red-team-tactics by davila7/claude-code-templates
npx skills add https://github.com/davila7/claude-code-templates --skill red-team-tactics基于 MITRE ATT&CK 框架的对手模拟原则。
RECONNAISSANCE → INITIAL ACCESS → EXECUTION → PERSISTENCE
↓ ↓ ↓ ↓
PRIVILEGE ESC → DEFENSE EVASION → CRED ACCESS → DISCOVERY
↓ ↓ ↓ ↓
LATERAL MOVEMENT → COLLECTION → C2 → EXFILTRATION → IMPACT
| 阶段 | 目标 |
|---|---|
| 侦察 | 绘制攻击面 |
| 初始访问 | 获取首个立足点 |
| 执行 | 在目标上运行代码 |
| 持久化 | 在重启后存活 |
| 权限提升 | 获取管理员/root权限 |
广告位招租
在这里展示您的产品或服务
触达数万 AI 开发者,精准高效
| 防御规避 | 避免检测 |
| 凭据访问 | 收集凭据 |
| 发现 | 绘制内部网络 |
| 横向移动 | 扩散到其他系统 |
| 收集 | 收集目标数据 |
| C2 | 维持命令通道 |
| 数据渗出 | 提取数据 |
| 类型 | 权衡 |
|---|---|
| 被动 | 无目标接触,信息有限 |
| 主动 | 直接接触,检测风险更高 |
| 类别 | 价值 |
|---|---|
| 技术栈 | 攻击向量选择 |
| 员工信息 | 社会工程学 |
| 网络范围 | 扫描范围 |
| 第三方 | 供应链攻击 |
| 向量 | 使用时机 |
|---|---|
| 钓鱼攻击 | 针对人员,有邮件访问 |
| 公开漏洞利用 | 暴露了易受攻击的服务 |
| 有效凭据 | 泄露或破解的凭据 |
| 供应链 | 第三方访问 |
| 检查项 | 机会 |
|---|---|
| 未加引号的服务路径 | 写入路径 |
| 薄弱的服务权限 | 修改服务 |
| 令牌权限 | 滥用 SeDebug 等 |
| 存储的凭据 | 收集 |
| 检查项 | 机会 |
|---|---|
| SUID 二进制文件 | 以所有者身份执行 |
| Sudo 配置错误 | 命令执行 |
| 内核漏洞 | 内核漏洞利用 |
| Cron 作业 | 可写脚本 |
| 技术 | 目的 |
|---|---|
| LOLBins | 使用合法工具 |
| 混淆 | 隐藏恶意代码 |
| 时间戳篡改 | 隐藏文件修改 |
| 日志清除 | 移除证据 |
| 类型 | 用途 |
|---|---|
| 密码 | 标准认证 |
| 哈希 | 哈希传递 |
| 票据 | 票据传递 |
| 证书 | 证书认证 |
| 攻击 | 目标 |
|---|---|
| Kerberoasting | 服务账户密码 |
| AS-REP Roasting | 无需预认证的账户 |
| DCSync | 域凭据 |
| 黄金票据 | 持久域访问 |
记录完整的攻击链:
针对每个成功的技术:
| ❌ 不要 | ✅ 应该 |
|---|---|
| 急于利用漏洞 | 遵循方法论 |
| 造成损害 | 最小化影响 |
| 跳过报告 | 记录一切 |
| 忽视范围 | 保持在边界内 |
记住: 红队模拟攻击者是为了改进防御,而不是造成伤害。
每周安装量
132
代码仓库
GitHub 星标数
22.6K
首次出现
2026年1月25日
安全审计
已安装于
claude-code110
opencode106
gemini-cli102
codex95
cursor94
github-copilot88
Adversary simulation principles based on MITRE ATT&CK framework.
RECONNAISSANCE → INITIAL ACCESS → EXECUTION → PERSISTENCE
↓ ↓ ↓ ↓
PRIVILEGE ESC → DEFENSE EVASION → CRED ACCESS → DISCOVERY
↓ ↓ ↓ ↓
LATERAL MOVEMENT → COLLECTION → C2 → EXFILTRATION → IMPACT
| Phase | Objective |
|---|---|
| Recon | Map attack surface |
| Initial Access | Get first foothold |
| Execution | Run code on target |
| Persistence | Survive reboots |
| Privilege Escalation | Get admin/root |
| Defense Evasion | Avoid detection |
| Credential Access | Harvest credentials |
| Discovery | Map internal network |
| Lateral Movement | Spread to other systems |
| Collection | Gather target data |
| C2 | Maintain command channel |
| Exfiltration | Extract data |
| Type | Trade-off |
|---|---|
| Passive | No target contact, limited info |
| Active | Direct contact, more detection risk |
| Category | Value |
|---|---|
| Technology stack | Attack vector selection |
| Employee info | Social engineering |
| Network ranges | Scanning scope |
| Third parties | Supply chain attack |
| Vector | When to Use |
|---|---|
| Phishing | Human target, email access |
| Public exploits | Vulnerable services exposed |
| Valid credentials | Leaked or cracked |
| Supply chain | Third-party access |
| Check | Opportunity |
|---|---|
| Unquoted service paths | Write to path |
| Weak service permissions | Modify service |
| Token privileges | Abuse SeDebug, etc. |
| Stored credentials | Harvest |
| Check | Opportunity |
|---|---|
| SUID binaries | Execute as owner |
| Sudo misconfiguration | Command execution |
| Kernel vulnerabilities | Kernel exploits |
| Cron jobs | Writable scripts |
| Technique | Purpose |
|---|---|
| LOLBins | Use legitimate tools |
| Obfuscation | Hide malicious code |
| Timestomping | Hide file modifications |
| Log clearing | Remove evidence |
| Type | Use |
|---|---|
| Password | Standard auth |
| Hash | Pass-the-hash |
| Ticket | Pass-the-ticket |
| Certificate | Certificate auth |
| Attack | Target |
|---|---|
| Kerberoasting | Service account passwords |
| AS-REP Roasting | Accounts without pre-auth |
| DCSync | Domain credentials |
| Golden Ticket | Persistent domain access |
Document the full attack chain:
For each successful technique:
| ❌ Don't | ✅ Do |
|---|---|
| Rush to exploitation | Follow methodology |
| Cause damage | Minimize impact |
| Skip reporting | Document everything |
| Ignore scope | Stay within boundaries |
Remember: Red team simulates attackers to improve defenses, not to cause harm.
Weekly Installs
132
Repository
GitHub Stars
22.6K
First Seen
Jan 25, 2026
Security Audits
Gen Agent Trust HubPassSocketPassSnykFail
Installed on
claude-code110
opencode106
gemini-cli102
codex95
cursor94
github-copilot88
Linux云主机安全托管指南:从SSH加固到HTTPS部署
33,600 周安装