Results for “red-team”

Set up and harden a Sliver server for authorized security exercises that simulate attackers. Cover multiple communication protocols, intermediary servers, certificate-based access for team members, and test programs that use periodic or interactive connections.

• Building a Sliver server for an authorized red-team exercise
• Configuring multiple communication protocols for an exercise
• Managing certificate-based access for multiple operators

Set up repeatable security tests for LLM apps with Promptfoo and DeepTeam. Connect them to automated build pipelines, detect renewed vulnerabilities to malicious instructions or data leakage, and compare results across model or prompt changes.

• Running automated attack tests on every code change
• Blocking merges when security tests fail
• Comparing security across model or prompt versions

Red-team operator discipline — the mindset corrections that separate offensive testing from defensive WAPT. Built from authorized red-team work where conservative defaults caused multiple findings to be missed and one to be incorrectly retracted. Use at the START of any red-team engagement and again whenever feeling stuck or considering "stopping" on a defended target. The single most important skill to load when scope is "external red team" not "bug bounty / WAPT".

The English summary is being prepared. Showing the original description.

Plan, scope, and execute an authorized red-team engagement — distinct from a penetration test. Covers engagement methodology, assumed-breach scenarios, ATT&CK emulation plans, rules of engagement, deconfliction with the blue team, post-engagement debriefs, and the program-level work that makes red teams actually improve defenses. Use when the user mentions 'red team,' 'red team engagement,' 'red teaming,' 'adversary emulation,' 'ATT&CK emulation,' 'assumed breach,' 'purple team exercise,' 'tabletop with technical execution,' 'red team scope,' 'rules of engagement,' 'red team RoE,' 'deconfliction,' 'red team debrief,' or wants to design or run a red-team engagement against systems with authorization.

The English summary is being prepared. Showing the original description.

Adversarially probe this monorepo for security flaws at the right depth. Steers the red-team subagent — picks quick/standard/deep from the request, spawns it (fanning out for a wide deep sweep), collates findings into a dated report, and files security/sec:* issues for confirmed high/critical findings. Use when asked to "red-team", "try to hack this", "find security holes", "pentest this package/app", or as the brain behind the CI + daily security runs.

The English summary is being prepared. Showing the original description.

Wire Promptfoo and DeepTeam into CI/CD for automated regression red-teaming of LLM apps against OWASP LLM Top 10 and OWASP Agentic presets, failing the build when jailbreak or injection vulnerabilities regress.

The English summary is being prepared. Showing the original description.

End-to-end Coval adversarial / red-team testing workflow. Builds one adversarial test set (12 core attack vectors plus legitimate controls, each with an expected-behavior checklist), creates a persistent "Adversarial User" persona and a Composite Evaluation metric that scores each scenario against its own expected behaviors, launches a multi-iteration run against the agent (voice or chat), polls for completion, builds a per-scenario pass/fail scorecard, and creates a saved report grouped by Test Case. Use when a user wants to follow the Adversarial & Red-Team Testing cookbook (https://docs.coval.dev/guides/adversarial-red-team-testing) without doing each step by hand. Triggers: "adversarial test set", "red team my agent", "jailbreak / prompt-injection testing", "test my agent against bad actors".

The English summary is being prepared. Showing the original description.

Red-team operator discipline — the mindset corrections that separate offensive testing from defensive WAPT. Built from authorized red-team work where conservative defaults caused multiple findings to be missed and one to be incorrectly retracted. Use at the START of any red-team engagement and again whenever feeling stuck or considering 'stopping' on a defended target. The single most important skill to load when scope is 'external red team' not 'bug bounty / WAPT'.

The English summary is being prepared. Showing the original description.

Monitor requests to an AI prediction API for signs of model copying or training-data exposure. Test an authorized model with simulated attacks, measure the risk, and evaluate defenses such as request limits and reduced prediction detail.

• Monitoring a public or partner prediction API
• Measuring model copying risk before deployment
• Testing request limits and reduced prediction detail

Use Stratus Red Team to simulate attack techniques across AWS, Azure, GCP, and Kubernetes. Prepare test resources, run and repeat simulations, check logs and alerts, and remove resources to assess whether security detections work.

• Checking whether cloud detection rules trigger
• Testing log ingestion and alert routing
• Running joint attack and defense exercises

Set up Havoc infrastructure for authorized attack simulations, including its command server, traffic listeners, Nginx relay servers, and Windows agents. The skill also covers communication profiles and operational precautions for running the infrastructure.

• Preparing Havoc infrastructure for an authorized exercise
• Reviewing server and traffic relay separation
• Configuring communication profiles for an exercise

Plan and run authorized security exercises that simulate an attacker's actions, from reconnaissance to activities after entry. Map techniques to MITRE ATT&CK, a framework of attack behaviors, and report detection gaps and response performance.

• Planning the scope and objectives of a red team exercise
• Designing scenarios based on a specific threat actor
• Measuring detection and response during an exercise

Build intermediary servers for authorized security exercises, separating public traffic from the command server used by the test team. It covers simple forwarding, request filtering with nginx or Apache, TLS certificates, and validation against the exercise’s traffic profile.

• Separating public infrastructure from an exercise command server
• Filtering exercise traffic against a defined profile
• Adding TLS certificates to a redirector

Assess Microsoft Entra ID with AADInternals during authorized security testing. Examine publicly exposed tenant information, API access, and federation weaknesses, including Golden SAML, a token forgery technique, then document evidence and recommendations for stronger identity protection.

• Mapping publicly exposed Entra ID tenant information
• Checking API access available through acquired tokens
• Validating AD FS signing certificate protection

Simulate device-code and app-consent phishing in an explicitly authorized Microsoft Entra ID environment. Assess whether authentication and consent controls prevent token misuse, map reachable Microsoft 365 resources, and document findings with remediation recommendations.

• Run authorized Microsoft 365 phishing exercises
• Validate Conditional Access and MFA controls
• Test restrictions on app consent

Use ROADrecon and roadtx during authorized Microsoft Entra ID testing to inspect directory objects and authentication tokens, which represent access permissions. Explore collected configuration offline, test token exchanges, and assess conditional access and device controls.

• Mapping tenant users, groups, roles, and applications
• Reviewing conditional access policies
• Testing token exchanges and device-based single sign-on

Assess Shadow Credentials account takeover during authorized Active Directory testing. Examine permissions that allow public key registration, validate authentication without a password reset, and document credential cleanup, detection opportunities, and access control changes needed for remediation.

• Assessing risky permissions identified in BloodHound
• Validating account takeover without resetting a password
• Generating directory change records during security exercises

Assess exposure of Windows secrets protected by DPAPI, the operating system’s data protection service, during authorized security tests. Guide examination and decryption of saved credentials and browser data using available user sessions, credentials, or backup keys.

• Assessing saved credential exposure in authorized tests
• Examining collected DPAPI files offline
• Reviewing protected browser and RDP credentials

Review a product requirements document, roadmap, or strategy by challenging the assumptions it depends on. Rank potential failures by impact, likelihood, and testing cost, then propose small tests, evidence to gather, and criteria for stopping or changing course.

• Challenging critical assumptions before starting a plan
• Preparing a strategy document for executive review
• Choosing low-cost tests to run this week

Client-facing red-team deliverable format — codifies the Subject / Observations / Description / Impact / Recommendation / PoC structure used for external red-team engagements (not bug-bounty platform reports). Different audience, different tone, different cadence. Built from an authorized engagement deliverable where 14 findings were packaged into a 52KB MD + 2.2MB DOCX with 16 embedded screenshots. Use when the engagement is "external red team for an enterprise client" (not H1/Bugcrowd/Intigriti), when generating the final report, when the client has specified a custom report format, or when packaging findings into DOCX/PDF.

The English summary is being prepared. Showing the original description.

Methodology for detecting client SOC patches, attacker activity, and security-state changes that occur DURING a red-team engagement — and converting those observations into deliverable findings. Built from authorized red-team work where the client patched a confirmed SQLi within 30 minutes of detection AND an external attacker locked multiple new accounts during a single test session. Use when (a) running ANY active engagement against a monitored target, (b) a previously-confirmed finding stops reproducing, (c) baseline timing shifts unexpectedly, or (d) you notice response patterns changing during testing.

The English summary is being prepared. Showing the original description.

Microsoft 365 / Entra ID red-team attack chain — current 2026 reality. AADSTS code reference, user enumeration vectors (with hardening status), Smart Lockout math, Conditional Access bypass options, ROPC + SAML SSO browser flow, Burp/Playwright templates. Built from authorized red-team work where ROPC spray surfaced pre-existing lockouts and CA-blocked credentials, plus real-time external attacker activity correlation. Use for any M365/Entra credential attack, password spray, user enumeration, CA-bypass exploration, or active-attacker-detection scenario.

The English summary is being prepared. Showing the original description.

End-to-end Android APK red-team pipeline — automated APK acquisition (Play Store + apkpure + apkmirror fallback), jadx decompilation, secret/URL/JWT/Firebase grep, pinned-cert extraction, exported-component enumeration, Frida runtime instrumentation templates, intent-injection probes. Built from an authorized external red-team engagement where 7 APKs were pulled manually, 4 download attempts truncated, and a hardcoded JWT + 30 internal API endpoints were recovered from one of the apps. Use when target has a mobile app catalogue (Play Store developer page), when you find an APK URL hosted on a web server, or when post-recon mentions "mobile app" in scope.

The English summary is being prepared. Showing the original description.

Simulate the acquirer's diligence team hunting for reasons to cut your price — their internal red-flags memo with a price-chip estimate per finding. Use when asked to red-team my company before a sale, how will an acquirer attack our valuation, pre-diligence audit, or what will DD find. Produces the acquirer's internal memo (revenue quality, key-person, tech debt, concentration, legal) and a debrief on which flags are fixable before a process.

The English summary is being prepared. Showing the original description.