「声明：本博客中涉及到的相关漏洞均为官方已经公开并修复的漏洞，涉及到的安全技术也仅用于企业安全建设和安全对抗研究。本文仅限业内技术研究与讨论，严禁用于非法用途，否则产生的一切后果自行承担。」

红队框架

攻击技战法

[list] 云上攻击技战法 https://hackingthe.cloud/
[doc] 红队技术实战 https://ired.team/

威胁情报 Threat Intelligence

[list] https://github.com/hslatman/awesome-threat-intelligence

红队框架/工具集 Redteam Framework

[tool] Utilities for MITRE™ ATT&CK https://github.com/nshalabi/ATTACK-Tools
[tool] 好用的渗透工具列表 https://github.com/enaqx/awesome-pentest
[book] KALI渗透 https://jobrest.gitbooks.io/kali-linux-cn/content/
[paper] ATT&CK 发布了七款安全产品的评估 https://medium.com/mitre-attack/first-round-of-mitre-att-ck-evaluations-released-15db64ea970d
[doc] 红队技术实战 https://ired.team/
[tool] 红队框架 https://ired.team/offensive-security/red-team-infrastructure/automating-red-team-infrastructure-with-terraform
[cheatsheet] 红队手册 https://github.com/mantvydasb/Offensive-Security-OSCP-Cheatsheets/
[tool] 渗透、红队工具集 https://github.com/blaCCkHatHacEEkr/PENTESTING-BIBLE
[tool] 红队资源集合 https://github.com/yeyintminthuhtut/Awesome-Red-Teaming/
[tool] APT实战资源 https://osint-labs.org/apt/
[cheatsheet] Windows 渗透 https://m0chan.github.io/2019/07/30/Windows-Notes-and-Cheatsheet.html

MITRE ATT&CK Matrix

Caldera https://github.com/mitre/caldera https://caldera.readthedocs.io/en/latest/index.html
Atomic Red Team https://github.com/redcanaryco/atomic-red-team https://atomicredteam.io
DumpsterFire https://github.com/TryCatchHCF/DumpsterFire
Metta https://github.com/uber-common/metta https://github.com/uber-common/metta/wiki
RTA https://github.com/endgameinc/RTA

业内红队 Industry

攻击杀伤链

信息搜集 Reconnaissance

OSINT 在线工具

[tool] 信息搜集和渗透工具集 https://github.com/projectdiscovery/
[tool] 企业邮箱搜索工具 http://www.skymem.info/
[tool] 子域名和DNS历史记录Dnstrails https://securitytrails.com/dns-trails
[tool] 全网证书搜索 http://crt.sh
[tool] 多种域名/IP信息工具 https://viewdns.info/
[tool] https://pentest-tools.com
[tool] 全网资产搜索 Shodan https://www.shodan.io/
[tool] 全网资产搜索 Censys https://censys.io
[tool] 全网资产搜索 Fofa https://fofa.so/
[tool] 全网资产搜索 Zoomeye https://www.zoomeye.org/
[tool] DNS查询 https://dnsdumpster.com/
[tool] 文件在线监测 VirusTotal https://www.virustotal.com/
[tool] DNS查询 http://www.dnsgoodies.com/
[tool] Google ASE aka Google Dorking [Most effective in some cases]
[tool] Spiderfoot [Currently Free, just request for a Spiderfoot instance]
[tool] Binaryedge [Paid/Rate-Limited]
[tool] onyphe.io [Free mostly]
[tool] Github用户历史记录API https://api.github.com/users/{username}/events

信息搜集工具

[tool] BigBountyRecon https://github.com/Viralmaniar/BigBountyRecon

指纹识别

[tool] WAF识别 https://github.com/stamparm/identYwaf

入口突破 Entry

服务器带外管理BMC、IPMI

供应链攻击

[blog] 针对目标企业开源项目的针对性软件供应链攻击 https://medium.com/@alex.birsan/dependency-confusion-4a5d60fec610

Exploitation

[tool] PE文件转为Shellcode / https://github.com/hasherezade/pe_to_shellcode
[blog] Java Runtime.exec(String)执行任意命令 https://www.anquanke.com/post/id/159554 https://mp.weixin.qq.com/s/pzpc44-xH932M4eCJ8LxYg http://jackson.thuraisamy.me/runtime-exec-payloads.html
[paper] 利用 Java JDBC 驱动利用反序列化漏洞 https://xz.aliyun.com/t/7067
[blog] 关于Jackson的CVEs https://medium.com/@cowtowncoder/on-jackson-cves-dont-panic-here-is-what-you-need-to-know-54cd0d6e8062
[paper] FastJson漏洞历史 https://github.com/miaochiahao/slides/tree/master/fastjson
[tool] 一键日Jira https://github.com/0x48piraj/Jiraffe
[tool] 很全的JNDI内存马利用工具 https://github.com/feihong-cs/JNDIExploit

权限提升 Privilege Escalation

[cheatsheet] Windows提权笔记 https://xz.aliyun.com/t/2519
[cheatsheet] Windows提权小抄 https://guif.re/windowseop
[cheatsheet] Windows本地提权技巧 http://payloads.online/archivers/2018-10-08/1
[cheatsheet] Linux提权小抄 https://guif.re/linuxeop
[exploit] Windows-Exploit-Suggester https://github.com/GDSSecurity/Windows-Exploit-Suggester/blob/master/windows-exploit-suggester.py
[exploit] Linux-Exploit-Suggester https://github.com/PenturaLabs/Linux_Exploit_Suggester/
[exploit] Windows Exploits https://github.com/abatchy17/WindowsExploits
[exploit] Windows Sherlock本地提权漏洞检查 https://github.com/rasta-mouse/Sherlock
[cheatsheet] Linux sudo滥用提权 http://touhidshaikh.com/blog/?p=790
[blog] 深入解读MS14-068漏洞：微软精心策划的后门？http://www.freebuf.com/vuls/56081.html
[paper] Windows特权提升 https://www.exploit-db.com/docs/english/46131-windows-privilege-escalations.pdf
[tool] juicy-potato本地提权 https://github.com/ohpe/juicy-potato https://foxglovesecurity.com/2016/09/26/rotten-potato-privilege-escalation-from-service-accounts-to-system/
[exploit] hh.exe提权 https://twitter.com/FlatL1ne/status/1194208167976165376
[tool] Linux本地信息搜集 https://github.com/rebootuser/LinEnum/blob/master/LinEnum.sh
[tool] Linux进程监控 https://github.com/DominicBreuker/pspy
[cheatsheet] Linux Privilege Escalation https://book.hacktricks.xyz/linux-unix/privilege-escalation

持久化后门 Persistent

[tool] Gray Dragon .NET应用Runtime注入工具 / https://www.digitalbodyguard.com/graydragon.html
[trick] 利用环境变量，在任意.Net应用DLL注入 / https://mobile.twitter.com/subTee/status/864903111952875521 https://docs.microsoft.com/en-us/previous-versions/dotnet/netframework-4.0/bb384689(v=vs.100)
[tool] PHP-FPM无文件后门Webshell https://www.anquanke.com/post/id/163197
[tool] 利用PrintDialog持久化+执行命令 http://www.hexacorn.com/blog/2018/08/11/printdialog-exe-yet-another-lolbin-for-loading-dlls/
[tool] SystemSettings http://www.hexacorn.com/blog/2018/08/12/systemsettings-exe-yet-another-lolbin-for-loading-dlls/
[tool] 二进制加密Webshell https://xz.aliyun.com/t/2744 https://github.com/rebeyond/Behinder
[cheatsheet] Linux权限维持 https://xz.aliyun.com/t/7338
[tool] Linux eBPF backdoor https://github.com/kris-nova/boopkit
[tool] 5行代码编译 PAM 后门 https://infosecwriteups.com/creating-a-backdoor-in-pam-in-5-line-of-code-e23e99579cd9

Post Exploitation

Windows

无Powershell.exe的Powershell工具 / https://github.com/Ben0xA/nps
全阶段的Powershell渗透测试脚本 / https://github.com/samratashok/nishang
命令执行 Living off the Land https://github.com/api0cradle/LOLBAS
C# 后渗透测试库 SharpSploit 介绍 https://posts.specterops.io/introducing-sharpsploit-a-c-post-exploitation-library-5c7be5f16c51
[blog] Windows执行命令和下载文件总结 https://www.cnblogs.com/17bdw/p/8550189.html
[trick] 使用Rundll32运行.Net程序 https://blog.xpnsec.com/rundll32-your-dotnet/
[tool] .NET DllExport https://github.com/3F/DllExport

Linux

纯Bash实现的后渗透工具 / https://github.com/TheSecondSun/Bashark/

凭据窃取 Credentials

[tool] SafetyKatz https://github.com/GhostPack/SafetyKatz
[tool] Shellcode Dump LSASS https://osandamalith.com/2019/05/11/shellcode-to-dump-the-lsass-process/
[tool] 内网密码搜集和解密工具 https://github.com/klionsec/Decryption-tool

横向移动 Letaral Movement

[tool] 端口扫描 wrriten in GO https://github.com/ffuf/ffuf/tree/master
[tool] 域信息搜集，域管理员的六度空间 https://github.com/BloodHoundAD/SharpHound
[usage] NMap空闲隐蔽扫描 https://nmap.org/book/idlescan.html
[blog] 使用meterpreter进行NTLM中继攻击 https://diablohorn.com/2018/08/25/remote-ntlm-relaying-through-meterpreter-on-windows-port-445/
[tool] Responder NetBIOS名称欺骗和LLMNR欺骗 https://github.com/SpiderLabs/Responder
[tool] NTLM Relay 攻击 Exchange Web Services https://github.com/Arno0x/NtlmRelayToEWS
[tool] SMB中间人劫持 https://github.com/quickbreach/SMBetray
[tool] 代理隧道 https://github.com/txthinking/brook
[tool] 代理隧道 https://github.com/Dliv3/Venom