red-team-assessment

Full-process red team assessment methodology

This skill is the penetration testingoverall process orchestration—it does not include specific vulnerability exploitation techniques (those are in the various specialized skills under exploit/), but instead guides you to advance the entire assessment in the correct order and with the correct strategy.

Phase 1: Passive Reconnaissance (Zero Contact)

Collect intelligence without touching the target:

1. OSINT search engines

   • Via http_request or curl query FOFA / Quake / Hunter API for cross-engine search
   • Goal: IP/domain asset inventory, exposed services, technology stack

2. Public information collection

   • Search GitHub/GitLab for organization names and domains (may leak source code/credentials)
   • Recruitment information analysis (leaks technology stack and internal systems)
   • SSL certificate transparency logs (discover subdomains)

Output: Initial asset inventory + technology stack overview

Phase 2: Active Reconnaissance

Based on passive reconnaissance results, conduct targeted active probing:

1. Subdomain enumeration — subfinder / ksubdomain
2. Port scanning — naabu(focus on high-value ports, with nmap as an alternative)
3. Liveness detection — httpx(confirm HTTP services)
4. Fingerprinting — httpx -tech-detect / nuclei -t technologies/(technology stack → determine attack direction)
5. Directory brute-forcing — spray / ffuf(discover hidden entry points)

Output: Complete asset map (domains + IPs + ports + technology stack + hidden paths)

Phase 3: Vulnerability Discovery

3.1 Automated scanning

• nuclei -u TARGET -severity critical,high — Nuclei POC scanning
• nuclei -u TARGET -t default-logins/ — Default credential detection

3.2 Manual testing (by asset type)

For each web application, select specialized tests based on the technology stack:

Discovery	Test direction
Login page	SQL injection, weak passwords
Search/query functionality	SQL injection, XSS
File upload	File upload bypass
API endpoints	IDOR, authentication bypass
Template rendering	SSTI
JWT Token	JWT attacks
Java applications	Deserialization

3.3 Key decisions

• Breadth-first: First perform quick scans on all assets and mark all possible entry points
• Deep attack: Select the 2-3 entry points most likely to be breached for in-depth testing
• Do not get stuck on one point for too long—if there is no progress after 3-5 rounds, switch direction

Phase 4: Vulnerability Exploitation and Verification

After discovering a vulnerability, perform exploitation verification:

1. Confirm the vulnerability is exploitable (PoC verification)
2. Assess the scope of impact (data leakage / RCE / privilege escalation)
3. If a shell is obtained → perform post-exploitation
4. Record the complete exploitation steps (for reproduction)

Phase 5: Report Output

Generate the formal report.

Key Principles：

• Findings are sorted by risk level (Critical > High > Medium > Low > Informational)
• Each finding must include: description, impact, reproduction steps, remediation recommendations
• Executive summary in non-technical language
• Appendix includes tool list and detailed technical data

Suggested Time Allocation

Phase	Time Percentage
Passive + Active Reconnaissance	20%
Vulnerability Discovery	30%
Exploitation Verification	35%
Reporting	15%

Time Management Strategies

• Quick testing mode: complete within a 30-minute or 60-minute time limit
• Prioritize the easiest and most effective attack paths, then delve into complex vulnerabilities
• When time is limited, focus on efficiency and ROI, and allocate resources reasonably
• Pivot promptly when encountering a bottleneck: switch attack surfaces, abandon the current path, and move to other attack surfaces
• Look for alternative solutions and new entry points