redteam

红队

采用攻击者思维，通过对抗性思考、模拟攻击和进攻性安全测试，识别安全漏洞、渗透途径和系统性弱点。

何时使用我

在以下情况下使用此技能：

• 开展安全评估或渗透测试
• 设计对安全要求较高的系统或功能
• 为安全审计或合规审查做准备
• 应对安全事件或数据泄露
• 通过演练培训防御团队（蓝队）
• 评估安全控制措施和检测能力
• 测试事件响应流程
• 验证安全架构决策
• 评估第三方系统或集成
• 培养安全意识和对攻击者的理解

我能做什么

1. 采用攻击者思维

• 从不同类型攻击者的角度思考：

  • 脚本小子（使用自动化工具，技术水平较低）
  • 有组织犯罪团伙（以经济利益为动机，技术水平中等）
  • 国家级攻击者（资源无限，技术水平高）
  • 内部威胁（掌握知识、拥有访问权限且具有攻击动机）
  • 黑客行动主义者（以意识形态为动机，追求曝光度）

• 采用攻击方法：

  • 侦察（信息收集、足迹识别）
  • 扫描（漏洞发现、枚举）
  • 漏洞利用（将漏洞武器化）
  • 权限提升（扩大访问权限）
  • 持久化（维持访问权限）
  • 数据窃取（窃取、提取数据）

2. 漏洞发现

• 识别攻击面和入口点
• 绘制信任边界和权限转换
• 发现安全配置错误
• 查找逻辑缺陷和业务逻辑漏洞
• 识别薄弱的身份验证和授权机制
• 发现不安全的数据处理和存储
• 查找缺失的安全控制措施

3. 攻击模拟

• 串联漏洞以实现最大影响
• 通过创新方法绕过安全控制措施
• 利用组件之间的信任关系
• 在适当情况下使用社会工程学技术
• 测试物理安全（用于全面评估）
• 模拟高级持续性威胁（APT 战术）

4. 影响评估

• 评估漏洞利用的后果（数据丢失、系统失陷）
• 评估业务影响（财务、声誉、运营）
• 衡量检测能力（攻击多久才会被发现？）
• 测试响应效果（事件响应、恢复）
• 根据可能性和影响量化风险等级

红队技术

侦察与信息收集：

• 收集开源情报（OSINT）
• 网络扫描和服务枚举
• 应用指纹识别和技术检测
• 社交媒体画像分析（用于社会工程学）
• DNS 侦察和子域名发现

漏洞识别：

• 使用工具进行自动化扫描（Nessus、OpenVAS 等）
• 通过手动测试查找逻辑缺陷和业务逻辑漏洞
• 通过代码审查查找安全弱点
• 通过配置审查查找安全配置错误
• 通过架构分析查找设计缺陷

漏洞利用方法：

• Web 应用攻击（SQLi、XSS、CSRF、SSRF 等）
• 网络攻击（中间人攻击、重放攻击、欺骗攻击）
• 绕过身份验证（密码破解、会话劫持）
• 权限提升（水平和垂直提升）
• 持久化机制（后门、计划任务等）

社会工程学：

• 钓鱼模拟（电子邮件、电话、当面接触）
• 设计借口（令人信服的故事和身份设定）
• 诱饵攻击（投放恶意 USB 设备等）
• 利益交换（互惠条件）
• 尾随（跟随他人进入受限区域）

示例

# Conduct reconnaissance on target system
npm run redteam:recon -- --target example.com --scope external

# Perform vulnerability assessment
npm run redteam:vulnerability-scan -- --target 192.168.1.0/24 --intensity aggressive

# Simulate web application attacks
npm run redteam:web-attack -- --url https://app.example.com --techniques "sql-injection,xss,csrf"

# Test social engineering resilience
npm run redteam:phishing-test -- --targets employees.csv --template "password-reset"

# Full red team engagement
npm run redteam:full-engagement -- --target organization --duration 2weeks --rules-of-engagement approved

输出格式

Red Team Engagement Report
──────────────────────────────
Target: E-commerce Platform (shop.example.com)
Engagement Duration: 72 hours
Rules of Engagement: Approved scope, no production impact
Red Team Lead: Synthetic Attacker #7

Executive Summary:
- Critical Vulnerabilities: 3
- High Severity Vulnerabilities: 7
- Medium Severity Vulnerabilities: 12
- Detection Rate: 42% (58% went undetected)
- Mean Time to Detection: 8.5 hours
- Business Impact Score: 8.2/10 (Severe)

Critical Findings:

1. Vulnerability: SQL Injection in Product Search
   CVE Equivalent: CWE-89
   Severity: Critical
   
   Attack Path:
   - Reconnaissance identified search functionality
   - Fuzzing revealed parameter vulnerable to SQL injection
   - Exploitation allowed database schema extraction
   - Privilege escalation to database administrator
   - Data exfiltration possible: 2.3M customer records
   
   Proof of Concept:

GET /search?q=' UNION SELECT username,password FROM users-- Response: admin | 5f4dcc3b5aa765d61d8327deb882cf99

Impact:
- Complete database compromise
- Customer PII exposure (names, emails, addresses)
- Payment information potentially accessible
- Regulatory violations (GDPR, CCPA, PCI-DSS)

Business Consequences:
- Estimated fine: $4.2M (GDPR violation)
- Customer notification costs: $850K
- Reputational damage: 35% customer churn likely
- Legal liability: Class action lawsuits probable

Recommendation:
- Immediate: WAF rule blocking injection patterns
- Short-term: Parameterized queries implementation
- Long-term: Secure coding training, code review process

2. Vulnerability: Authentication Bypass via JWT Tampering
CVE Equivalent: CWE-287
Severity: High

Attack Path:
- Captured JWT token from legitimate user
- Analyzed token structure (header.payload.signature)
- Modified "role" claim from "user" to "admin"
- None signature verification detected
- Full administrative access achieved

Technical Details:
- JWT uses "none" algorithm vulnerability
- No signature validation on server side
- Role-based access control depends solely on token claims

Impact:
- Complete administrative control
- Order manipulation, pricing changes, user data access
- Financial fraud capability
- Platform compromise

Detection Metrics:
- Attack duration before detection: 14 hours
- Detection method: Manual log review (not automated)
- Alert quality: Low (generic "unusual activity")

Recommendation:
- Immediate: Reject "none" algorithm JWTs
- Short-term: Implement proper JWT validation
- Long-term: Add anomaly detection for admin actions

3. Vulnerability: Server-Side Request Forgery (SSRF)
CVE Equivalent: CWE-918
Severity: High

Attack Path:
- Image upload functionality accepts URLs
- SSRF to internal metadata service (169.254.169.254)
- AWS credentials retrieval
- Cloud environment compromise

Impact:
- Complete AWS account compromise
- Data exfiltration from S3 buckets
- Resource hijacking (crypto mining, botnet)
- Infrastructure destruction capability

Business Consequences:
- Cloud resource costs: $50K+/month potential
- Data breach: All cloud-stored data
- Service disruption: Complete outage possible
- Recovery time: Weeks to rebuild infrastructure

Recommendation:
- Immediate: Block metadata service access
- Short-term: Implement URL validation and allowlisting
- Long-term: Network segmentation, outbound proxy

Detection & Response Assessment:
- Security Monitoring Coverage: 65%
- Alert Quality Score: 4.2/10 (High false positives, low true positives)
- Mean Time to Respond: 3.5 hours (excluding undetected incidents)
- Incident Response Effectiveness: 6.1/10
- Forensic Capability: Basic (log review only)

Attack Simulation Metrics:
- Initial Compromise Time: 2.3 hours
- Privilege Escalation Time: 1.1 hours
- Lateral Movement Effectiveness: 8.7/10
- Persistence Established: 5 locations
- Data Exfiltration Simulation: 2.1GB in 4.5 hours

Red Team Observations:
1. Defense-in-depth lacking (single points of failure)
2. Detection focused on perimeter, blind to internal movement
3. Incident response reactive, not proactive
4. Security controls inconsistent across services
5. Developers lack security training (vulnerability density high)

Strategic Recommendations:
1. IMMEDIATE (Next 24 hours):
- Apply WAF rules for SQL injection protection
- Disable "none" algorithm for JWT
- Block metadata service access from applications

2. SHORT-TERM (Next 2 weeks):
- Implement parameterized queries globally
- Add JWT signature validation
- Deploy SSRF protection middleware
- Enhance monitoring for authentication anomalies

3. MEDIUM-TERM (Next 2 months):
- Conduct secure coding training for developers
- Implement automated security testing in CI/CD
- Enhance incident response playbooks
- Deploy endpoint detection and response (EDR)

4. LONG-TERM (Next 6 months):
- Establish security champion program
- Implement threat modeling process
- Deploy deception technology (honeypots, canaries)
- Conduct regular red team exercises (quarterly)

Lessons Learned:
- The most critical vulnerabilities were in business logic, not typical OWASP Top 10
- Detection failed for sophisticated attacks (58% undetected)
- Response was slow even for detected incidents
- Security debt accumulated from rapid feature development
- Attacker mindset revealed blind spots in defensive thinking

Engagement Value:
- Prevented potential breach: High confidence (>90%)
- Cost savings: Estimated $8.4M (fines + breach costs)
- Risk reduction: Significant (addressed critical vulnerabilities)
- Organizational learning: High (attacker perspective gained)
- Security maturity improvement: Foundation for growth

备注

• 红队测试需要获得适当授权并遵守交战规则
• 重点是提升安全性，而不是指责个人或团队
• 在全面测试与业务运营需求之间取得平衡
• 清晰记录发现，并提出可执行的建议
• 在组织内分享经验教训
• 利用红队测试的发现提升蓝队能力
• 定期开展红队测试，避免安全建设停滞
• 优秀的红队会创造性地思考，而不只是运行工具
• 衡量随时间推移的改进，而不只是统计漏洞数量
• 红队测试通过增进共同理解来培育安全文化