red-team

Compare original and translation side by side

🇺🇸

Original

English

🇨🇳

Translation

Chinese

Red Team

Category: Engineering Domain: Offensive Security

分类： 工程 领域： 攻击性安全

Overview

概述

The Red Team skill provides tools for planning and scoping security engagements. It helps define rules of engagement, select methodologies, scope targets, plan attack phases, and generate engagement documentation.

Red Team技能提供用于规划和界定安全作业范围的工具，可帮助定义作战规则、选择评估方法、划定目标范围、规划攻击阶段以及生成作业相关文档。

Quick Start

快速开始

bash

undefined

bash

undefined

Plan a red team engagement

python scripts/engagement_planner.py --type red-team --target "web application" --duration 2w

Plan a penetration test

python scripts/engagement_planner.py --type pentest --target "api,network" --duration 1w --compliance pci-dss

Generate rules of engagement document

python scripts/engagement_planner.py --type red-team --target "full-org" --output engagement_plan.json --format json

undefined

python scripts/engagement_planner.py --type red-team --target "full-org" --output engagement_plan.json --format json

undefined

Tools Overview

工具概览

Tool	Purpose	Key Flags
`engagement_planner.py`	Plan red team engagements with scope, rules, and methodology	`--type` , `--target` , `--duration` , `--compliance`

工具	用途	核心参数
`engagement_planner.py`	规划Red Team作战，包含范围、规则和方法	`--type` , `--target` , `--duration` , `--compliance`

engagement_planner.py

Generates comprehensive engagement plans including:

Scope definition and boundaries
Rules of engagement (ROE)
Methodology selection (MITRE ATT&CK, OWASP, PTES, etc.)
Phase breakdown with timelines
Communication and escalation procedures
Deliverables checklist

生成全面的作战计划，包含：

范围定义与边界
作战规则（ROE）
方法选择（MITRE ATT&CK、OWASP、PTES等）
按时间线拆分的阶段安排
沟通与升级流程
交付物检查清单

Workflows

工作流程

Full Red Team Engagement

完整Red Team作战

Define engagement objectives and scope with
```
engagement_planner.py
```
Review generated rules of engagement with stakeholders
Get formal sign-off on scope and ROE
Execute phases per the plan timeline
Document findings throughout
Deliver final report

使用
```
engagement_planner.py
```
定义作战目标和范围
与利益相关方评审生成的作战规则
获得范围和ROE的正式签字批准
按照计划时间线执行各阶段
全程记录发现结果
交付最终报告

Compliance-Driven Pentest

合规导向渗透测试

Run planner with
```
--compliance
```
flag for framework-specific requirements
Map test cases to compliance controls
Execute against compliance-specific checklist
Generate evidence for auditors

携带
```
--compliance
```
参数运行规划工具，满足特定框架要求
将测试用例与合规控制项映射
按照合规特定检查清单执行测试
为审计人员生成证据

Reference Documentation

参考文档

Red Team Methodology - Frameworks, attack phases, and engagement standards

Red Team方法论 - 框架、攻击阶段和作业标准

Common Patterns

常见模式

Engagement Types

作战类型

Red Team: Full adversary simulation, stealth required, tests detection/response
Penetration Test: Authorized vulnerability exploitation, known to defenders
Purple Team: Collaborative attack/defense, real-time knowledge sharing
Bug Bounty Triage: Structured vulnerability validation from external reports

Red Team：完整对手模拟，要求隐蔽，测试检测/响应能力
渗透测试：授权漏洞利用，防御方已知情
Purple Team：攻防协作，实时知识共享
Bug Bounty Triage：对外部上报的漏洞进行结构化验证