Home / Cybersecurity / How to become Red teamer
How to become Red teamer
Beginner
v1.0.0
Master Red Teaming from Fundamentals to Advanced Adversary Simulation
A practical, structured roadmap designed to take learners from cybersecurity fundamentals to advanced Red Team operations. Learn networking, Linux, Windows, Active Directory, reconnaissance, OSINT, vulnerability assessment, web and network penetration testing, privilege escalation, Active Directory attacks, initial access, lateral movement, persistence, credential attacks, command and control, evasion, payload development, cloud security, adversary simulation, threat emulation, and professional Red Team operations.
Your progress
0 / 108 topics
0 %
Saved in this browser. Clearing site data will reset it.
Topics in this roadmap
The interactive map needs JavaScript. Here is the full list.
Offensive Security Mindset
An offensive mindset means always asking how a feature can be abused rather than how it is meant to be used. Attackers think in terms of trust boundaries, assumptions and the weakest link in a chain of controls. You learn to chain small, low severity issues into a serious impact, because real breaches are rarely a single perfect exploit. Building this way of thinking early makes every tool and technique later far more effective, since tools only automate ideas you already have.
Rules of Engagement
Rules of engagement define exactly what you may and may not do during an engagement. They cover the scope of systems, allowed hours, off limits actions such as denial of service, data handling requirements and emergency contacts. A signed rules of engagement document plus authorisation is what separates legal testing from a crime. You should also agree on deconfliction, meaning a way to prove a suspicious event was you and not a real attacker, so the defenders do not waste hours chasing your activity.
Red vs Pentest vs Purple
A penetration test aims to find and prove as many vulnerabilities as possible in a defined scope within a fixed time. A red team engagement is goal driven and stealth focused, measuring detection and response as much as exploitation. A purple team exercise puts attackers and defenders in the same room so that every attack is paired with an attempt to detect it, then detection is improved on the spot. Knowing which model a client actually needs is a core professional skill.
Cyber Kill Chain
The Lockheed Martin Cyber Kill Chain breaks an intrusion into stages: reconnaissance, weaponisation, delivery, exploitation, installation, command and control, and actions on objectives. Mapping your engagement to these stages helps you plan, communicate progress and understand where a defender could have stopped you. It is an older model but still useful as a shared vocabulary and as a simple mental checklist during an operation.
MITRE ATT&CK
MITRE ATT&CK
MITRE ATT&CK is a large, community maintained knowledge base of real attacker tactics and techniques observed in the wild. Tactics are the goals such as initial access or persistence, and techniques are the specific ways those goals are achieved. Red teamers use ATT&CK to plan realistic engagements, describe what they did in a language defenders understand, and to make sure their emulation looks like real adversaries rather than a random tool run.
MITRE ATT&CK
Atomic Red Team
Adversary Emulation
Adversary emulation means selecting a specific real world threat group that is relevant to the target industry, studying its known behaviour, and reproducing those techniques in a controlled way. Instead of a generic attack, you replay how a named group would operate, which makes the test far more meaningful to defenders. Frameworks and public threat reports give you the tactics, techniques and procedures to copy, and tools such as Atomic Red Team let you fire single techniques to test detection.
Atomic Red Team
MITRE ATT&CK
TCP/IP Model
The TCP IP model describes how data moves across networks in four layers: link, internet, transport and application. TCP provides a reliable, ordered connection using a three way handshake, while UDP is connectionless and fast but offers no delivery guarantee. Understanding the handshake explains how port scanners work and why some scans are stealthier than others. Knowing which protocol a service uses tells you how to interact with it and how it might be filtered.
DNS
The Domain Name System translates human friendly names into IP addresses using record types such as A, AAAA, CNAME, MX and TXT. For attackers, DNS is both a reconnaissance goldmine, revealing subdomains and mail servers, and a covert channel, because DNS traffic is often allowed out of networks with little inspection. Zone transfers, when misconfigured, can hand you an entire internal name list at once.
HTTP and HTTPS
HTTP is the request and response protocol behind the web, using methods such as GET and POST, status codes, headers and cookies. HTTPS wraps HTTP inside TLS to provide encryption and identity. Since so many applications are web based, understanding requests, sessions and headers is essential for web exploitation, payload delivery over the web, and blending command and control traffic into normal looking web requests.
PortSwigger Web Security Academy
Common Ports and Services
Learning the common ports and the services behind them speeds up every enumeration phase. Examples include 22 for SSH, 80 and 443 for web, 445 for SMB, 3389 for RDP, 389 and 636 for LDAP, and 88 for Kerberos. Recognising a port pattern lets you guess what a host does and pick the right follow up technique without waiting for slow full scans. Always verify the actual service though, since ports can be moved.
Tunneling and Proxies
Tunneling moves traffic through an intermediate host so you can reach networks you cannot touch directly. SSH local and dynamic forwarding, SOCKS proxies and tools such as Chisel let you route your tools through a compromised machine into an internal segment. This is the backbone of pivoting during an engagement. Understanding proxies also helps you route web tools through Burp for inspection and manipulation.
HackTricks
Windows Internals
Windows is the dominant desktop and enterprise operating system, so understanding it deeply pays off constantly. Key ideas include processes and threads, access tokens that carry a user identity, the registry as a central configuration store, and services that run in the background with high privilege. Knowing how authentication tokens and integrity levels work explains many privilege escalation and lateral movement techniques you will use later.
Active Directory Basics
Active Directory is the identity backbone of most enterprises, managing users, computers, groups and policies inside domains and forests. It uses Kerberos and NTLM for authentication and stores everything in a directory that can be queried. Because a single compromised account can often be leveraged across the whole domain, Active Directory is the primary battleground of internal red team engagements, which is why a whole later section is devoted to attacking it.
ADSecurity
Bash Scripting
Bash scripting turns repetitive command line tasks into repeatable automation. Loops, conditionals, variables and pipelines let you enumerate hosts, parse tool output, and build small helper scripts on the fly during an engagement. Even a few lines of Bash can save hours, for example looping over a host list to test a single check. It is also common to write quick one liners directly on a compromised Linux box.
PowerShell Basics
PowerShell is a powerful scripting language and shell built into Windows, giving deep access to the operating system and .NET. For red teamers it is a native way to enumerate systems, move files, and run tooling without dropping obvious binaries. Because it is trusted and present everywhere, it is a favourite living off the land option, though modern logging and script block logging mean you must understand its telemetry too.
LOLBAS
Permissions and File Systems
Permission models decide who can read, write or execute a resource, and misconfigurations here are a constant source of privilege escalation. On Linux you study owner, group and other bits plus special bits like setuid. On Windows you study access control lists on files, registry keys and services. Learning to spot a weak permission, such as a writable service binary, is one of the highest value skills in the whole roadmap.
GTFOBins
PowerShell for Offense
Offensive PowerShell goes beyond basics into in memory execution, downloading and running code without touching disk, and interacting with Windows APIs. Historic toolkits showed how much can be done natively, from credential access to Active Directory enumeration. Because defenders now log PowerShell heavily, modern use focuses on understanding that telemetry and choosing quieter techniques, but the language remains central to Windows tradecraft.
LOLBAS
C and C++ Basics
C and C++ give you low level control over memory, which is essential for understanding memory corruption bugs, writing shellcode loaders and building tooling that interacts directly with the operating system. Reading C helps you analyse vulnerabilities in source, and writing it lets you produce payloads that evade simple detection. Even a working reading level of C unlocks a large amount of exploit and malware literature.
Go for Tooling
Go has become popular for offensive tooling because it compiles to a single static binary that runs across platforms without dependencies, which is ideal for dropping tools onto target hosts. Many modern command and control frameworks and implants are written in Go. Its concurrency support also makes it good for fast network tooling. Learning to build small Go utilities gives you portable, self contained capabilities.
Sliver C2
Windows API
The Windows API is the set of functions programs use to talk to the operating system, covering processes, memory, files and networking. Advanced tradecraft such as process injection, credential access and evasion relies on calling these functions directly, sometimes bypassing higher level wrappers to avoid detection. Understanding core calls like those for allocating memory and creating remote threads is the foundation of writing custom loaders and evasive payloads.
Passive Recon
Passive reconnaissance collects information without sending any traffic that the target could log, which keeps you invisible in the early phase. Sources include search engines, public records, social media, certificate logs and third party databases. Because there is no direct interaction, passive recon carries almost no risk of detection and is the correct first step. It builds the map that active recon later confirms.
Active Recon
Active reconnaissance involves interacting with the target directly, for example resolving hosts, probing services or browsing an application. It produces more accurate and current data than passive methods but can be logged and detected, so it must fit the rules of engagement and the desired stealth level. The skill is balancing the value of fresh information against the noise you create.
Subdomain Enumeration
Subdomain enumeration discovers the many hosts that live under a domain, such as development, staging or forgotten legacy systems, which often have weaker security than the main site. Techniques combine passive sources like certificate transparency and DNS aggregators with active brute forcing of names. Each discovered subdomain expands the attack surface and may expose a soft entry point that the organisation forgot about.
HackTricks
Google Dorking
Google dorking uses advanced search operators such as site, filetype and inurl to surface exposed files, login portals, configuration data and sensitive documents that were indexed by accident. It is fast, free and entirely passive. A well crafted query can reveal credentials in public repositories or internal documents that should never have been reachable, giving you a head start before any active testing.
Shodan and Censys
Shodan and Censys continuously scan the internet and index exposed devices and services, letting you query for a target organisation to find open ports, technologies and even vulnerable systems without scanning them yourself. This is passive from the target point of view because the scanning was already done. These platforms quickly reveal exposed databases, cameras, industrial devices and forgotten servers tied to a target.
Email Harvesting
Email harvesting collects valid email addresses and the naming convention an organisation uses, which is the raw material for phishing and password spraying. Sources include search engines, breach data, social networks and public documents. Knowing the format, for example first initial and last name, lets you predict addresses for staff you find on professional networks, turning a few known names into a large target list.
Service Enumeration
Service enumeration is the deep dive after a scan, where you interact with each discovered service to learn its version, configuration and possible weaknesses. Every service has its own tools and quirks, so you build a checklist per protocol. Careful enumeration frequently uncovers default credentials, exposed shares, verbose error messages and misconfigurations that lead directly to a foothold, which is why it deserves more time than exploitation.
HackTricks
Vulnerability Scanning
Vulnerability scanners automatically compare discovered software and configurations against databases of known issues, producing a prioritised list of potential weaknesses. They save time on large scopes but generate noise and false positives, so results must be verified manually. In a stealthy red team, heavy scanning may be avoided entirely, while in a wider assessment it is a useful early filter to focus effort.
SMB Enumeration
SMB is the Windows file sharing protocol on port 445 and a rich source of information and access. Enumeration can reveal shares, users, password policies and sometimes readable or writable folders that expose credentials or allow payload placement. Null sessions and guest access, where allowed, can leak surprising amounts of data. SMB is often the first internal service a red teamer examines closely.
HackTricks
LDAP Enumeration
LDAP is the query protocol for Active Directory, and even a low privileged domain account can read a large amount of the directory. Enumeration reveals users, groups, computers, organisational structure and attributes that hint at privileged accounts. This information feeds tools like BloodHound that map attack paths. Learning to query LDAP directly gives you flexibility when standard tools are blocked or monitored.
ADSecurity
Web Enumeration
Web enumeration discovers hidden directories, files, parameters and virtual hosts on a web server. Content discovery tools brute force common paths to find admin panels, backups, API endpoints and forgotten pages. Combined with technology fingerprinting, this maps the application before you test it. Many serious findings begin with a forgotten endpoint or an exposed backup file uncovered during patient web enumeration.
PortSwigger Web Security Academy
Spear Phishing
Spear phishing targets a small, specific group with a highly tailored message based on recon, which makes it far more effective than mass email. You reference real projects, colleagues or events to earn trust. Because it is precise, it also creates less noise and is more likely to slip past filters. Crafting a believable pretext for a named person is a blend of research, writing and psychology.
Malicious Documents
Malicious documents deliver code through office files, PDFs or other formats that a target expects to open. Historically macros were the classic vector, and modern variations use other embedded content and container formats as macro handling has tightened. The challenge is building a document that executes reliably while surviving mail filtering and endpoint inspection. Studying how defenders detect these documents is essential to building ones that work.
PayloadsAllTheThings
Payload Delivery
Payload delivery is the craft of getting your code onto a target and running it without tripping controls. Options include email attachments, links to staged files, removable media and web downloads. Each path faces different defences, so operators stage payloads, use trusted looking domains and split delivery into stages to reduce exposure. Reliable delivery is often harder than the exploitation that follows.
Vishing
Vishing is voice phishing, where an operator calls a target and uses a believable story to extract information or push them into an action, such as resetting a password or approving a login. It exploits helpfulness and authority pressure that written messages cannot. Because it leaves less technical evidence, it can be very effective, and it tests help desk and verification procedures that email campaigns never reach.
Pretexting
Pretexting is the invention of a believable scenario and identity that justifies your request to a target. A strong pretext gives the target a reason to comply that fits their normal work, for example posing as IT support during a known migration. It underpins every social engineering method, phishing and vishing included. The best pretexts are built from real recon so that details check out if the target verifies them.
SQL Injection
SQL injection happens when user input is placed into a database query without proper handling, letting an attacker change the query logic. Impact ranges from reading arbitrary data to bypassing login and, in some cases, running commands on the database server. You learn to identify injection points, extract data through union and blind techniques, and understand why parameterised queries are the correct fix. It remains one of the most damaging web flaws.
PortSwigger Web Security Academy
Cross Site Scripting
Cross site scripting lets an attacker run JavaScript in another user browser by injecting script through unsanitised input. Reflected, stored and DOM based variants differ in where the payload lives, but all can steal sessions, perform actions as the victim, or deliver further attacks. In a red team, XSS can be chained into account takeover or used to reach internal interfaces. Understanding output encoding explains both the attack and its defence.
PortSwigger Web Security Academy
Server Side Request Forgery
Server side request forgery tricks a server into making requests on the attacker behalf, often to internal systems that are not reachable from outside. This can expose cloud metadata services, internal APIs and admin panels, making it a powerful pivot from the edge into a network. SSRF has become especially dangerous in cloud environments where metadata endpoints can hand out credentials.
PortSwigger Web Security Academy
Insecure Direct Object References
An insecure direct object reference occurs when an application exposes a reference to an internal object, such as a record id in a URL, and fails to check that the current user is allowed to access it. By changing the identifier you reach other users data. IDOR is common, easy to test and often high impact, which makes it a favourite finding. It is a pure access control flaw with no fancy payload required.
PortSwigger Web Security Academy
File Upload Attacks
File upload features become dangerous when an application accepts and stores files without validating type and content, allowing an attacker to upload a script that the server will execute. This can lead directly to remote code execution. Bypasses target weak checks on extension, content type or magic bytes. Even when execution is blocked, uploads can enable stored XSS or overwrite important files, so they deserve careful testing.
PayloadsAllTheThings
Authentication Bypass
Authentication bypass covers the many ways to log in as someone else or skip login entirely, including weak password reset flows, predictable tokens, flawed multi factor logic and logic errors in the login sequence. Since authentication is the front door of most applications, a single flaw here can undo every other control. Testing it thoroughly, including edge cases and race conditions, often produces the highest severity findings.
PortSwigger Web Security Academy
Metasploit Framework
Metasploit is a modular exploitation framework that bundles exploits, payloads and post exploitation modules behind a common interface. It speeds up common tasks and is excellent for learning how an exploit, a payload and a handler fit together. Because it is well known to defenders, its default artifacts are heavily signatured, so operators learn when to use it and when a quieter custom approach is safer.
Metasploit Docs
Buffer Overflows
A buffer overflow occurs when a program writes more data into a memory buffer than it can hold, overwriting adjacent memory and potentially the control flow of the program. Understanding the stack, registers and how return addresses are overwritten teaches the fundamentals of memory corruption. While modern mitigations make classic overflows harder, the concepts underpin much of exploit development and reverse engineering.
Msfvenom Payloads
Msfvenom generates standalone payloads in many formats and encodings, from reverse shells to shellcode you embed in your own loader. It lets you tailor a payload to the target platform and delivery method. Learning its options, including format and encoder choices, helps you produce working payloads quickly, though relying on default encoders alone is rarely enough to beat modern endpoint protection.
Metasploit Docs
Public Exploits
Public exploit databases collect proof of concept code for known vulnerabilities. The real skill is not finding an exploit but reading it to understand what it does, checking it against your exact target version, and running it safely so you do not crash a live system. Many public exploits need small changes to work, and some contain deliberate mistakes or malicious code, so understanding before executing is essential.
HackTricks
Fuzzing
Fuzzing feeds a program large volumes of malformed or unexpected input to trigger crashes that may indicate exploitable bugs. It is a core technique in vulnerability research and can also be applied to web parameters and protocols during an engagement. Even simple fuzzing of an unusual service can reveal input handling flaws that no scanner would find, making it a valuable skill for discovering novel weaknesses.
Cobalt Strike
Cobalt Strike is a widely used commercial C2 platform known for its flexible beacon and malleable communication profiles that let operators shape traffic to look like legitimate services. It is a strong learning reference because both attackers and defenders study it heavily. Because it is so well known, its default indicators are detected everywhere, so realistic use depends on careful profile and infrastructure configuration.
Sliver
Sliver is an open source C2 framework written in Go that has become popular for its cross platform implants, multiple transport options and active development. Being free and open, it is excellent for learning how modern C2 works under the hood. Operators use it to generate implants, manage sessions and pivot, and defenders study it because it appears in real intrusions.
Sliver C2
Beaconing
Beaconing is the pattern where an implant checks in with its C2 server at intervals to receive tasks, rather than holding a constant connection. Randomised timing, called jitter, and long sleep intervals help the traffic hide among normal activity. Defenders hunt for the regular heartbeat of a beacon, so operators tune timing carefully to balance responsiveness against stealth.
Malleable Profiles
Malleable profiles let an operator define exactly how C2 traffic looks on the wire, including headers, URIs and data encoding, so it mimics a legitimate application or cloud service. Well crafted profiles make network detection much harder because the traffic resembles normal browsing. Building and testing profiles against detection tooling is a specialised but high value red team skill.
Redirectors
A redirector is an intermediate server that sits between the target and your real C2 server, forwarding valid traffic while hiding and protecting the true infrastructure. If a redirector is burned, you simply replace it without exposing your team server. Using redirectors, along with categorised domains and trusted cloud fronts, is core infrastructure hygiene that keeps an operation alive when defenders start blocking indicators.
Linux Privilege Escalation
Linux privilege escalation looks for ways a normal user can gain root, including misconfigured sudo rules, setuid binaries, writable scripts run by root, weak file permissions and exposed credentials. Enumeration scripts speed up the search, but understanding why each finding matters lets you exploit it reliably. The setuid and sudo paths in particular, catalogued in resources like GTFOBins, are common and high value.
GTFOBins
Windows Privilege Escalation
Windows privilege escalation moves from a limited user to SYSTEM by abusing service misconfigurations, weak permissions on binaries or registry keys, unquoted service paths, stored credentials and token privileges. Automated enumeration helps, but knowing the mechanism behind each technique lets you exploit it and explain the fix. Many findings are configuration issues rather than software bugs, which is why enumeration matters more than exploits.
HackTricks
Kernel Exploits
Kernel exploits target flaws in the operating system core to gain the highest privileges directly. They can be powerful when a host is unpatched, but they are risky because a failed attempt can crash the system, which is unacceptable on production machines. For that reason experienced operators treat kernel exploits as a last resort after safer configuration based paths have been ruled out.
SUID and Sudo Abuse
On Linux, the setuid bit lets a program run with the privileges of its owner, and sudo rules grant specific elevated commands. When these are applied to programs that can spawn shells or read arbitrary files, a normal user can escalate to root. GTFOBins documents which common binaries can be abused this way. Spotting a dangerous setuid binary or a loose sudo rule is one of the fastest Linux escalation wins.
GTFOBins
Token Impersonation
Windows uses access tokens to represent a user identity for a process. If a low privileged account holds certain privileges, or if a higher privileged token is available on the system, an attacker can impersonate it and act as that user, often reaching SYSTEM. Techniques in the well known potato family abuse specific privileges to do this. Token abuse is a common and reliable Windows escalation route.
HackTricks
DLL Hijacking
DLL hijacking abuses the way Windows searches for libraries a program loads. If an application looks for a DLL in a location an attacker can write to, and finds a malicious copy first, the attacker code runs with the application privileges. This can be used for escalation, persistence and evasion. Understanding the DLL search order is the key to both finding and fixing these issues.
LOLBAS
Kerberoasting
Kerberoasting requests service tickets for accounts that have a service principal name and cracks them offline to recover the account password. Any domain user can request these tickets, so the attack needs only a normal account, and service accounts often have weak, rarely changed passwords. It is a low noise, high reward technique and a staple of internal engagements. The fix is strong, managed service account passwords.
ADSecurity
AS-REP Roasting
AS-REP roasting targets accounts that do not require Kerberos pre authentication. For such accounts an attacker can request authentication data and crack it offline to recover the password, without needing any valid credentials first. It is quick to check across a domain and occasionally yields an easy win on a misconfigured account. Requiring pre authentication everywhere closes the hole.
ADSecurity
Pass the Hash
Pass the hash uses a captured NTLM password hash to authenticate as a user without ever knowing the plaintext password, because the protocol accepts the hash as proof of identity. This lets an attacker reuse credentials harvested from one machine to access others. It is a foundational lateral movement technique on Windows networks and a major reason password hashes must be protected as carefully as passwords.
Impacket
Golden Ticket
A golden ticket is a forged Kerberos ticket granting ticket created using the secret key of the domain krbtgt account. With it, an attacker can impersonate any user, including domain admin, and access resources at will, providing extremely powerful and persistent control. Because it requires the krbtgt key, obtaining a golden ticket usually means the domain is already deeply compromised, and full recovery requires rotating that key twice.
ADSecurity
DCSync
DCSync abuses replication rights to ask a domain controller for password data as if it were another domain controller, letting an attacker with the right permissions extract hashes for any account, including krbtgt. It is a clean way to dump credentials without touching the domain controller disk. Because it relies on specific high privileges, tightly controlling who holds replication rights is the primary defence.
Impacket
BloodHound
BloodHound collects Active Directory data and visualises the relationships between users, groups, computers and permissions as a graph, then finds the shortest paths to high value targets such as domain admin. It turns a confusing directory into a clear attack plan and reveals non obvious escalation routes hidden in group memberships and access control lists. It is essential for efficient, targeted domain attacks.
BloodHound
ACL Abuse
Access control lists in Active Directory define who can modify objects, and misconfigured permissions can let a low privileged user reset another user password, add themselves to a group, or grant themselves further rights. These paths are often invisible without tooling but are common in large, aged directories. BloodHound surfaces them, and abusing them frequently provides a quiet route to privilege that avoids credential cracking entirely.
BloodHound
Delegation Abuse
Kerberos delegation lets a service act on behalf of a user to reach other services, and its unconstrained, constrained and resource based variants each carry abuse potential. Misconfigured delegation can let an attacker impersonate privileged users and reach sensitive systems. These attacks are complex but powerful and appear regularly in mature environments, making delegation one of the more advanced and rewarding Active Directory topics.
ADSecurity
PsExec Style Execution
PsExec style execution runs commands on a remote Windows host by creating a service over the SMB protocol using valid credentials or a hash. It is reliable and widely supported, which is why both administrators and attackers use it. Because it creates recognisable service and log artifacts, defenders watch for it closely, so operators weigh its reliability against its noise before using it.
Impacket
WMI Execution
Windows Management Instrumentation can run commands on remote systems without dropping an obvious service, which makes it quieter than some alternatives. It is a native management feature, so its use can resemble legitimate administration. Attackers use WMI for remote execution, enumeration and even persistence. Understanding the telemetry it produces helps you use it in a way that avoids the specific events defenders alert on.
LOLBAS
WinRM
Windows Remote Management provides a built in remote shell over standard ports, commonly used by administrators and therefore useful for blending in. With valid credentials, tools give you an interactive PowerShell session on a remote host. Because it is a sanctioned admin channel, its traffic and logging patterns are known, so operators consider what evidence a WinRM session leaves before relying on it for movement.
RDP Abuse
The Remote Desktop Protocol gives a full graphical session to a Windows host and is heavily used by administrators, so a logon may not look unusual. Attackers use captured credentials to log in interactively, harvest more credentials, and hop onward. RDP produces clear logon events and session artifacts, so while it is convenient, it is not stealthy, and operators often prefer quieter execution methods when detection matters.
Pivoting and Port Forwarding
Pivoting uses a compromised host as a gateway to reach network segments you cannot access directly. Port forwarding and SOCKS proxies route your tools through that host into the internal network. Tools such as SSH forwarding and Chisel make this practical. Mastering pivoting turns a single foothold into access across an entire segmented environment, which is often required to reach the true objective.
HackTricks
Scheduled Tasks
Scheduled tasks run a program at a set time or on a trigger such as logon or system start, which makes them a simple and reliable persistence mechanism. Because administrators use them constantly, a well named task can hide in plain sight. Attackers create tasks to relaunch an implant on a schedule. Defenders monitor task creation, so naming and timing choices affect how long the task survives.
Atomic Red Team
Registry Run Keys
Certain registry keys tell Windows to run a program automatically when a user logs on. Adding an entry to a run key is a classic, easy persistence method that survives reboots. It is also well known to defenders and endpoint tools, so it is often caught quickly. It remains valuable to understand because it is common in real malware and is a good example of auto start abuse.
MITRE ATT&CK
Malicious Services
Windows services run in the background, often with high privilege and automatic start, which makes them attractive for persistence. An attacker can create a new service or modify an existing one to launch their payload at boot with strong privileges. The trade off is that service creation and changes are logged and watched, so this durable method must be weighed against its visibility to defenders.
WMI Event Subscriptions
WMI event subscriptions can trigger an action when a chosen system event occurs, such as a certain time or a user logon, providing a stealthy fileless persistence method. Because the logic lives in the WMI repository rather than an obvious file, it historically evaded many defences. Modern tools now inspect WMI subscriptions, but this technique remains a strong example of advanced, low footprint persistence.
MITRE ATT&CK
Startup Persistence
Placing a program or shortcut in a startup folder causes it to run when a user logs in, which is one of the simplest persistence techniques available. It requires only write access to the folder and no special privileges. Its simplicity is also its weakness, since it is one of the first places defenders and endpoint tools check, so it is best understood as a basic baseline method.
Antivirus Evasion
Traditional antivirus relies heavily on signatures and simple heuristics, so evasion focuses on making a payload look unfamiliar through custom code, encryption and avoiding known bad patterns. Understanding how signatures are generated helps you avoid them. Antivirus evasion is now considered a baseline, since defeating it alone is rarely enough against modern endpoint detection that watches behaviour rather than just files.
EDR Evasion
Endpoint detection and response watches process behaviour, API calls and relationships between events, so beating it requires more than a clean file. Techniques include avoiding suspicious call patterns, unhooking monitored functions, and choosing actions that do not stand out. EDR evasion is one of the most demanding red team skills and a fast moving arms race, since vendors continuously add new behavioural detections.
AMSI Bypass
The Antimalware Scan Interface lets Windows scan scripts and in memory content before execution, which catches many PowerShell and script based attacks. AMSI bypass techniques neutralise this scanning so that malicious scripts run without inspection. Because it is a common checkpoint for script based tradecraft, understanding how AMSI works and how it is bypassed is important for anyone using scripting on modern Windows.
Obfuscation
Obfuscation transforms code or commands so that their purpose is hidden from signature based detection while keeping the same behaviour. It ranges from simple encoding to complex restructuring of scripts and binaries. Obfuscation buys time against static detection but does not defeat behavioural monitoring, so it is one layer in a broader evasion strategy rather than a complete solution on its own.
PayloadsAllTheThings
Living off the Land
Living off the land means using tools already present and trusted on the system, such as built in Windows binaries and scripting engines, to carry out attacker goals. Because these tools are signed and expected, their use blends into normal activity and avoids dropping new files. The LOLBAS project catalogues which native binaries can be abused and how, making this a cornerstone of quiet, modern operations.
LOLBAS
Process Injection
Process injection runs attacker code inside the memory space of another, often trusted, process to hide execution and inherit that process context. Classic methods allocate memory in a target process, write code, and start a thread to run it, while newer variants aim to look less suspicious. It is a core evasion and post exploitation technique, and understanding it deeply is expected of advanced operators.
MITRE ATT&CK
DNS Exfiltration
DNS exfiltration encodes stolen data into DNS queries, taking advantage of the fact that DNS is almost always allowed out of a network and is often lightly inspected. Data is split into small pieces and sent as subdomain lookups to a server the attacker controls. It is slow but stealthy, which makes it a classic covert channel and a good test of whether an organisation monitors its DNS traffic.
HackTricks
HTTPS Exfiltration
HTTPS exfiltration sends data out over encrypted web traffic, often to a trusted looking cloud service, so it blends in with the large volume of normal web activity. Encryption hides the contents from inspection, and using well known services can defeat simple reputation filtering. It is faster than DNS and very common in real intrusions, which makes it a realistic technique for demonstrating data loss.
Staging and Compression
Before exfiltration, attackers gather target data into one place, then compress and often encrypt it to reduce size and hide its nature. This staging step makes transfer more efficient and less obvious. Defenders can detect large archives suddenly appearing or unusual compression activity, so understanding staging helps a red team both perform it quietly and advise on how it could be detected.
Red Team Reporting
The report is the real product of an engagement, because it is what lets the organisation improve. A strong red team report tells a clear attack narrative, shows the objectives reached, documents each step with evidence, and separates an executive summary for leadership from technical detail for defenders. Writing well and mapping actions to frameworks like ATT&CK makes findings actionable rather than just impressive.
MITRE ATT&CK
Remediation Guidance
Good remediation guidance turns each finding into a practical fix and a lasting improvement, prioritised by risk so the organisation knows what to do first. It addresses both the specific issue and the underlying pattern, and where possible suggests detections so the same attack would be caught next time. This forward looking advice is what distinguishes a valuable engagement from a simple list of problems.
Red Team Operator
A red team operator runs full, stealthy engagements that emulate real adversaries, focusing on evading detection and testing an organisation response capability. The role demands strong tradecraft across initial access, command and control, evasion and Active Directory, plus disciplined operational security. It is usually a senior position reached after building broad offensive experience, and it rewards patience and creativity as much as technical depth.
Penetration Tester
A penetration tester assesses networks, applications and infrastructure to find and prove as many vulnerabilities as possible within scope and time, then reports them clearly. The role values breadth, methodology and communication, and it is a common entry point into offensive security. Many operators start here to build the wide foundation of skills that more specialised roles later build upon.
Exploit Developer
An exploit developer researches software to find new vulnerabilities and writes reliable code to exploit them, often working with memory corruption, reverse engineering and low level systems. It is a deeply technical specialisation that requires strong programming and patience. This path suits people who enjoy understanding software at the lowest level and creating capabilities rather than only using existing tools.
Adversary Emulation Engineer
An adversary emulation engineer designs and runs tests that faithfully reproduce specific real world threat groups, bridging offensive skill with threat intelligence. The role focuses on mapping behaviour to frameworks like ATT&CK and working closely with defenders to improve detection. It suits people who enjoy both hacking and the analytical study of how real attackers operate.
Red Team Fundamentals
Red teaming is the practice of imitating a real world attacker to test how well an organisation can prevent, detect and respond to a determined intruder. Unlike a plain vulnerability scan, a red team engagement has a goal such as reaching a domain admin account, stealing a specific database or proving that a payment system can be reached, and the team uses whatever legal and in scope path gets them there.
Why learn this
Every technique later in this roadmap only has value inside a disciplined engagement. Understanding the purpose, scope and reporting flow first stops you from becoming a person who runs tools without knowing why.
Core concepts
Objective based testing rather than finding every bug Stealth and detection testing, not just exploitation Working within written rules of engagement Emulating a known threat actor where possible Common mistakes
Treating red teaming as a race to root every box Ignoring the blue team and detection side of the story Skipping scoping and legal paperwork Interview importance: High. Almost every red team interview starts by checking that you understand the difference between a red team and a normal penetration test.
MITRE ATT&CK
TryHackMe
Networking Fundamentals
You cannot attack what you do not understand, and almost everything an attacker touches travels across a network. Networking fundamentals cover how devices find each other, how data is split into packets, and how it is routed from source to destination. A strong grasp of the OSI and TCP IP models lets you reason about where a control lives, why a scan behaves a certain way, and how to move traffic through a compromised host.
Why learn this
Recon, scanning, pivoting and command and control all depend on networking. Weak fundamentals here become a ceiling on everything else you try to do.
Core concepts
OSI and TCP IP layers and what each does IP addressing, subnets and routing basics The difference between TCP and UDP How ports map to services Common mistakes
Confusing a closed port with a filtered port Not understanding NAT when a shell will not connect back Interview importance: High. Networking questions are a standard filter in offensive security interviews.
TryHackMe
Linux Fundamentals
Linux runs most servers, containers and security tooling, so comfort on the command line is non negotiable for a red teamer. You need to navigate the file system, manage processes, read and set permissions, and use core utilities to search, transfer and manipulate data. This fluency lets you work quickly on a compromised host and understand how privileges are enforced.
Why learn this
Many targets are Linux, your own attack machine is Linux, and privilege escalation on Linux depends entirely on understanding permissions, services and scheduled jobs.
Core concepts
File system layout and permission model Users, groups, sudo and the root account Processes, services and cron jobs Shell scripting for automation Common mistakes
Leaving loud artifacts such as shell history on a target Not knowing where credentials and config files usually live Interview importance: High. Practical Linux skill is assumed in every hands on assessment.
GTFOBins
Python for Offense
Python is the default language of offensive tooling because it is quick to write, has huge library support, and reads almost like English. Red teamers use it to write custom scanners, parse data, automate attacks and glue tools together. Many core security libraries, including Impacket for Windows protocols, are Python, so being able to read and adapt them is a direct force multiplier.
Why learn this
When an off the shelf tool does not fit, the ability to script your own solution in minutes is what separates an operator from a tool user.
Core concepts
Requests, sockets and file handling Parsing and automating tool output Reading and modifying existing exploits Working with libraries such as Impacket and Scapy Common mistakes
Copy pasting exploit code without understanding it Reinventing tools that already exist and are tested Interview importance: Medium to High. Many roles ask you to script a small task live.
Impacket
OSINT
Open source intelligence is the gathering of information about a target from publicly available sources, without touching the target directly. This includes company websites, employee social media, code repositories, breach data, certificate transparency logs and search engines. Good OSINT shapes the entire engagement because it reveals people to target with phishing, technologies in use, and the shape of the external attack surface.
Why learn this
The quality of your recon usually decides the success of everything that follows. A strong picture of the target lets you pick the highest value, lowest noise path in.
Core concepts
Company, people and technology footprinting Certificate transparency and DNS data Public code and document leaks Building a target profile and attack surface map Common mistakes
Jumping to scanning before understanding the target Ignoring the human layer that phishing depends on Interview importance: Medium to High. Recon methodology is a common discussion topic.
HackTricks
Network Scanning with Nmap
Nmap is the standard tool for discovering live hosts, open ports, running services and their versions. Scanning turns a range of addresses into a concrete map of what you can talk to, which drives every following decision. You learn different scan types, timing controls to balance speed against stealth, and the scripting engine that automates thousands of checks.
Why learn this
Enumeration is where most footholds are actually found. Attackers who enumerate patiently beat attackers who rush to exploit.
Core concepts
Host discovery and port states Service and version detection Timing templates and stealth options The Nmap Scripting Engine Common mistakes
Running one loud full scan and stopping there Trusting a banner without confirming the real service Interview importance: High. You will almost certainly be asked how you scan and enumerate a network.
Nmap Reference Guide
Phishing
Phishing is the most common way real attackers get their first foothold, because people are easier to fool than well patched systems. It means crafting a convincing message that tricks a target into clicking a link, opening an attachment or entering credentials on a fake page. A red team phishing campaign tests both the human layer and the technical controls such as mail filtering and endpoint protection.
Why learn this
Initial access is the hardest and most important stage. A realistic phishing capability is central to genuine adversary emulation.
Core concepts
Pretext design and target selection Credential harvesting versus payload delivery Infrastructure such as domains and mail servers Bypassing mail and browser protections Common mistakes
A pretext that does not match the target context Loud infrastructure that is instantly flagged Interview importance: High for red team roles, since initial access defines an engagement.
MITRE ATT&CK
Web Application Attacks
Web applications are exposed to the internet by design, which makes them a primary target for both real attackers and red teams. Web exploitation covers the classes of flaws that let you read data you should not, act as another user, or run commands on the server. The OWASP Top Ten is a good map of the most impactful categories, and PortSwigger Academy is the standard free training ground.
Why learn this
Many external footholds come through a vulnerable web app, and web skills transfer directly to API and cloud testing.
Core concepts
Input handling and injection flaws Authentication and session weaknesses Access control and business logic issues Server side request and file handling flaws Common mistakes
Relying only on scanners instead of manual testing Reporting a bug without proving real impact Interview importance: High. Web questions appear in almost every offensive interview.
PortSwigger Web Security Academy
OWASP
Exploitation Basics
Exploitation is the act of turning a vulnerability into concrete access or code execution. It ties together everything before it: recon and enumeration point you at a weakness, and exploitation proves it is real by achieving an effect such as a shell. You learn to find reliable public exploits, understand what they do, adapt them safely, and choose the least risky path to your objective.
Why learn this
Being able to weaponise a weakness, or safely reuse someone else work, is the moment an engagement moves from theory to impact.
Core concepts
Matching a target to a known exploit Reading and modifying exploit code Choosing reliable, low risk techniques Payloads, handlers and shells Common mistakes
Running exploits blindly and crashing production systems Not testing an exploit in a lab before using it live Interview importance: High. Interviewers want to see careful, understanding driven exploitation.
Metasploit Docs
C2 Frameworks
Command and control, often shortened to C2, is the infrastructure and software that lets you communicate with and control compromised machines. After initial access you need a reliable, stealthy channel to run commands, move files and manage multiple hosts. A C2 framework provides an implant that runs on the target and a server that operators use to task it, ideally while blending into normal network traffic.
Why learn this
C2 is the nerve centre of an engagement. Choosing and configuring it well is the difference between staying hidden and being caught in minutes.
Core concepts
Implants, beacons and tasking Communication channels and traffic shaping Redirectors and infrastructure hygiene Operational security for the operator Common mistakes
Using default profiles that are instantly detected Poor infrastructure that links back to the operator Interview importance: High for red team operator roles.
Sliver C2
Privilege Escalation
Privilege escalation is the process of turning a low privileged foothold into higher access, such as root on Linux or SYSTEM and then domain admin on Windows. Initial access rarely lands you where you need to be, so escalation is almost always required to reach an objective. It relies on careful enumeration of the host to find a misconfiguration or vulnerability that grants more power.
Why learn this
Most engagements hinge on escalation. The operators who win are those who enumerate patiently and recognise a weak configuration when they see it.
Core concepts
Host enumeration for weak settings Abusing services, scheduled jobs and permissions Kernel and software vulnerabilities Credential reuse and token abuse Common mistakes
Reaching for a kernel exploit before checking easy wins Missing writable services or stored credentials Interview importance: High. Practical escalation is a standard exam and interview task.
HackTricks
GTFOBins
Active Directory Exploitation
Active Directory exploitation is the heart of most internal red team engagements because almost every enterprise runs on it and a single weak point can lead to full domain control. Attacks abuse the way authentication, trust and permissions work rather than software bugs, which makes them reliable and hard to patch away. The goal is usually to escalate from a normal user to domain admin or to a specific high value resource.
Why learn this
Domain dominance is the classic red team objective. These techniques appear in nearly every real world enterprise breach.
Core concepts
Kerberos and NTLM authentication weaknesses Credential theft and ticket abuse Attack path mapping with BloodHound Delegation and access control abuse Common mistakes
Attacking blindly instead of mapping paths first Being loud and triggering ticket and logon alerts Interview importance: Very High. Active Directory attacks are a core red team competency.
BloodHound
ADSecurity
Lateral Movement
Lateral movement is how an attacker spreads from the first compromised host to others in order to reach the real objective. It usually reuses stolen credentials or tickets with built in remote execution features of the operating system, so the activity can blend in with normal administration. Good lateral movement is quiet, deliberate and mapped in advance so you touch only the hosts you need.
Why learn this
The first machine you land on is rarely the target. Reaching the goal almost always requires careful, low noise movement across the network.
Core concepts
Credential and ticket reuse Remote execution methods on Windows Pivoting and tunnelling through hosts Choosing quiet techniques over loud ones Common mistakes
Spraying credentials and triggering lockouts and alerts Using the noisiest execution method by default Interview importance: High. Expect scenario questions on moving through a network.
Impacket
Persistence
Persistence is how an attacker keeps access after a reboot, a password change or the loss of the initial foothold. In a red team it also tests whether defenders can find and remove a determined intruder. Techniques hook into the ways an operating system automatically starts programs, so your code runs again without another exploit. Good persistence is redundant, quiet and easy to clean up when the engagement ends.
Why learn this
Access you cannot keep is fragile. Persistence tests the response side of security and keeps a long engagement alive.
Core concepts
Auto start mechanisms on Windows and Linux Redundant and layered persistence Balancing durability against detectability Clean removal after the engagement Common mistakes
Only one obvious persistence method that is easily found Leaving persistence behind after the engagement Interview importance: Medium to High for operator roles.
MITRE ATT&CK
Defense Evasion
Defense evasion is the collection of techniques used to avoid or defeat security controls such as antivirus, endpoint detection and response, and logging. Modern enterprises have strong defences, so realistic engagements require an understanding of how those defences work and how to operate quietly beneath them. Evasion is less about a single trick and more about disciplined operational security throughout an engagement.
Why learn this
Capable defences are the norm now. Without evasion knowledge, your techniques will be detected and blocked before they achieve anything.
Core concepts
How endpoint detection observes behaviour In memory and fileless execution Living off the land with trusted tools Reducing loud artifacts and telemetry Common mistakes
Assuming a payload that beat antivirus will beat EDR Generating obvious telemetry through careless actions Interview importance: High for advanced red team roles.
LOLBAS
Data Exfiltration
Data exfiltration is the controlled removal of target data to prove impact and to test whether the organisation can detect data leaving its network. In a red team this is done carefully and only with authorised data, using channels that mimic how real attackers steal information. Demonstrating that you could take sensitive data, and whether anyone noticed, is often the most powerful part of a report.
Why learn this
Proving business impact requires showing what could be taken and whether data loss controls would have caught it.
Core concepts
Covert channels such as DNS and HTTPS Staging, compression and encryption of data Blending exfiltration into normal traffic Responsible handling of client data Common mistakes
Moving data in a way that ignores rules of engagement Loud transfers that a basic control would flag Interview importance: Medium. Often discussed as part of objectives and impact.
MITRE ATT&CK
Red Team Careers
The offensive security field offers several career directions, and this roadmap prepares you for all of them. Roles differ in focus, some on stealth and adversary emulation, others on breadth of vulnerability discovery, and others on deep technical exploit work. Building a portfolio through practice platforms, capture the flag events and recognised certifications helps you enter the field and grow.
Why learn this
Knowing the roles helps you aim your study, choose relevant certifications, and present your skills to employers effectively.
Core concepts
The main offensive role types and their focus Portfolios, labs and certifications Continuous learning in a fast moving field Ethics and professional responsibility Common mistakes
Chasing certifications without hands on skill Ignoring the reporting and communication side Interview importance: Useful context for shaping your own path.
Hack The Box
TryHackMe
