Cybrary ForgeCYBRARY / FORGE
Back to Forge Offensive
Forge Offensive · Red-team playbook

The red-team playbook

Each simulated offensive lab is a page from a real red-team engagement plan: what the objective is, what the pretext looks like, which tools the operator reaches for, what deliverable it produces, and how the blue side should see it. Run them in order for a full engagement — or pull one when you need to rehearse a single play.
Open the hubRead the methodology
Plays
10
Recon
1
Initial access
3
Post-exploit
6
Play 01·Recon·pt-01-external-recon-to-foothold

Op. Cold Perimeter — External Recon to Foothold

Enumerate a customer's public perimeter inside an approved scan window and convert one stale service into a supervised foothold.

Run the lab
Pretext

External assessment against a single /29, ports 1-65535, no denial of service, four-hour window.

Primary tools
nmapgobusterffufniktometasploithydra
Kill chain
  1. 01Confirm ROE and record scope blocks on the engagement
  2. 02SYN + version scan the authorized range
  3. 03Content discovery against exposed web surface
  4. 04Exploit one stale service under supervision, capture proof
Deliverable

Foothold finding: CVSS vector, screenshot-equivalent evidence, and remediation the owner can action today.

Blue mirror

External scan bursts and directory brute force should trigger perimeter WAF or IDS rules — capture what the blue mirror caught and what it missed.

ATT&CKT1595.001T1595.002T1190
Play 02·Post-exploitation·pt-02-ad-attack-graph

Op. Iron Forest — Read the AD Attack Graph

From a low-privileged domain user, read the attack graph and walk the shortest path to Domain Admin, one deliberate hop at a time.

Run the lab
Pretext

Internal assessment with a seeded workstation credential, ROE forbids ticket forgery and DCSync outside the change window.

Primary tools
bloodhoundnetexecimpacketresponderpowersploit
Kill chain
  1. 01Ingest the domain into BloodHound and pick the shortest owned → DA path
  2. 02Kerberoast the service accounts on the path
  3. 03Coerce and relay only inside the change window
  4. 04Prove DA access with a benign artifact, then stop
Deliverable

Kill-chain timeline with every hop, the graph query that found it, and a tiering-model remediation for the AD team.

Blue mirror

Kerberoast tickets, LDAP recon and NTLM relay should show up as blue-mirror verdicts — every miss is a detection-gap appendix entry.

ATT&CKT1069.002T1558.003T1557.001T1003.006
Play 03·Initial access·pt-03-web-app-assessment

Op. Glass Storefront — Web App Assessment (OWASP Top 10)

Prove the OWASP Top 10 risk on the customer's storefront: injection, broken access control, SSRF and an authenticated privilege bypass.

Run the lab
Pretext

Gray-box web assessment against staging, one tester account per role, real customer data masked.

Primary tools
proxy (Burp-lite)sqlmapffufniktocyberchef
Kill chain
  1. 01Map the app through /pentest/proxy — routes, roles, tokens
  2. 02Fuzz inputs for injection and broken access control
  3. 03Chain SSRF to metadata or internal service
  4. 04Escalate role via IDOR and file the finding with CVSS
Deliverable

Findings register rows tagged with OWASP category, repro request/response, and a remediation the app team can ship.

Blue mirror

Payload spikes on the WAF, anomalous auth transitions and outbound calls to metadata endpoints — check each against the blue mirror.

ATT&CKT1190T1213.003T1552.005
Play 04·Post-exploitation·pt-04-cloud-privesc

Op. Bright Vault — Cloud Privilege Escalation

From a leaked developer key, enumerate cloud roles and chain AssumeRole hops to a production data reader without touching real data.

Run the lab
Pretext

Cloud-only assessment, read-only escalation proof, no changes to production resources, evidence via loot records only.

Primary tools
aws-cli (sim)bloodhoundcyberchefproxy
Kill chain
  1. 01Enumerate identities, roles and trust policies
  2. 02Follow the AssumeRole chain the graph surfaces
  3. 03Prove production data-reader reach with a benign list call
  4. 04Return the graph, the chain, and the offending trust policy
Deliverable

Cloud privesc finding with the exact trust-policy diff, a graph screenshot from the attack graph, and IAM guardrail remediation.

Blue mirror

AssumeRole chains and cross-account list calls should show as blue-mirror verdicts; missing coverage is the appendix.

ATT&CKT1078.004T1580T1548.005
Play 05·Post-exploitation·pt-05-purple-team-emulation

Op. Two-Way Mirror — Purple-Team Emulation

Emulate a named threat actor's TTPs against the range with the blue side watching live — every technique either fires a detection or opens a gap.

Run the lab
Pretext

Announced purple-team exercise, TTPs drawn from a real advisory, detections tuned between runs.

Primary tools
atomic-red-teammetasploitpowersploitc2 console
Kill chain
  1. 01Pick the emulation plan from the advisory
  2. 02Execute each atomic under supervision
  3. 03Blue mirror grades each ActionKind live
  4. 04Re-run after the detection tune and score the delta
Deliverable

Purple-team detection-gap register: technique, verdict, rule that fired (or should have), latency, remediation.

Blue mirror

This lab is the blue mirror — every step is meant to land as a verdict, and the gaps are the deliverable.

ATT&CKT1059.001T1546.008T1071.001
Play 06·Initial access·pt-06-wireless-assessment

Op. Open Air — Wireless Assessment

Capture a WPA2 handshake from the authorized SSID, crack it offline with the supplied wordlist, and prove wireless-to-wired pivot.

Run the lab
Pretext

On-site wireless assessment during business hours, one SSID in scope, no guest-network deauth, wordlist supplied by the customer.

Primary tools
airmon-ngairodump-ngaireplay-ngaircrack-ngwireshark
Kill chain
  1. 01Enter monitor mode and pin the target BSSID/channel
  2. 02Capture the four-way handshake (targeted deauth if ROE allows)
  3. 03Crack offline with the supplied wordlist
  4. 04Prove pivot onto a wired VLAN and stop
Deliverable

Wireless finding: SSID, BSSID, capture reference, crack time, and a PSK-rotation + 802.1X remediation.

Blue mirror

Deauth bursts and rogue-client joins should trip WIDS — check what the blue mirror flagged.

ATT&CKT1040T1110.002T1021.001
Play 07·Initial access·pt-07-phishing-simulation

Op. Warm Envelope — Authorized Phishing Simulation

Run an authorized phishing campaign against an opted-in audience, capture credentials on the simulated portal, and hand back who clicked, who submitted, and who reported.

Run the lab
Pretext

Announced-to-security phishing exercise, opt-in audience, no payload delivery, credentials never leave the range.

Primary tools
proxycyberchefc2 console
Kill chain
  1. 01Pick pretext and landing page from the library
  2. 02Send to the opted-in audience through the simulated relay
  3. 03Collect click / submit / report telemetry
  4. 04Debrief with the awareness team, name no individuals
Deliverable

Phishing campaign report: send/click/submit/report rates, dwell time, and a training + MFA-hardening remediation.

Blue mirror

Lookalike-domain hits, credential-submission POSTs and user-reported buttons should light up the blue mirror.

ATT&CKT1566.002T1204.001T1078.003
Play 08·Post-exploitation·pt-08-defense-evasion

Op. Ghost Hook — Defense Evasion and EDR Sidestep

Land a payload past a live EDR without disabling its self-protection, and hand the customer a detection ask for every evasion you used.

Run the lab
Pretext

One workstation in scope, EDR in monitor-only, no self-defense disable, four-hour evasion window.

Primary tools
msfvenompowersploitmimikatzatomic-red-team
Kill chain
  1. 01Patch AMSI in-process for the current session
  2. 02Silence ETW for the loading process
  3. 03Fire an unhooked-syscall payload into a benign parent
  4. 04Beacon over jittered HTTPS and file the userland-unhook proof
Deliverable

Evasion finding with three detection asks: userland-unhook diff, ETW ring-buffer gaps and remote-thread into signed binaries.

Blue mirror

Kernel callbacks still see remote-thread creation; ETW absence and AMSI memory-modification signals are the durable catches — grade what the mirror missed.

ATT&CKT1562.001T1562.006T1055T1071.001
Play 09·Post-exploitation·pt-09-c2-operations-and-tunneling

Op. Long Line — C2 Operations and Tunneling

Operate a small beacon fleet over jittered HTTPS with a DNS fallback, stage a benign collection and prove the exfil path — all inside a ROE.

Run the lab
Pretext

Three beacons in one segment, HTTPS primary, DNS TXT fallback in business hours only, no real customer data ever staged.

Primary tools
c2 consolemetasploitimpacketpowersploit
Kill chain
  1. 01Bring up three beacons on jittered HTTPS with domain fronting
  2. 02Fail over to a DNS TXT tunnel when HTTPS is blocked
  3. 03Stage a benign compressed collection under %TEMP%
  4. 04Exfil in chunks over the primary channel and file the tunnel finding
Deliverable

Tunnel-and-egress finding: JA3, jitter, callback cadence, DNS entropy signature and an egress allowlist the network team can adopt.

Blue mirror

Destination allowlists, high-entropy TXT queries and bulk-transfer anomalies should light up the blue mirror; every miss is a rule to write.

ATT&CKT1071.001T1071.004T1560.001T1041
Play 10·Post-exploitation·pt-10-ransomware-emulation

Op. Cold Reboot — Ransomware Adversary Emulation

Emulate a named ransomware crew end-to-end against the simulated estate and hand the recovery team a per-stage detection-gap table linked to the RAN track.

Run the lab
Pretext

One-key kill-switch confirmed, benign fixture-swap 'impact' only, defender on-console, cross-linked to the recovery track for handoff.

Primary tools
atomic-red-teammetasploitpowersploitmimikatzimpacket
Kill chain
  1. 01Confirm kill-switch and ROE before step one
  2. 02Persist via a scheduled task with an unusual author
  3. 03Escalate via token impersonation to SYSTEM
  4. 04Hop over WinRM and trigger the benign fixture-swap 'impact'
Deliverable

Detection-gap table per stage cross-linked to the RAN recovery labs, plus a kill-switch clean-shutdown proof.

Blue mirror

4698 scheduled-task creation, SeDebugPrivilege token duplication, WinRM 4624 type-3 and mass-rename per-minute are the anchors — the report notes which fired and which did not.

ATT&CKT1053.005T1134.001T1021.006T1486

Run it as one engagement

The plays are ordered to fold into a single engagement: recon feeds initial access, initial access seeds post-exploitation, and every play files into the same findings register.

Start / resume an engagement
Attack-path map
Web proxy workbench
C2 console

Every play is a simulation — no packets leave the browser, no real credentials are used.