Design a modular red team engagement with separate servers for phishing, payload hosting, and command-and-control so one discovery does not unravel everything.
Set up HTTP and DNS redirectors so defenders cannot trace discovered traffic back to the core team server.
Find and register expired domains with clean history to make red team traffic blend in with legitimate web activity.
Configure web server traffic redirection rules to disguise outbound connections during an authorized engagement.
Requires cloud servers, domain purchases, and solid knowledge of network protocols, this is a documentation resource, not a ready-to-run tool.
This is a wiki for security professionals who conduct authorized red team engagements, meaning simulated attacks against organizations that have hired them to test defenses. A red team tries to act like a real attacker so that the organization can find and fix weaknesses. This wiki collects guidance on how to build the technical infrastructure that supports those engagements. The core idea covered here is that a red team's servers and tools should be built to survive detection. If the defending team discovers one piece of infrastructure, the red team should be able to swap it out quickly without losing the whole operation. The wiki explains how to separate different functions, such as sending phishing emails, hosting malicious files, and maintaining a connection back to the target, onto different machines so no single discovery unravels everything. A key technique covered is the use of redirectors: intermediate machines that sit between the red team's main servers and the target network. If a defender blocks one redirector, the core server is untouched and a new redirector can be swapped in. The wiki walks through how to set these up for different types of traffic, including web requests, DNS queries, and email. The domain selection section explains how to find old, legitimate-looking web domains that have expired and are available to register. Using domains with history can make red team traffic look less suspicious to automated security tools. There is also coverage of how to configure web servers to redirect traffic in ways that hide the real destination, and how to use third-party services to disguise outbound connections. The wiki references tools like Cobalt Strike and Empire, which are commercial and open-source frameworks used by professional red teams during authorized engagements. It was originally created to accompany a conference talk on hardening red team infrastructure and has since been expanded by community contributions. The full README is longer than what was shown.
← bluscreenofjeff on gitmyhub — every repo by this author, as a profile.
Verify against the repo before relying on details.