Evasive Ginger - RedHeadSec

RedHeadSec

Sign in

Evasive Ginger

A Trap in the Shadows: Red Team Thoughts on Modern Deception Technologies

A Trap in the Shadows: Red Team Thoughts on Modern Deception Technologies

Recently I had an engagement baselining a security stack within an organization, one of which was a product I was unfamiliar with, called Shadow. This is Proofpoint's agentless detection platform that came out of their acquisition of Illusive Networks. Coming from my early career days in the SOC

Bringing Ludus to the stars! - Accessing your home lab from anywhere using Nebula!

Bringing Ludus to the stars! - Accessing your home lab from anywhere using Nebula!

Anyone working in IT, particularly in the consulting space loves home labs. Some people dedicate entire closets in their house, even rooms to running server racks, random IoT gadgets, and desktop computers from across the ages. I myself stay pretty minimal with a simple K8 Nucbox running Ludus for all

IronSuite - IronEye v2.0 + IronFist Loader Showcase

IronSuite - IronEye v2.0 + IronFist Loader Showcase

It's been a while since any big updates but I have not been idle. I'll be showcasing two major tool updates for this article. One is IronEye v2.0 with a lot of major improvements from the previous versions. The other is my current private loader

Phantom Persistence - A quick look at Windows Persistence via RegisterApplicationRestart

Phantom Persistence - A quick look at Windows Persistence via RegisterApplicationRestart

A quick look at Windows Persistence via RegisterApplicationRestart

AdaptixC2 - Possibly My New Favorite Open-Source C2 Platform

AdaptixC2 - Possibly My New Favorite Open-Source C2 Platform

As an offensive security consultant, I've had my fair share of experience with command and control frameworks. Everything from commercial products such as Cobalt Strike to open-source frameworks such as Sliver and Mythic. There are tons of options in the space, each with their own little pros and

IronEye - Welcome to your Rusty LDAP Swiss Army Knife

IronEye - Welcome to your Rusty LDAP Swiss Army Knife

Description: A mullti-purpose LDAP tool written in Rust. Created By: Evasive_Ginger

SCCM - Microsoft's Native C2

SCCM - Microsoft's Native C2

A lot of hype has come out around System Center Configuration Manager (SCCM), Microsoft's software management suite that allows administrators to manage and deploy software applications, operating systems, and updates across a network of computers. SCCM provides a centralized solution for managing large-scale deployments and automating various tasks

Hack The Box - Support

Hack The Box - Support

Hack The Box walkthrough of the machine Support

Compatibility to Compromise

Compatibility to Compromise

How legacy compatibility options and misconfigured ADCS can lead to a real bad day.

Sliver Quickbook

Paid-members only

Sliver Quickbook

Red Team Operator 2 Review

Red Team Operator 2 Review

Red Team Operator 2 is the continuation of the educational content and certifications from RastaMouse at Zero Point Security. This builds upon RTO 1 foundations and ramps up the difficulty by throwing AV and EDR into the mix. The goal is to educate users on common and modern tactics to

New Role, New AD Takeover

New Role, New AD Takeover

Hello World! It's been a while, but not without justification. I've been adjusting to a new job position, Offensive Security consulting. It's been quite a difference compared to my previous positions, but boy has it been fun. I've had some big smiles

Napping - TryHackMe Walkthrough

Napping - TryHackMe Walkthrough

This is a quick walkthrough of Napping on TryHackMe. https://tryhackme.com/room/nappingis1337 The room does not give any hints/walkthroughs on the page, but simply asks for two flags. Lets get down to it and see what we find! After getting my vpn set up, I have a

Building a simple custom implant for AV bypassing

Building a simple custom implant for AV bypassing

Building a C++ implant for Sliver Shellcode

New Year, New Case Management

New Year, New Case Management

I thought it would be appropriate for the first post of the new year to discuss some of the things that have been on the table regarding case management. Our team has been demoing and testing various solutions from open source to commercial products. One of the new kids of

Year End Review - 2021

Year End Review - 2021

This year has been a hurricane of debris hitting anyone in the Cybersecurity space. Its been extremely active for a large majority of the year from the coattails of the Solarwinds and Fireeye breach at the end of 2020, pushing into a global Exchange attack at the start of 2021

CRTO Certification Review

CRTO Certification Review

Certified Red Team Operator ❗Updated 12/06/21 -------------------------------------------------------------------------------- Recently I had the opportunity to enroll into the CRTO course by RastaMouse at ZeroPointSecurity. This course focuses on red team engagements in multiple forest active directory environments with the goal of teaching the basic principles of operating under specific TTPs

Breaking into InfoSec - My Story

Breaking into InfoSec - My Story

Our industry is quite an interesting beast when it comes to breaking into the field. On one side we have gate keeping by various seasoned workers in fear of losing their jobs to competition, breaking traditional ways of doing things, or diluting the pay pool that our industry is very

Initial Recon - OSINT Tools

Paid-members only

Initial Recon - OSINT Tools

Sliver C2 - All hackers gain deathtouch in 2021

Sliver C2 - All hackers gain deathtouch in 2021

What is Sliver? Lets get down to business and discuss a C2 Project I have grown fond over over the summer of 2021 which is Sliver, the work of the brilliant minds over at Bishop Fox. What is Sliver? Well lets consult the GitHub readme: > "Sliver is an

Freddie's Compliance Checker

Freddie's Compliance Checker

Hard / Malware on Round 3 -------------------------------------------------------------------------------- Creator: Me :) After getting into the repo from The Repo challenge using the key rewarded from Freddie's Fav, you find yourself with access to a bash script that is obfuscated. The goal is to deobfuscate the script to see what it is

Freddie's Fav & The Repo

Freddie's Fav & The Repo

[https://redheadsec.tech/content/images/2021/10/FreddiesFav.png] [https://redheadsec.tech/content/images/2021/10/repo.png] Freddie's Fav and The Repo are the precursors to the Compliance Check challenge in R3 - Freddie. Freddie's Fav is a web challenge focused on SSTI (Server Side

Let The Nightmare Begin

Let The Nightmare Begin

-------------------------------------------------------------------------------- The Connectwise CRU has been hosting a 16 day long CTF for Cybersecurity Awareness month. The competition started on October 13th and will be completed officially on the 29th. That hasn't stopped some top talent teams from completing all five rounds of challenges to secure victory and

Welcome! Here is to humble beginnings...

Welcome! Here is to humble beginnings...

That's right, this is the first post on the site. I am new to this so bear with me here. My goal is to continue to build on this project of mine and hopefully get some useful experience in terms of my technical writing and just general infrastructure.