Red Team Assessments

For red team engagements, defining the scope is more about determining what areas to exclude from the assessment. This process is consists of the following steps:

• Compile a list of goals or flags to compromise or capture
• Establish a definitive set of rules of engagement specifying what is allowed, such as on-site social engineering
• Determine exclusions from the attack, such as specific applications, personnel, or IP addresses
• Set the official testing period
• Acquire a letter of authorization for all on-site activities

We use several OSINT resources to gather data and intelligence on the target to develop a plan of attack. The information we collect in this stage is critical and its accuracy determines how well the attack is planned. The information we try to acquire during the reconnaissance include:

• External network IP range, hosting providers, and open ports or services
• Web and mobile applications, along with associated APIs
• Personnel identities, email addresses, phone numbers, and social media activities
• Previously breached credentials and other information sources
• The IoT and embedded systems the organization uses

In this phase, we use the intelligence we’ve gathered to map our strategy and plan the actual attack. The strategies and plans vary widely from organization to organization and are heavily dependent on several variables, but some of the steps we follow to prep for the actual attack are:

• Identifying subdomains, hidden environments, and prepping applications
• Analyzing cloud services for misconfigurations
• Checking authentication forms for weak credentials
• Identifying known vulnerabilities in network and web applications
• Mapping any identified vulnerabilities for potential manual attack-vectors
• Crafting social-engineering pretext scenarios

Once we’ve finalized the attack plan, we execute and begin systematically taking down the organization’s security checkpoints, compromising targets, and capturing flags as we go. The penetration may include:

• Attacking services through previously mapped vulnerabilities
• Compromising testing systems and sandboxes
• Accessing servers using breached credentials or brute-forcing our way in
• Targeting personnel using various social engineering techniques
• Combining attack vectors such as exploiting client-side vulnerabilities via phishing emails

Proper reporting and documentation of findings are crucial for any assessment. Di8it follows strict documentation standards and offers a customized, highly detailed report that outlines the scope of the engagement, how the attack was planned and executed, and the vulnerabilities discovered. We also provide remediation suggestions and steps to help bolster your security and plug in the holes.