red-team-tactics by sickn33/antigravity-awesome-skills
npx skills add https://github.com/sickn33/antigravity-awesome-skills --skill red-team-tactics基于 MITRE ATT&CK 框架的对手模拟原则。
RECONNAISSANCE → INITIAL ACCESS → EXECUTION → PERSISTENCE
↓ ↓ ↓ ↓
PRIVILEGE ESC → DEFENSE EVASION → CRED ACCESS → DISCOVERY
↓ ↓ ↓ ↓
LATERAL MOVEMENT → COLLECTION → C2 → EXFILTRATION → IMPACT
| 阶段 | 目标 |
|---|---|
| 侦察 | 绘制攻击面 |
| 初始访问 | 获取首个立足点 |
| 执行 | 在目标上运行代码 |
| 持久化 | 在重启后存活 |
| 权限提升 | 获取管理员/root权限 |
广告位招租
在这里展示您的产品或服务
触达数万 AI 开发者,精准高效
| 防御规避 | 避免检测 |
| 凭证访问 | 收集凭证 |
| 发现 | 绘制内部网络图 |
| 横向移动 | 扩散到其他系统 |
| 收集 | 收集目标数据 |
| C2 | 维持命令通道 |
| 数据渗出 | 提取数据 |
| 类型 | 权衡 |
|---|---|
| 被动 | 不接触目标,信息有限 |
| 主动 | 直接接触,检测风险更高 |
| 类别 | 价值 |
|---|---|
| 技术栈 | 攻击向量选择 |
| 员工信息 | 社会工程学 |
| 网络范围 | 扫描范围 |
| 第三方 | 供应链攻击 |
| 向量 | 使用时机 |
|---|---|
| 钓鱼攻击 | 针对人员,有邮件访问权限 |
| 公开漏洞利用 | 暴露了易受攻击的服务 |
| 有效凭证 | 泄露或破解的凭证 |
| 供应链 | 第三方访问 |
| 检查项 | 机会 |
|---|---|
| 未加引号的服务路径 | 写入路径 |
| 弱服务权限 | 修改服务 |
| 令牌权限 | 滥用 SeDebug 等 |
| 存储的凭证 | 收集 |
| 检查项 | 机会 |
|---|---|
| SUID 二进制文件 | 以所有者身份执行 |
| Sudo 配置错误 | 命令执行 |
| 内核漏洞 | 内核漏洞利用 |
| Cron 任务 | 可写脚本 |
| 技术 | 目的 |
|---|---|
| LOLBins | 使用合法工具 |
| 混淆 | 隐藏恶意代码 |
| 时间戳篡改 | 隐藏文件修改 |
| 日志清除 | 移除证据 |
| 类型 | 用途 |
|---|---|
| 密码 | 标准认证 |
| 哈希 | 哈希传递 |
| 票据 | 票据传递 |
| 证书 | 证书认证 |
| 攻击 | 目标 |
|---|---|
| Kerberoasting | 服务账户密码 |
| AS-REP Roasting | 无需预认证的账户 |
| DCSync | 域凭证 |
| 黄金票据 | 持久域访问 |
记录完整的攻击链:
针对每个成功的技术:
| ❌ 不要 | ✅ 要做 |
|---|---|
| 急于利用漏洞 | 遵循方法论 |
| 造成损害 | 最小化影响 |
| 跳过报告 | 记录一切 |
| 忽视范围 | 保持在边界内 |
记住: 红队模拟攻击者是为了改进防御,而不是造成伤害。
此技能适用于执行概述中描述的工作流程或操作。
每周安装数
329
仓库
GitHub 星标数
27.1K
首次出现
Jan 20, 2026
安全审计
安装于
opencode261
gemini-cli256
claude-code235
cursor228
codex224
github-copilot203
Adversary simulation principles based on MITRE ATT&CK framework.
RECONNAISSANCE → INITIAL ACCESS → EXECUTION → PERSISTENCE
↓ ↓ ↓ ↓
PRIVILEGE ESC → DEFENSE EVASION → CRED ACCESS → DISCOVERY
↓ ↓ ↓ ↓
LATERAL MOVEMENT → COLLECTION → C2 → EXFILTRATION → IMPACT
| Phase | Objective |
|---|---|
| Recon | Map attack surface |
| Initial Access | Get first foothold |
| Execution | Run code on target |
| Persistence | Survive reboots |
| Privilege Escalation | Get admin/root |
| Defense Evasion | Avoid detection |
| Credential Access | Harvest credentials |
| Discovery | Map internal network |
| Lateral Movement | Spread to other systems |
| Collection | Gather target data |
| C2 | Maintain command channel |
| Exfiltration | Extract data |
| Type | Trade-off |
|---|---|
| Passive | No target contact, limited info |
| Active | Direct contact, more detection risk |
| Category | Value |
|---|---|
| Technology stack | Attack vector selection |
| Employee info | Social engineering |
| Network ranges | Scanning scope |
| Third parties | Supply chain attack |
| Vector | When to Use |
|---|---|
| Phishing | Human target, email access |
| Public exploits | Vulnerable services exposed |
| Valid credentials | Leaked or cracked |
| Supply chain | Third-party access |
| Check | Opportunity |
|---|---|
| Unquoted service paths | Write to path |
| Weak service permissions | Modify service |
| Token privileges | Abuse SeDebug, etc. |
| Stored credentials | Harvest |
| Check | Opportunity |
|---|---|
| SUID binaries | Execute as owner |
| Sudo misconfiguration | Command execution |
| Kernel vulnerabilities | Kernel exploits |
| Cron jobs | Writable scripts |
| Technique | Purpose |
|---|---|
| LOLBins | Use legitimate tools |
| Obfuscation | Hide malicious code |
| Timestomping | Hide file modifications |
| Log clearing | Remove evidence |
| Type | Use |
|---|---|
| Password | Standard auth |
| Hash | Pass-the-hash |
| Ticket | Pass-the-ticket |
| Certificate | Certificate auth |
| Attack | Target |
|---|---|
| Kerberoasting | Service account passwords |
| AS-REP Roasting | Accounts without pre-auth |
| DCSync | Domain credentials |
| Golden Ticket | Persistent domain access |
Document the full attack chain:
For each successful technique:
| ❌ Don't | ✅ Do |
|---|---|
| Rush to exploitation | Follow methodology |
| Cause damage | Minimize impact |
| Skip reporting | Document everything |
| Ignore scope | Stay within boundaries |
Remember: Red team simulates attackers to improve defenses, not to cause harm.
This skill is applicable to execute the workflow or actions described in the overview.
Weekly Installs
329
Repository
GitHub Stars
27.1K
First Seen
Jan 20, 2026
Security Audits
Gen Agent Trust HubPassSocketPassSnykFail
Installed on
opencode261
gemini-cli256
claude-code235
cursor228
codex224
github-copilot203
OpenClaw 安全 Linux 云部署指南:私有优先、SSH隧道、Podman容器化
19,500 周安装