Phase one · 30 field guides
Red Team
Field Guide.
A growing, defensive-minded knowledge base for authorized assessments—now covering methodology, network services, web security, APIs, source intelligence, and exposure response.
30 / 30 guides
Featured guides
Methodology,
made operational.
6 starting points
Pentesting Methodology
A controlled end-to-end workflow for scoping, discovery, validation, evidence, reporting, and retesting.
Fuzzing Methodology
Calibrate inputs, filters, state, and rate limits to discover meaningful behavior without overwhelming the target.
External Recon Methodology
Build a validated, ownership-aware inventory from passive signals before any controlled active checks.
Database Leak Exposure
Assess breach exposure through official, ownership-verified services without collecting or using leaked credentials.
Wide Source-Code Search
Map public code, configuration, packages, history, and documentation tied to an authorized organization.
GitHub Leaked Secrets
Find and triage potential secrets in an authorized GitHub scope without attempting to use them.
Knowledge library
Network, web
& API security.
24 operational guides
Network Service Discovery
Identify approved hosts and services at a controlled rate, then turn scanner output into an ownership-aware service inventory.
DNS Security Assessment
Review authoritative records, delegation, transfer controls, DNSSEC, email policy, and operational monitoring.
TLS & PKI Assessment
Assess certificate identity, protocol policy, trust chains, client authentication, and certificate lifecycle controls.
SSH Security Assessment
Review SSH reachability, host identity, authentication policy, forwarding, privilege boundaries, and audit coverage.
FTP & File Transfer Assessment
Review legacy FTP exposure, encrypted transfer alternatives, anonymous access, file permissions, and transfer monitoring.
SMTP & Email Security Assessment
Review mail routing, relay policy, transport security, sender authentication, enumeration resistance, and monitoring.
SNMP Security Assessment
Assess SNMP reachability, version policy, read/write separation, exposed metadata, traps, and management-plane controls.
SMB Security Assessment
Review SMB exposure, dialects, signing, guest access, share permissions, administrative paths, and audit telemetry.
LDAP Security Assessment
Assess directory reachability, transport protection, bind policy, anonymous access, ACLs, schema exposure, and logging.
Kerberos Security Assessment
Review Kerberos trust, encryption policy, service identities, delegation, ticket lifetime, time synchronization, and logging.
Database Service Assessment
Review database exposure, transport security, authentication, role design, dangerous features, backups, and query auditing.
VPN & Remote Access Assessment
Assess remote-access exposure, identity controls, device posture, split tunneling, segmentation, lifecycle, and monitoring.
Authentication Security Testing
Assess sign-in, enrollment, MFA, recovery, lockout, federation, and account-state transitions with designated identities.
Session Management Testing
Review session creation, cookie policy, renewal, revocation, concurrent use, timeout, and cross-channel consistency.
Access Control Testing
Build a role-versus-action matrix and validate object, function, tenant, workflow, and field-level authorization.
Input Validation & Injection Testing
Map parser boundaries and validate parameterization, encoding, type enforcement, and error handling with harmless markers.
SSRF Assessment
Assess server-side URL fetching, redirect handling, parser normalization, egress policy, and cloud metadata protections safely.
File Upload Security
Review upload authorization, type validation, storage isolation, processing, malware controls, delivery, and deletion.
Security Misconfiguration Review
Review headers, diagnostics, defaults, exposed management surfaces, dependency configuration, and environment drift.
Business Logic Testing
Model workflow invariants, state transitions, limits, race boundaries, and abuse controls with synthetic accounts and records.
REST API Security Testing
Assess API inventory, schema enforcement, authentication, authorization, rate limits, lifecycle, and observability.
GraphQL Security Testing
Review schema exposure, resolver authorization, query cost, batching, errors, subscriptions, and persisted operations.
WebSocket Security Testing
Assess upgrade authentication, origin policy, message authorization, schema validation, lifecycle, limits, and telemetry.
OAuth 2.0 & OIDC Testing
Review authorization flows, redirect URIs, PKCE, state and nonce, scopes, token audiences, clients, logout, and federation trust.
Quick playbooks
Focused checks
for the field.
9 compact references
MethodologyRules of EngagementTranslate authorization into exact technical boundaries.
Open playbook
Operator checks
- Targets and exclusions
- Window, rate and source IPs
- Stop contact and evidence rules
Defensive view
- Preserve an escalation channel
- Stop on ownership uncertainty
WebHTTP Security BaselineCapture redirects, headers, cookies, methods, and trust boundaries.
Open playbook
Operator checks
- Raw response headers
- Cookie attributes
- Authentication boundaries
Defensive view
- Centralize secure headers
- Remove verbose diagnostics
WebAuthorization MatrixCompare role-versus-action decisions with synthetic records.
Open playbook
Operator checks
- Own versus other object
- User versus admin function
- Expected versus observed
Defensive view
- Server-side checks on every request
- Negative tests in CI
IdentityIdentity & Session ReviewAssess MFA, recovery, consent, and session lifecycle.
Open playbook
Operator checks
- MFA enrollment
- OAuth grants
- Revocation behavior
Defensive view
- Phishing-resistant MFA
- Risky-consent monitoring
CloudCloud Control-Plane ReviewInspect effective permissions and public exposure with read-only access.
Open playbook
Operator checks
- Identity context
- Trust relationships
- Audit logging
Defensive view
- Continuously analyze permissions
- Alert on public exposure
HostLinux Local ReviewInspect delegated privileges and risky service paths.
Open playbook
Operator checks
- User and group context
- sudo rules
- SUID and writable paths
Defensive view
- Baseline privileged files
- Remove unnecessary delegation
HostWindows Local ReviewReview service context, privileges, and control visibility.
Open playbook
Operator checks
- Identity and privileges
- Service paths
- Patch and security state
Defensive view
- Harden service ACLs
- Monitor privileged changes
ReportingFinding Write-upProduce a reproducible finding with durable remediation.
Open playbook
Operator checks
- Minimal proof
- Realistic impact
- Verification test
Defensive view
- Fix root cause
- Add regression coverage
ReportingEvidence HygieneMinimize, encrypt, transfer, and delete assessment evidence safely.
Open playbook
Operator checks
- Redaction
- Access control
- Deletion date
Defensive view
- Audit evidence handling
- Avoid secrets in tickets