start	end	text
0	6460	Good to support the village. I'm really glad to see that DEF CON continued on this year.
6460	11480	I think it was a great idea. You know, there's a lot of people that don't always get to make it out to DEF CON.
11480	16320	And so, you know, people get a little taste of what it's like. They missed the human interaction part.
16320	19740	But I would bet it's going to be back even bigger and stronger next year.
19740	26200	But thanks to Omar and Joseph for continuing this on as well as DEF CON in general.
26780	30200	So I'm happy to present my new talk here today.
30440	33220	I have a talk that I do, the Pentester Blueprint.
33680	36340	And it's basically a talk on becoming a Pentester.
36680	40700	And so I came up with something more Red Team related.
41640	47040	Because there's a lot of confusion between what true Red Team is and Pentesting.
47080	53400	So who am I? I'm Phillip Wiley. I have my CISSP, OSCP, and the SANS GWAPT cert.
53400	57320	I'm a senior lead at a global consumer products company.
57580	62240	I'm also an adjunct professor at Dallas College, formerly Richland College.
62260	76400	I'm the founder of the Pwn School Project, which is a monthly, now virtual, meetup that teaches cybersecurity techniques as well as a big focus on stuff offensive security.
76400	78620	So a lot of our talks are geared towards that.
79180	82520	Even some good talks on SOX and other areas of security.
82520	87080	I've been in technology and InfoSec for over 22 years.
87840	90600	2004 is when I got my start into security.
90880	93360	The last eight years I've spent Pentesting.
93360	95780	First five years I was a consultant.
96060	100240	I was featured in the book, The Tribe of Hackers, Red Team book edition.
100320	104280	So those are some really great books by Marcus Carey and Jennifer Jin.
104640	107800	Really good for those getting started out, but I recommend it for anyone else.
107800	111080	It's advice from industry professionals on different topics.
111080	116640	There's The Red Team. There's The First Tribe of Hackers. It's across all spectrums of security.
117000	120480	And then there's the leadership book out.
120820	126420	I'm also the co-author of The Pentester Blueprint, Starting a Career in Ethical Hacking.
126500	131940	I took my talk, The Pentester Blueprint, and decided to make a book.
131940	136660	And I teamed up with Kim Crowley to help me make that a reality.
136660	140140	So that should be coming out late fall or so.
140140	145480	And I'm also a co-host of the Uncommon Journey podcast with Chloe Mostogian and Alyssa Miller.
147840	155200	So the agenda. During this talk, I'm going to describe my path into offensive security.
155200	158460	Because a lot of people that attend these talks are trying to get into it.
158460	164020	There's not a lot of... you have to look out there to find good information on how to get into certain areas of security.
164020	166820	And there's not a lot of stuff on offensive security.
166820	172280	So continuing on in the spirit of the Pentester Blueprint talk,
172280	179700	I've kind of extended that on to offensive security in general with this talk being more focused on red teaming.
179700	189300	We're going to discuss what offensive security is, the different domains, a red team intro, red team tools, a red team blueprint,
189300	195040	as well as some other educational resources and books out there and blogs.
195560	200960	So my offensive security path is kind of an unusual one. I started out as a pro wrestler.
200960	205280	I graduated high school and my friends asked me, what are you going to do for a career?
205280	212240	And I did not have a clue. I mean, really college wasn't in the plans for me and I didn't know what I was going to do.
212240	216260	I was a power lifter and my friends said, hey, you're a big guy. You should be a pro wrestler.
216260	219420	So I went to wrestling school and I wrestled for a few years.
219420	227540	And I got out in the late 80s due to needing a more stable career since I got married.
227540	232020	So I was married and needed a stable career for my wife and future family.
233560	242500	When I did that, you know, just having, you know, working through other areas of manual labor and retail sales,
242500	247000	I saw an ad on TV for a trade school that taught AutoCAD.
247000	251520	So I went to school to be a CAD draftsman and there's where things really started to take off.
252580	260140	I learned about sysadmin work because I was working in offices and we had a network administrator,
260180	265180	a system administrator come in one time to work on our systems and found out that, you know,
265180	268600	this guy was making more money than I was and what he did looked a lot more interesting.
268600	274820	I taught myself how to build computers, took a Nobel network class that used to be the popular network operating system
274820	279640	before Microsoft really took off with their directory services.
280140	284040	So from there I moved into InfoSec and then AppSec.
284040	289300	And AppSec is really where I kind of found out about pen testing and offensive security,
289300	292220	learning how to use web application vulnerability scanners,
292220	297180	going to some different vendor talks on their tools and stuff got me interested in pen testing.
297280	303600	So in 2012, I got laid off from my job of 14 years at a mortgage company
303600	307820	and then I went to work as a consultant working in pen testing.
307820	313380	I did that for five years and then got out of consulting and moved more into the corporate world.
313840	316880	And then back in November, I moved into red teaming.
318740	323160	So this is a slide I share every semester during all these conference talks
323160	328100	because, you know, only hack if you have permission, even better written permission.
328100	330120	Hacking without permission is illegal.
330120	334420	So as long as you have permission, you're good.
334420	343720	But, you know, you don't want to get in any trouble because if you get any kind of criminal record,
343720	348820	then it kind of makes it hard to work in any area of IT and especially something like offensive security.
349220	352980	So I like this quote. I first learned about it from Spider-Man.
352980	355700	With great power comes great responsibility.
356900	359040	So what is offensive security?
359040	365120	So offensive security is kind of a broad generalization of different types of ethical hacking.
365120	371880	So it's assessing security of a target using adversary tactics, techniques, and procedures or TTPs,
371880	374180	commonly known as ethical hacking.
375000	381960	So some of the different domains in offensive security, two main categories is pen testing and red teaming.
381960	386940	You can see different areas in pen testing that are covered.
387100	397100	Network, application, network including wireless, cloud, social engineering, physical security, hardware, and vehicle security can be tested through pen testing.
397380	399880	Red teaming is kind of more of a specialized area.
400240	403400	You're getting into more adversarial type simulations.
404020	406320	But there's been a lot of confusion.
406540	411080	So red teaming, red team engagement is not a pen test. It's not the same thing.
411080	414720	They've been used interchangeably, pen testing and red team for years.
414720	420380	It's a way to generalize, kind of the same way the blue team generalizes the defensive side.
420380	425440	Even on the defensive side, all blue team is not the same. There's a lot of differences.
425800	430360	But red team, a lot of people have confused and think that red teaming in general, that it's all the same, but it's not.
430360	432920	So there are some distinct differences.
433960	439260	Some of the commonalities, these similarities between the two areas.
439520	445080	They're both forms of pen testing or forms of defensive security.
445240	452920	Exploitation, social engineering, phishing, and physical security exploitation are used on both of these.
452920	454520	Sometimes not everything.
454520	462900	With your pen testing, a lot of times only social engineering, phishing, or physical security exploitation is not part of it.
462900	469380	Unless it's specifically built into the statement of work, the rules of engagement.
471740	474200	There are some differences there too.
474200	481020	With red teaming, you're emulating a threat actor, an APT, an advanced persistent threat.
481060	486420	With pen testing, you're using some of those techniques, but you're not emulating a threat actor.
486420	488400	You're just using some of those techniques.
488400	490740	In red teaming, you're trying to avoid detection.
490740	496080	With pen testing, it's a time box test. You're limited to the amount of time you have to test.
496160	500240	So you don't have time to go low and slow to try to avoid being detected.
500580	507920	And due to the time constraints, you're using vulnerability scanners and doing a lot of port and service scanning, which makes it more loud.
507920	510860	So you're not really avoiding detection.
510860	516220	Sometimes it can be part of a statement of work, but usually this gets more into your red teaming.
516440	518700	Red teaming is less restrictive.
518700	526220	There's more areas you can, in most cases, social engineering, phishing are part of it, part of the scope.
526620	528640	With the pen testing, it's more limited.
528640	536300	With PCI, when PCI came out, a lot of the pen tests and PCI has drove a lot of pen testing requirements.
536440	541240	To be PCI compliant, you know, it's a requirement to be pen tested.
541240	546880	So a lot of the focus has been on just what is needed to be compliant and not overall security.
546880	548020	So some things get missed.
548820	550960	And that's kind of carried on throughout the pen test.
551140	553980	There's a certain area that they want to be tested.
554480	556800	Sometimes it's not a lot of time to plan it out.
557960	560500	Budget constraints, they just want to get it done quickly.
560620	563660	And with pen testing, vulnerability is the focus.
564080	569740	Whereas with red teaming, you're trying to simulate an actual attacker or cyber criminal.
571000	572820	And there's a lot of tool commonalities.
572820	577200	If you look at the list of tools here, you see everything is pretty much the same.
577200	580540	There are some variants and some things that are not on this list.
580540	582600	But the common tools are listed here.
582700	585660	With pen testing, you're using vulnerability scanners.
585860	590420	Red teaming, you know, if you're using a vulnerability scanner, you're going to cause noise.
590420	591960	You know, you want to be quiet.
592620	594860	Metasploit can be used across both of those.
595300	600620	And also you see malware and exploits used across both.
600620	607540	But red teaming, it's more heavily depended on to get the footholds using malware, do phishing campaigns.
607540	614960	Command and control is done both, and useful in both, but a lot more heavily relied on for red teaming.
617850	623350	And so here's kind of a little red introduction on red teaming.
623350	629710	Red teaming is scenario-based assessment, emulating threat actors, and even simulating specific APTs.
629710	634930	You can go through like the MITRE ATT&CK framework and pick out specific APTs to mimic.
635050	638610	The goal of red team operation is to simulate real-world breaches.
638670	644590	Not only is this operator testing the security of technology, they're testing the people in the process.
645150	649890	A great quote from Dwyer Fald, the founder of Dallas Hackers Association,
649890	651530	is the red team tests the blue team.
651530	654070	And this is a good way to describe that.
654150	657110	When you're doing a pen test, you're really not testing the people.
657110	660910	You're testing the security controls and the technology.
661170	668510	With red teaming, you're testing the reactions of the defenders, as well as any of the systems being detected.
668830	674550	During a pen test, things can be detected, and usually, unless it's built in to block it, you're not going to get blocked.
674550	676470	They're going to let you complete the pen test.
679460	683420	And red team operations take a lot of time to plan and perform.
683420	689280	So you're trying to go and plan a specific scenario, a certain type of APT.
689280	691260	You're trying to imitate.
691260	693980	So you're taking the time to plan this out, to perform it.
693980	696100	And usually, you've got more time.
696400	702080	A pen test, not to say it's a thorough pen test, but a lot of times, a pen test may be a week.
702640	706800	Like a red team engagement could be four weeks or it could be months.
706800	711060	So it depends on the scenario you're trying to imitate.
711060	717700	And so red team operations rely heavily on OSINT to enumerate information on target technologies and employees.
717960	723840	This is leveraged through social engineering and phishing to gain initial foothold in the target environment.
724120	730160	You can also do like an assumed breach and use accounts.
730160	742560	But this is a good way to see how easy it is to get past people, the process and technology by using phishing campaigns,
742560	751100	sending malicious payloads to end users or compromising a site and putting payloads in there to gain access to the systems.
751220	755480	Detection avoidance is very important for red team to be successful.
755480	757680	Because part of this is they're trying to stop you.
757680	762200	They may see something going on and they're going to let you finish the pen test.
762200	769040	During a red team engagement, usually the people you're testing, they don't know about the pen test.
769040	773560	It's not announced. Usually management and a few key people know what's going on.
773560	786060	So in case the defenders detect this, they can report it and it can be treated internally to look like a normal breach to see how everyone reacts to it during the exercise.
786060	790280	So that's important to stay undetected.
792920	799360	Red team TTPs, red team operations a lot of malware payloads to gain initial footholds.
799560	805920	So being able to evade and obfuscate your code for your malware and exploits is very important.
806000	814560	A lot of times to get it to work in a pen testing role, you have to work on obfuscating your code because PowerShell is getting more detected.
814560	824100	Although some environments it's not. So as a practitioner, keep trying. People will say this is not environments anymore. It still will be.
824100	833040	I mean, I've performed pen tests as recent as the end of 2018 where Windows XP was in a company, a Fortune 100 company.
833040	839140	So that stuff's still out there and not everyone's blocking PowerShell, but it's becoming more often blocked.
839140	843840	So some of the skills that you'll need to work on is really working on the evasion and obfuscation.
843840	853860	Command and Control or C2 is a very important tool used to compromise systems, deliver payloads, elevate privileges, lateral movement, and use for persistence.
853900	860580	Cobalt Strike is a very popular command and control as well as there's some other ones out there, Silent Trinity, Covenant.
863180	872020	And actually Team Ares from Critical Start came out with Domidios, which is a new C2 that's built on Go.
872020	880060	So it looks really promising, a new one out there and recently was added to the C2 matrix.
882400	886780	And Red Team Ops Planning, so as we mentioned, there's more planning that goes into this.
886780	892920	It can be more detailed, so you can map the APTs from the MITRE ATT&CK framework and use tools like Vector.
893320	898660	Vector is a pretty cool tool I learned about from George Ochia's talks.
898660	901740	He does a lot of great talks on red teaming and purple teaming.
901760	905160	He currently works for Scythe, so he's a SANS instructor.
905160	911200	He teaches the SANS Red Team course, so keep an eye out for his videos.
911200	921160	This Vector tool is a framework that you can plan out your scenarios for your Red Team engagements.
921160	926120	So you can go through and map out the APTs that it's pulling from the MITRE ATT&CK framework.
926600	933960	And so Red Team Ops can also be less complicated and not map to specific APTs, just using common TTPs.
933960	941060	And as your program starts out, it may not take really advanced attacks to be able to compromise systems.
941500	944200	You know, it's kind of like offensive security in general.
944220	950200	You want to make sure that you've got your vulnerability scanning program, your vulnerability management solid in place.
950560	957260	You know, before you include it with pen testing, but you really want to get that in place and working on that.
957260	967280	As you get to more open scope pen tests and Red Team engagements where more things are in scope and can be exploited,
967280	973140	then, you know, as you become more mature, then you'll need to emulate more advanced attacks.
973140	983000	So starting out, you may not have to be as complicated, but as you're going along, you can become more complicated and detailed in your attacks.
983000	990400	And using the tools like the MITRE ATT&CK framework and Vector to map those out are great options.
993150	995630	There are some additional Red Team benefits here.
995630	999510	So a major benefit of Red Team is testing the people process and technology.
999710	1010070	So during the operation, if activities are not detected, then the Red Team can work with the security team to tune the security defenses to be able to detect malicious activity.
1010070	1021450	This can be extended to Purple Teaming engagements or activities where you just work with the Blue Team to tune their systems to detect different types of exploits.
1021450	1031070	So during your testing, if PowerShell is not being detected, if Mimikatz is not being detected, then you can, you know, kind of do a Purple Team activity,
1031070	1036730	just kind of working with your Blue Team as you launch specific attacks.
1036790	1045170	See if they detect it and help them to work on detecting those systems where you can build signatures to detect those vulnerabilities.
1049010	1058270	And so in the spirit of the Pentester Blueprint, I'm kind of going to go into some details on here on how to become a Red Team operator.
1058270	1069450	So, you know, basically Red Team operator is a Pentester. You're getting more specialized, going more into adversarial simulation.
1069450	1076490	But you have to start, you need a base, the base starting out. So your base, you need to understand technology.
1076490	1082810	So if you're jumping in this from nothing, then you're going to have to build these technologies.
1082810	1090810	You have to understand networking and operating systems and Active Directory that you're performing Pentest against some of these networks and Red Team engagements.
1090850	1101050	Because Active Directory is Microsoft's directory services where all the users and different computer objects and security settings are set in Active Directory.
1101050	1105470	You get access to that, you can breach a lot of things, compromise on a large scale.
1105470	1110830	I mean, the way to look at it is kind of like a single sign-on type of solution using LDAP.
1110830	1117230	So you're able to, if you're able to compromise Active Directory, then you can get access to anything in the environment.
1117690	1127710	So understand, you have to understand this technology. So understanding networking, understanding operations, operating systems from a, you know, a system administrator perspective.
1127710	1136430	You need to be able to start and stop services, you know, disable firewalls, enable services, and that sort of thing during a Pentest.
1136430	1144610	So if you gain a shelter system or command line access, then the more you understand the command line, the more things you can do, the more effective you can be.
1144610	1146430	And you've got to understand networking.
1147310	1156010	And Pentesting hacking, so you have to understand the different tools and techniques that penetration testers and hackers use.
1156170	1160990	So you have to have those because, you know, hacking is part of being a Red Teamer.
1160990	1168890	That's part of the job. It's kind of an extension or more advanced form of Pentesting.
1168930	1171830	And so programming and scripting can be very important.
1172070	1178730	Some of the best hackers I know can program. They can write their own code or they can write their own scripts.
1179450	1183690	So popular ones out there are Python and PowerShell.
1183690	1198470	From a Red Teamer or Pentester perspective, you know, knowing how to use PowerShell using some of the tools like PowerShell, Empire, and some of the different exploitation tools out there in command and control is very important.
1198470	1202670	So you don't necessarily have to know how to write PowerShell, although it's good.
1203050	1208370	Tools like Python and Golang can be used across multiple platforms.
1208450	1210690	Python has been very popular for years.
1210690	1214570	It allows you to write tools pretty quickly, modify tools.
1214690	1225950	And from programming scripting perspective, at first you need to really be able to, you know, modify exploit code, be able to look at Python code and be able to alter that to fit.
1225950	1231190	Maybe you find some exploit code and there's something different about that system that you need to modify.
1231190	1236290	So just understanding how to modify exploits is important. It's a good starting step.
1236290	1241430	But be able to write Python scripts. Golang is a very new popular one.
1241910	1245890	I guess it's been out five or six years or so, maybe longer, eight years.
1245890	1248830	But it's a really good one because it's also a compiled language.
1248830	1251810	It can run across multiple platforms.
1251810	1260090	The thing I really like about it too is you can compile code on a Linux or Mac system to run on Windows.
1260090	1262130	So this is kind of nice.
1262130	1271390	Some of your exploits, if you're doing a pen test, then you need a similar system with Linux to be able to compile your exploit code.
1271490	1274210	A similar system or compile it on that system.
1274210	1278590	With this, you can easily compile it on your own system.
1278730	1284490	And this C Sharp is a very popular one for pen testing.
1284610	1289530	Some of the PowerShell started getting detected and people moved on to C Sharp.
1289530	1292750	There's a lot of good tools out there with C Sharp.
1292750	1297290	A lot of the tools are kind of going away from PowerShell more towards C Sharp.
1297290	1301230	So understand these tools. You'll write your own tools and it'll make you a lot better hacker.
1302870	1310290	So yeah, just be able to do that makes, like I said, some of the best hackers I know and red teamers know how to write their own code.
1310290	1312630	I mean, you stop and look at some of the tools out there.
1312750	1318710	Harmjoy, for instance, from Spectrops, he's a prime example of someone that writes tools and he's a red teamer.
1318710	1324930	So I mean, this goes to show you, you look at a lot of these high level pen testers and red teamers.
1324930	1327010	They're writing exploits and they're writing tools.
1327010	1331670	So if you really want to do well, then that's an area to focus on.
1335210	1337670	So red team focus skills.
1337670	1341730	So malware and exploit development, where these are also important in pen testing.
1341850	1347010	Really working on obfuscating and be able to evade systems.
1347010	1351810	With your PowerShell code or C sharp or any language you're writing and be able to obfuscate.
1351810	1357370	Sometimes there's written tools out there and you can use different tools to obfuscate.
1357550	1361450	Or going to manually modify yourself to try to take some of the headers out and signatures.
1361450	1363490	So it's not as easily detectable.
1363490	1369970	Sometimes it could just be the name of the developer of the tool that the system's picking up or the name of the tool in the system.
1369970	1373590	So just be able to modify your code where it's not being detected.
1374390	1376210	Active directory exploitation.
1376210	1384810	Understanding active directory is not enough, but understanding active directory and knowing how to exploit it is very important in red teaming.
1384810	1388350	And command and control. So command and control is a very important tool.
1388910	1392990	It allows you to send payloads to your systems.
1392990	1396050	Once you get a system compromised, you get access to it.
1396050	1402230	Then you can do lateral movements, going to other computers, other accounts, try to escalate privileges.
1402230	1408250	And help you maintain persistence, maintain control over the systems that you exploit.
1408410	1413370	In phishing and social engineering, these are two very helpful tools.
1413370	1420150	Because in a lot of cases, maybe their systems are pretty secure as far as trying to crack passwords.
1420150	1427170	Or if you're doing a Zoom breach and you're on that network and maybe you're not able to crack hashes.
1427170	1434970	So if you can send malware through email, through phishing campaigns, then that's a way to get initial foothold.
1435150	1438850	Social engineering to get people to execute that code.
1439050	1442410	Physical security exploits. Gaining access to the buildings.
1442610	1448330	Getting past security into the server rooms or different areas to be able to pull off your exploits.
1453260	1458040	And here's kind of a learning path to follow for gaining these skills.
1458040	1462520	Kind of a good baseline or a good place to start.
1462520	1466040	And this is assuming that you've got an IT background.
1466660	1468900	You've got to learn the hacking skills.
1469780	1478300	Certification courses like the OSCP, Hack the Box are really good to build those skills.
1478300	1480260	Learning social engineering.
1480260	1486860	But the OSCP is a really good one because you've got to get those hacking skills before you really get into the red teaming.
1487140	1489580	So you need to be a good hacker.
1489580	1497400	So there's other courses out there like eLearn Security where a lot of those other courses really focus on pen testing.
1497400	1499420	Which pen testing and hacking is similar.
1499440	1503940	With the OSCP there is a big focus on hacking skills.
1503940	1513620	And with some of the newer content of the OSCP, they've kind of went more in the direction of adding more pen testing content.
1513620	1519860	Whereas before it was mainly just a really great hacking course.
1519860	1524180	And kind of teaching kind of the way pen testing used to be.
1524200	1532680	But a good path is once you get the skill set of someone with OSCP, then you can start working on the red teaming skills.
1532680	1534300	And this is something you can work on hand in hand.
1534300	1537600	Because your red teaming skills, you're going to be working on Active Directory.
1537740	1541700	So there's some courses out there that are really good for red teaming.
1541860	1545920	And Pentester Academy's Red Team Labs is a good resource.
1545920	1548180	They have Active Directory in their labs.
1548180	1549980	So they've got different levels.
1550100	1554100	But they even have like a red team certification.
1554100	1564040	They have labs where you're using Linux to exploit Windows systems as well as Windows systems to perform the same similar labs.
1564040	1569140	Learning how to use PowerShell exploits during that to compromise systems.
1569140	1578940	And then eLearn Security, their Pen Testing Extreme course is labeled Pen Testing Extreme, but it's a red team course.
1578940	1581040	It teaches red teaming techniques.
1581040	1589840	They teach you exploit development, code obfuscation, and some other techniques that are important for red teaming.
1589940	1595420	Hack the Box Pro, Rasta Labs, this is a really great, good one to learn.
1595420	1602200	And it's kind of inspired Rasta Mouse to start the Zero Point Security Red Team Ops course.
1602200	1603520	I'm actually going through that.
1603520	1608400	And if they actually have a certification with that, I'm currently going through that at the moment.
1608420	1609900	And it's a really good course.
1609900	1613740	I mean, it's even set up to where you can send phishing emails in that environment.
1615040	1620000	And so some different tools and resources for red teaming.
1620000	1628680	So your APT planning, as mentioned, the MITRE ATT&CK Framework, Vector, there's the URLs for those resources.
1628880	1630200	Those are really good to know.
1630200	1635140	Just getting out there and learning how a threat actor's mind works.
1635140	1639700	Getting that threat actor mindset through tools like the MITRE ATT&CK Framework.
1639700	1641680	Learning how those TTPs work.
1641880	1643720	You get to see some of the common attacks.
1643720	1645340	And this is a great resource for defenders.
1645340	1647740	It's being widely used by defenders.
1648060	1650340	Command and Control, the C2 Matrix.
1651960	1655280	You can find that at the C2Matrix.com.
1655560	1657420	Cobalt Strike is one of the more popular ones.
1657420	1659060	One of the first command and control.
1659060	1662600	Although Metasploit is also considered command and control.
1663020	1666560	It's also pretty heavy on the exploit framework.
1667020	1671400	But Cobalt Strike, Silent Trinity, PowerShell Empire.
1671840	1676200	BC Security took over support of that and upgraded it to Python 3.
1676520	1679980	And you can use Starkiller, which is a web front end to it.
1679980	1684640	It makes it more similar to some of the other C2s that have a web front end.
1685200	1687240	Or you can use these tools as a team.
1687240	1688720	You can collaborate together.
1688720	1691360	So you can collaborate on the same project.
1691360	1694240	So these really work good for collaboration.
1694580	1701060	And a shout out to Critical Start Team Ares with their Demios C2 that recently came out.
1701060	1702660	It's written in Golang.
1703680	1709380	They're adding new items to it, new features as it goes along.
1709380	1710720	So it just recently came out.
1710720	1711960	They're pretty excited about it.
1711960	1713940	It looks like a really good tool.
1714300	1716340	So you should check that out.
1716340	1718240	It's a free tool. It's open source.
1718240	1720060	It's like a lot of the other C2s.
1720600	1722120	And operating systems.
1722120	1724880	Slingshot OS or Slingshot Linux.
1724880	1726940	You can find that on SANS.
1727440	1734220	It's a good operating system for pentesting as well as red teaming.
1734220	1736840	It has a lot of the C2s already installed.
1737140	1741980	So actually Vector, I believe Vector is installed as well.
1742220	1747420	Kali Linux and Parrot OS are good hacking options and Commando VM for Windows.
1747420	1750280	So in red teaming, you're dealing a lot with Active Directory.
1750280	1753560	So it's good to have a Windows box to test with.
1754100	1756140	And resources and courses.
1756300	1760740	So Hack the Box Pro as mentioned by Roster Labs.
1760740	1762780	One of Roster Mouse's projects.
1762860	1765040	Pentester Academy, Red Team Labs.
1766020	1769380	And institute.sector7.net.
1769380	1770240	This is a good course.
1770240	1772980	They have relatively inexpensive.
1774580	1779900	And I'm kind of listing some of these out based on the expense of the course.
1779900	1783860	They have a course on malware writing for red teaming.
1783860	1787580	They have a Privilege Escalation as well as another course.
1787580	1788520	I can't think of it at the moment.
1788520	1791100	But these three different courses build red team skills.
1791100	1795520	And sometimes some courses may deal more on the red team side and less on the malware.
1795800	1798640	With this course, they have good coverage of malware.
1798800	1801800	So that's a good skill to develop.
1801800	1803440	And they cover that in that course.
1803500	1807880	And Zero Point Security of the Red Team Ops course by Roster Mouse.
1807880	1810000	Which they actually have a certification for.
1810020	1812140	This is a pretty cool environment.
1812360	1814420	You have VPN access to it.
1814460	1816420	They have Windows boxes in there.
1816700	1822840	You're separated through a firewall so you're connecting in.
1823720	1826900	So you have to send a phishing email to get on that system.
1826900	1828200	So it's really cool.
1828320	1831480	If you have the OSCP, you can just take the exam.
1831480	1836820	But I didn't really want to miss out on the educational opportunity of going through the course fully.
1836960	1838740	So that's currently what I'm working on.
1838740	1841000	It's been a lot of fun so far.
1841100	1842380	eLearn Security, as we mentioned.
1842380	1844740	The Pentesting Extreme course.
1845040	1846580	That one's a red team course.
1846580	1847620	And they cover malware.
1847620	1850240	So it's a really good, well-rounded course.
1850240	1851880	Covers a lot of good materials.
1852000	1854180	I haven't personally taken this course myself.
1854180	1857740	But I've taken the eLearn Security Web App Pentesting course.
1857740	1859280	And the Mobile Pentesting course.
1859280	1860780	And the good quality courses.
1860780	1864540	And they don't expect you to be an expert to be able to take these courses and learn from it.
1864540	1870720	They start in enough detail that someone with technical experience can pick these up.
1870800	1874480	And then the Spectre Ops, Adversary Tactics and Red Team Operations.
1874720	1881120	I fortunately got to take a couple courses before COVID really started ramping up.
1881200	1883780	And it caused us all to have to social isolate.
1883780	1885680	But I got to attend this talk.
1886140	1887840	Harmjoy was one of the presenters there.
1887840	1890900	As well as some of the other gurus from Spectre Ops.
1890900	1896720	But this course, if you've got Cobalt Strike, this is a really good way to learn Cobalt Strike.
1897140	1899240	And use it as a Red Team Operator.
1899760	1902720	Forty North has a couple good classes.
1903100	1906860	Their initial access operations and intrusion operations.
1906860	1910060	So they cover some malware in their course.
1910060	1912420	As well as silent break security.
1912420	1917860	They have a malware development course and the adversary simulation.
1918300	1920100	So these are really great courses.
1920400	1924840	And SANS Red Team Exercise and Adversary Emulation.
1924840	1926900	This is a two-day course.
1927080	1929240	And George Rochias teaches this.
1929240	1931560	And it looks like a really good course.
1931560	1938400	They get into the Red Team from building a team type perspective.
1938400	1941380	As well as doing the technology piece.
1941380	1944580	And then Cobalt Strike offers some free videos on their site.
1944580	1948880	If you go to the training and support tab on the Cobalt Strike website.
1949180	1951220	There's links to their YouTube page as well.
1951220	1955880	So they've got all sorts of tools in Cobalt Strike that they teach you how to use.
1955940	1959660	A lot of the tools are pretty easy to pick up on.
1959660	1964340	But if you haven't had experience with C2s, then I highly recommend these videos.
1964340	1967440	Because there's things that are done a little bit different with a C2.
1967440	1972920	But they do a good job of covering the different tools that you can use within Cobalt Strike.
1972920	1976780	And Cobalt Strike uses PowerShell and C Sharp tools pretty heavily.
1976780	1982560	As well as other scripting languages and executable files.
1982600	1984440	So that's a good resource out there.
1984440	1990940	You get a good idea of how Red Teaming works from the Cobalt Strike video series as well.
1993680	1995500	And resources and blogs.
1995500	2000820	So here's a list of some blogs and resources that I've come across.
2000820	2004520	I started dedicated Red Teaming back in November.
2004520	2010480	So I've been doing a lot of research and studying to learn the Red Team side of things.
2010700	2013980	So here's some good... the Red Team Journal is kind of an older blog.
2015300	2017800	I don't think it's been updated lately.
2017800	2019760	But there's a lot of good information on there.
2019900	2024120	The Red Team Guide is based on the Red Team Guide book.
2024120	2027300	But there's a lot of good documents on there on starting pen tests.
2027300	2029180	And some of the different techniques.
2029240	2031620	I mean Red Teaming techniques.
2032000	2037820	And Thread Express is kind of a site related to the Red Team Guide.
2037820	2041400	Same people. It was kind of their blog before they came out with the Red Team Guide.
2041400	2042720	Good information there.
2043780	2047000	Mike Bleeder's website along with his awesome tools.
2048120	2050940	There's a lot of great information on his blog.
2050960	2052200	Harmjoy's blog is great.
2052200	2053720	B.C. Security.
2054200	2055840	Spectra Ops.
2055840	2056860	Rastamouse.
2056860	2060220	Howsec is actually part of Spectra Ops.
2060220	2061780	Silent Security's blog.
2061780	2063440	Forty Moore's blog.
2063560	2067820	And IRED.Team and Vincent Yu's blogs.
2067820	2071680	These are some really good places to learn.
2071680	2082140	And I've been using a lot of these resources as I'm going through the Rastamouse's Zero Security Red Team Ops course.
2083300	2084800	There's some other books out there.
2084800	2088900	So this is one of the books out here that recently came out.
2088900	2090140	The Hacker's Playbook.
2090140	2095340	If you've seen version 1 and 2, it's more pen testing related.
2095340	2098760	But version 3 gets into Red Teaming.
2098760	2101520	I highly recommend if you don't have version 2, get version 2.
2101520	2106360	It's got a lot of good real world pen testing attack scenarios.
2106580	2109560	So also the Red Team Development and Operations.
2109560	2113300	This kind of shows you how to build a Red Team.
2113320	2115560	And one of the authors is Joe Vest.
2115560	2117940	He formerly worked with Spectra Ops.
2117940	2124360	I got to meet him back during my Red Team training through Spectra Ops earlier this year.
2124480	2125720	So it's a really good book.
2125720	2132620	And they go through and show you some different checklists and stuff on how to perform Red Team operations.
2132720	2136940	So it's a really good book even for management or people who manage Red Teams.
2136940	2141140	I recommend this book because it kind of shows you how Red Team operations work.
2141500	2145180	And then Hands-On Red Team Tactics, A Practical Guide to Mastering Red Team.
2145200	2150660	This book actually covers some Cobalt Strike information.
2150780	2157360	And this was recently recommended yesterday or actually Friday during one of the talks in Red Team Village.
2157360	2161620	So it's a little more indicator that it's a good resource.
2161760	2166380	But these are some good books out there as well as just pen testing books in general.
2166380	2170720	Learning pen testing and certifications.
2170720	2172920	There's not like a lot of certifications out there yet.
2173000	2174840	And there may be more than this.
2174840	2182160	I saw another Red Team cert that is more physically and more lock picking and more physical security related.
2182160	2189520	But what you're going to need from, in most cases, what you would gain from Zero Point Securities cert,
2189520	2197920	the skills that you would need for performing Red Teaming operations.
2197920	2204720	While some of the physical stuff is important, you can take lock picking courses and learn physical security to kind of really get started.
2204720	2207000	Especially if you have a pen testing background.
2207000	2212760	And these three cert courses or the certs would be good to have.
2212860	2219140	And some of these pen test focused certs from Offensive Security, SANS, and E-Learning Security.
2219140	2224660	Offensive Security and the SANS certs are really good for getting your foot in the door as a pen tester.
2224820	2226560	And good for getting pen testing jobs.
2226560	2228960	The E-Learning Security is starting to gain more notoriety.
2228960	2233760	They're really good courses and really well written and really well priced.
2233760	2237400	If you don't have the money to, you know, your company won't put you through SANS training.
2237400	2242580	Then Offensive Security and E-Learning Security, those certification courses are really good ones.
2242600	2245140	As well as the Pen Tester Academy courses.
2246860	2248980	And here's my contact information.
2249640	2254960	I kind of got into teaching and presenting at conferences as a way to share.
2254960	2258320	I used to mentor and still do mentor a lot of people.
2258660	2261640	A lot of times just answering questions and sharing resources.
2261880	2264740	So this stuff is my hobby. I live and breathe this stuff.
2264880	2270900	So I'm always up to talk about this stuff, give career advice, and help out if you're having questions.
2271020	2275700	There's my contact information. Feel free to contact me.
2277840	2281500	And so that concludes my presentation.
2282000	2284420	Awesome. Thank you so much, Phillip.
2284420	2286500	As always, you have been amazing.
2286500	2290700	And thank you so much for supporting the community and the Red Team Village as well.
2290820	2296300	And for those of you that are online, please join the conversation in Discord.
2296700	2299240	We have the link in the bottom of the screen.
2299240	2304780	So in the description, whether you're in YouTube, in Periscope, or in Twitch.
2304780	2305880	Please join us.