# 🔴 Red Teaming & Professional Penetration Testing

---

## 🧠 What is Penetration Testing?

**Penetration testing** (pentest) is an **authorized, simulated cyberattack** against a computer system, network, or application. The goal is to find and expose security weaknesses *before* malicious actors can exploit them.

A professional pentester — also called an **ethical hacker** — uses the exact same techniques as a real attacker, but operates within a strictly defined legal and contractual scope.

> 🎯 **Red Teaming** takes this further: it simulates a full adversary campaign with specific objectives (e.g., exfiltrate sensitive data, compromise domain admin), while the **blue team** tries to detect and respond. Red team engagements are typically longer, stealthier, and scenario-driven.

---

## 🎓 Context and Purpose

The labs in this module use **Metasploitable** — a deliberately vulnerable Linux VM maintained by Rapid7, designed *exclusively* for practicing attack techniques in a safe, isolated environment.

Every technique demonstrated here mirrors real-world attacker behavior. Understanding it is essential for:

| 🎯 Goal | 💡 Why It Matters |
|--------|-----------------|
| 🛡️ Building defensive controls | You can't defend what you don't understand |
| 📋 Authorized security assessments | Core skill of any pentester |
| 🏆 Certifications (OSCP, CEH, eJPT) | Hands-on labs are the backbone of these exams |
| 🔍 Detection & incident response | Attack knowledge drives better detection rules |

---

## 🗺️ Phases of a Penetration Test

A professional pentest follows a structured lifecycle. The most referenced frameworks are **PTES** and the **OWASP Testing Guide**.

---

### 🤝 Phase 1 — Pre-Engagement

Before a single packet is sent, the legal and operational groundwork must be laid:

- 📄 Sign a **Statement of Work (SoW)** and **NDA**
- ✅ Obtain **written authorization** from the asset owner
- 🗂️ Define scope, objectives, and **Rules of Engagement (RoE)**
- 📞 Establish emergency contacts and escalation paths
- 🚫 Identify and document out-of-scope systems

> ⚠️ No authorization = no test. Full stop.

---

### 🔍 Phase 2 — Reconnaissance

Gather intelligence about the target — the quieter, the better.

| 🕵️ Type | Description | 🛠️ Tools |
|--------|-------------|---------|
| **Passive** | OSINT — zero direct contact with the target | Shodan, WHOIS, theHarvester, LinkedIn |
| **Active** | Direct interaction with the target system | Nmap, Netcat, Enum4linux |

---

### 📡 Phase 3 — Scanning & Enumeration

Map the attack surface in detail:

- 🔓 Port scanning — discover open services
- 🏷️ Service version fingerprinting
- 💻 OS detection
- 👥 User, share, and resource enumeration (SMB, SNMP, LDAP)
- 🐛 Vulnerability scanning (Nmap NSE scripts, Nessus, OpenVAS)

---

### 💥 Phase 4 — Exploitation

Attempt to turn vulnerabilities into access:

- 🧨 Known CVEs (e.g., vsftpd 2.3.4 backdoor, Distcc RCE)
- 🔑 Authentication attacks (brute-force, credential stuffing)
- ⚙️ Misconfigurations (weak permissions, default credentials)

---

### 🕵️ Phase 5 — Post-Exploitation

Once inside, understand the full impact:

- 📊 System and network enumeration
- 🗝️ Credential harvesting (`/etc/shadow`, SSH keys)
- 🔀 Lateral movement
- 📤 Data exfiltration *(proof of concept only)*
- ⬆️ Privilege escalation (SUID binaries, sudo misconfigurations, kernel exploits)

---

### 🪝 Phase 6 — Persistence *(Simulated)*

Demonstrate how an attacker could maintain long-term access:

- ⏰ Cron jobs, systemd services, `rc.local` backdoors
- 🐚 Reverse shells disguised as system processes

> 🧹 In real engagements, **all persistence mechanisms are documented and then removed** before the report is delivered.

---

### 📝 Phase 7 — Reporting

The final deliverable — and the most important one for the client:

| 📑 Section | Content |
|-----------|---------|
| 📊 **Executive Summary** | Business impact in plain language |
| 🔬 **Technical Findings** | Vulnerability details, evidence, CVSS scores |
| 🔧 **Remediation Recommendations** | Prioritized and actionable fixes |
| 🛠️ **Methodology** | Tools and techniques used |

---

## 📚 Core Methodologies & Frameworks

| 🏛️ Framework | 🎯 Focus |
|-------------|---------|
| **PTES** | End-to-end pentest lifecycle |
| **OWASP Testing Guide** | Web application security |
| **MITRE ATT&CK** | Adversary TTPs — tactics, techniques, procedures |
| **NIST SP 800-115** | Technical guide to information security testing |
| **OSSTMM** | Open-source security testing methodology |

---

## ⚖️ Ethics in Penetration Testing

> 🧭 Ethical hacking is defined not by the **techniques** used, but by **authorization and intent**.

### 📜 The Three Laws of Ethical Hacking

```
1. 🖊️  Always have WRITTEN PERMISSION from the system owner.
2. 🗺️  Stay WITHIN SCOPE — never touch systems not in the agreement.
3. 🩺  DO NO UNNECESSARY HARM — avoid disrupting production services.
```

### 🏅 Professional Standards

- 📘 The **EC-Council Code of Ethics** and **(ISC)² Code of Ethics** govern certified professionals
- 🔐 Sensitive data encountered during testing (passwords, PII, business secrets) must be **protected and not retained** beyond the engagement
- 📢 **Responsible disclosure** applies when finding third-party software bugs — notify the vendor privately before any public release

### 🔴 vs 🟢 — Attacker vs Ethical Hacker

| Dimension | 🟢 Ethical Hacker | 🔴 Malicious Attacker |
|-----------|-----------------|----------------------|
| Authorization | ✅ Written, explicit | ❌ None |
| Intent | 🛡️ Improve security | 💣 Damage, steal, disrupt |
| Scope | 📏 Defined and limited | ♾️ Unrestricted |
| Reporting | 📋 Full disclosure to client | 🤫 Concealment |
| Accountability | ⚖️ Contractually bound | 👤 Anonymous / criminal |

---

## 🖥️ Lab Environment

All exercises in this module run against **Metasploitable 2/3** — isolated, with no internet access.

| 🎭 Role | 💻 OS | 🌐 IP (example) |
|--------|------|----------------|
| ⚔️ Attacker | Kali Linux | `192.168.56.101` |
| 🎯 Target | Metasploitable 2 | `192.168.56.102` |

> 🚨 **Never run these techniques against any system you do not own or have explicit written permission to test.**
