because each time when you need to generate a payload, you will be typing a long command for it. MSFPC just does what msfvenom does, but with fewer words to type.
2. It all depends upon the creator but in the meantime, if you feel that some features are missing, you can always fork the script and contribute to the community.
3. When you don't know what device the victim will use, you can generate all these types of payload and download these files from your web server to the victim's system (Phishing, Drive-by, Ewhoring, and so on). You need to obfuscate/encrypt the files to avoid AV detection.
4. No. However, it's already packaged in Kali rolling. You can install MSFPC in Kali by executing the following...

Chapter 3: Foreplay – Metasploit Basics

1. It's up to you. The nightly builds contain version 4. However, if you want to try out the latest version (version 5), it can be manually downloaded and configured from their official repository.
2. Integration of Metasploit with slack is not mandatory. However, in most Red Teaming activity, you may find it pretty useful as you may not always be in a situation where you will have your laptop in your hand to check and confirm sessions, especially when social engineering is being used. The slack app can be easily configured on your phone and getting notified of every new session becomes very easy.
3. Yes! Cortana scripts can be created and loaded easily based on the requirements of your activity.
4. Although the official website says that team server is not supported on Windows, we can install and run team server on a Windows machine via...

Chapter 4: Getting Started with Cobalt Strike

1. Yes. It is necessary to plan the attack because you may get only one shot in which you have the advantage of the element of surprise. You need to know exactly when you'll be attacking the server and carry on with the operation.
2. Cobalt Strike is not free, but you can download the trial version online. A little bit of Googling may help here.
3. Yes, you can. However, for that you need to change the port in the team server script. Furthermore, running two team servers on the same instance will have a listener's port conflict. This can be avoided by using different ports for listeners during setup.
4. You could be connecting to someone else's team server with your credentials. It's highly unlikely but possible that you're in an MITM attack phase.
5. The older version of Cobalt Strike required MSF, but new versions don...

Chapter 5: ./ReverseShell

1. Yes, it is. Not understanding the tool can be much more problematic than learning to understand it. Also, you can think of unique solutions in a red-team engagement.
2. Yes, if you don't want the organization to detect your presence in the network.
3. You can either buy MSF Pro, which comes with the GUI web interface, where you can generate the payloads, or you can also use the venom tool (source: https://github.com/r00t-3xp10it/venom) for a partial GUI in Metasploit payload generation.
4. You can download the Cryptcat source code for Windows and compile it using Visual Studio 2005.
5. Yes, you can. But make sure the encoder you will be using is supported for this operation.
6. It's recommended that you do because it will get much harder for the organization's defenders to detect you in this way.
7. Yes, it is. However, it also has a premium access that...

Chapter 7: Age of Empire – The Beginning

1. Yes. Empire is an open source tool available on GitHub.
2. Yes, it does, but only when the listener is SSL-enabled.
3. Yes, it does. There's an official Empire GUI, but this can only work with the Empire 3.0 beta version for now. There's also another Empire GUI tool which is covered in the next chapter.

Chapter 8: Age of Empire – Owning Domain Controllers

1. There are many different techniques which can be used to get access into the Domain Controller but not all are recommended. It's better to impersonate the Domain Controller using 'DCSync' to extract the password hashes without requiring interactive logon or copying the Active Directory database file (ntds.dit).
2. You can either try other UAC modules in Empire for privilege escalation or you can look for a local vulnerability using privesc/powerup/allchecks module or a Unquoted Service Path Vulnerability to escalate the privileges manually.
3. DeathStar follows a series of checklist to look for the credentials. If the standard way didn't work, you need to do some manual reconnaissance to move further.
4. It's not mandatory to retrieve the passwords in plain-text. We can always use Pass-The-Hash (PTH)...

Chapter 9: Cobalt Strike – Red Team Operations

1. No, Cobalt strike is a paid software which costs about USD 3500 per annum and renewal of license is USD 2500.
2. Yes , Cobalt Strike has an external C2 module in it which allows other programs to act as a middle-man between Cobalt Strike and its Beacon payload.
3. Cobalt Strike's beacon have a mallable C2 profile which define how the communication happens and the data is stored. There are a different C2 profiles which can be downloaded from GitHub and used to avoid detection. https://github.com/rsmudge/Malleable-C2-Profiles.
4. Older versions of Cobalt Strike used Metasploit Framework, but the new versions are independent and do not depend on Metasploit Framework.

Chapter 10: C2 – Master of Puppets

1. We can use different platforms such as Gmail, Twitter, and different protocol suits like HTTP 2.0, DNS, and so for communication.
2. It's recommended that you create a new account because sometimes Dropbox can disable your account as we're using their features in a simulated attack.
3. Well you can but you need your system to be connected to the internet at all times because you never know when the agent will be connecting to you. It's recommended that you setup the C2 server on a cloud service like AWS for efficient usage.
4. Yes there are tools which can be used for automated configuration and setup. Refer to https://rastamouse.me/2017/08/automated-red-team-infrastructure-deployment-with-terraform---part-1/.
5. We can use Ansible to deploy and monitor our C2 servers. Refer to https://rastamouse.me/2017/08/automated-red-team-infrastructure...

Chapter 11: Obfuscating C2s – Introducing Redirectors

1. Yes. you can use a Windows based redirector, provided you have socat installed for dumb pipe redirection or XAMPP/WAMP installed for smart redirection.
2. We're not the actual attacker here. There are a set of rules that even a red teamer has to follow. We should configure and install our own redirectors unless the organization asked us to use theirs. Remember, if the motivation behind the engagement is negative, then it's just another cyber attack and not a simulated one.
3. You can use any web server which supports web request redirection. You can also use NGINX instead of Apache for robust connections.
4. Only if it is allowed by the organization and mentioned in the RoE and if by any chance the red teamers took things too far, the organization's legal advisors will be available to make things clear.
5. We can...

Chapter 13: Data Exfiltration

1. Yes, there are alternative methods such as FTP, SSH, Gmail, Twitter, and so on. A lot of tools and PoC codes can be found on the internet for exfiltration of data. And, it's not totally undetectable, these techniques help you avoid detection to a certain level, but we should consider the fact that Blue team may also know about these tools and might be monitoring tool-specific channels for any activity.
2. Frequency analysis is one of the known ciphertext attacks. This is based on the study of the frequency of letters or groups of letters in a ciphertext. Frequency analysis is used for breaking substitution ciphers. The general idea is to find the popular letters in the ciphertext and to try to replace them with the common letters in the used language.
3. There are a lot of tools which are released every day for the same purpose, such as the Data Exfiltration...