offensive-playbooks

Plugin offensive-playbooks in redcell-sh/redcell-plugins. Commands read from the repo's manifest — 10 days ago.

Skills (14)

• bug-bounty-workflow

  End-to-end authorized bug bounty workflow — program scope discipline, asset and subdomain recon, automated lead generation, manual validation with an oracle, deduplication, and report writing. Use when hunting on a bug bounty platform, VDP, or any authorized public-facing program.

• cloud-attack-paths

  Cloud attack-path playbook for authorized AWS and Azure/Entra ID environments — account and metadata enumeration, IAM role abuse, SSRF to instance metadata, privilege-escalation chains, hybrid-identity pivots (Azure AD Connect, gMSA), storage account abuse, and automation/runbook abuse. Use when the

• container-k8s-escape

  Container and Kubernetes escape playbook for authorized environments — identifying container context, Docker misconfigurations (socket exposure, privileged containers, hostPath, capabilities), Kubernetes API and kubelet abuse, service-account token pivots, RBAC enumeration, and pod-to-host escape. U

• database-attack-paths

  Database attack-path playbook for authorized engagements — MSSQL enumeration and abuse (xp_cmdshell, linked servers, impersonation), MySQL, PostgreSQL, Redis and NoSQL paths from credentials to shells and lateral movement, plus credential harvesting inside databases. Use whenever database credential

• host-attack-workflow

  Universal workflow for attacking a single authorized host or lab target — full-surface port scanning, service-by-service enumeration, foothold hunting, post-foothold host enumeration, and escalation. Use when starting work on any standalone target, lab machine, or single-host engagement and you need

• linux-privesc

  Linux local privilege-escalation playbook for authorized hosts — post-shell enumeration checklist, credential hunting, sudo/SUID/capabilities/cron abuse, arbitrary-file-write escalation primitives, and last-resort kernel exploits. Use after gaining any Linux foothold when you need root.

• mobile-testing

  Mobile application security testing methodology for authorized engagements — Android (APK analysis, decompilation, Frida hooking, SSL pinning bypass, device and backup analysis) and iOS (IPA analysis, keychain, jailbroken-device testing), aligned to OWASP MASVS, plus backend API testing through the

• password-cracking

  Offline password and hash cracking methodology for authorized engagements — hash format identification, wordlist and rule selection, mask and mutation attacks, cracking Kerberos tickets, SSH keys, password safes, VNC passwords, and encrypted configs, and knowing when to stop. Use whenever recovered

• pivoting-and-tunneling

  Network pivoting and tunneling playbook for authorized engagements — mapping what a foothold can reach, building tunnels (SSH local/remote/dynamic, SOCKS proxies, chisel/socat), port-forwarding to localhost-bound and internal services, and chaining pivots through multi-host networks. Use whenever a

• source-code-audit

  Source-code auditing methodology for authorized engagements — reviewing target application source (client-provided repos, recovered source, or file-read access) for security bugs: entry-point mapping, taint tracking to dangerous sinks, authentication/authorization review, secret and dependency scann

• web-foothold-patterns

  Pattern library for turning web application access into a shell or foothold in authorized engagements — surface expansion (subdomains/vhosts/hidden panels), content discovery and source disclosure, upload-to-RCE abuse, LFI/file-read to credential discovery, deserialization and template injection, im

• windows-ad-attack-paths

  Playbook for Windows and Active Directory attack paths in authorized environments — null-session and LDAP recon, policy-aware credential spraying and validation, BloodHound path analysis, Kerberos attacks, ADCS template abuse, and privilege abuse to domain dominance. Use whenever a target presents W

• windows-privesc

  Windows local privilege-escalation playbook for authorized hosts — post-shell enumeration, service abuse, unquoted paths, registry secrets, and privilege-token abuse (impersonate/backup/restore/ownership). Use after gaining any Windows foothold when you need SYSTEM on a single host.

• wireless-testing

  Wireless network testing methodology for authorized environments — 802.11 reconnaissance, WPA/WPA2 handshake capture and offline cracking, WPS and enterprise EAP testing, rogue access point (evil twin) testing strictly within scope, and guest-network segmentation findings. Use when an engagement exp

Similar plugins