渗透测试实战第三版(红队版) (it-ebooks)（Z-Library）

【One-Line Pitch】 A hands-on red-team playbook that walks you through a full adversary simulation—from building C2 infrastructure and evading antivirus to Active Directory exploitation and reporting—for security practitioners who already know the basics and want to operate like a real threat actor. 【Book Arc】 - **Opening (~0%–10%)**: Frames the red-team mindset versus traditional pentesting, sets up the fictional "Cyber Space Kittens" engagement, and covers legal/authorization warnings plus the assumed-breach exercise concept. - **Early (~10%–30%)**: Builds the attack infrastructure—VPS setup, Metasploit, Cobalt Strike, PowerShell Empire, dnscat2, and other C2 frameworks—and introduces MITRE ATT&CK as the planning backbone. - **Middle (~30%–55%)**: Moves into reconnaissance and initial access: environment probing, scan diffing, cloud scanning, subdomain discovery, then web exploitation (XSS, NoSQL injection, deserialization, SSRF, XXE) and network footholds via Responder, CrackMapExec, and credential harvesting. - **Late (~55%–80%)**: Covers post-exploitation depth—privilege escalation on Windows and Linux, lateral movement (Pass-the-Hash, DCOM, RDP tunneling), Active Directory/Kerberos abuse, BloodHound, and social engineering (phishing, macro/DDE payloads, domain lookalikes). - **Ending (~80%–100%)**: Closes with physical access attacks (LAN Turtle, Bash Bunny), AV/network evasion and custom malware development, automation, password cracking, and post-engagement analysis and reporting. 【Key Takeaways】 - **Red teaming differs from pentesting in goal, not just tools** (Opening): the focus shifts from finding vulnerabilities to testing detection and response, measured by metrics like time-to-detect (TTD) and time-to-mitigate (TTM). - **Infrastructure is a first-class concern** (Early): reusable, redirectable C2 setups using domain fronting and CDNs let you survive takedowns and blend traffic with legitimate services. - **C2 diversity matters** (Early): frameworks like Cobalt Strike, Empire, and dnscat2 each solve different problems—SMB beacons for internal pivoting, DNS tunneling for restricted egress. - **Web exploitation remains a primary entry vector** (Middle): the book walks through XSS variants, NoSQL injection, deserialization, template injection, SSRF, and XXE with practical lab scenarios. - **Credential access drives lateral movement** (Late): Responder, CrackMapExec, Pass-the-Hash, and SPN enumeration form the chain from a single foothold to domain-wide compromise. - **Active Directory is the endgame** (Late): BloodHound/SharpHound mapping, DCOM abuse, and domain controller hash dumping show how attackers escalate from workstation to domain. - **Evasion requires custom tooling** (Ending): recompiling Meterpreter, code caves, PowerShell obfuscation, and application whitelist bypasses are presented as necessary skills, not optional extras. - **Reporting and metrics close the loop** (Ending): the book emphasizes translating red-team activity into actionable data for defenders, not just a list of exploited hosts. 【Reading Tips】 - **Deep-read the infrastructure and evasion chapters** (Early and Ending): these are the most reusable and hardest to improvise; skim the tool installation steps if you already have a lab. - **Treat the labs as mandatory practice**: the book is explicitly exercise-driven; reading without reproducing the scenarios will not build the muscle memory it aims for. - **Expect a steep curve on Active Directory and Kerberos**: if you lack AD fundamentals, pause and study those before the lateral movement chapters. - **Use MITRE ATT&CK as a companion map**: keep the matrix open while reading to see how each technique fits into a broader TTP taxonomy. - **Re-read after a gap**: the author himself notes that two or three passes with digestion time in between are typical for absorbing the material. 【Coverage Limits】 This guide is based on stratified excerpts covering the table of contents, introduction, and early-to-middle chapters; later chapters on physical attacks, evasion, and reporting are summarized from headings and brief fragments, so specific techniques and lab details in those sections are not fully represented.