> For the complete documentation index, see [llms.txt](https://red.0xbad53c.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://red.0xbad53c.com/red-team-operations.md).

# Red Team Operations

- [Initial Access](https://red.0xbad53c.com/red-team-operations/initial-access.md): This section describes techniques related to Mitre TA0001 - Initial Access
- [Webshells](https://red.0xbad53c.com/red-team-operations/initial-access/webshells.md): This category talks about webshells. Our aim is usually to load a C2 framework from the webshell or execute other code without spawning suspicious subprocesses from the web server process.
- [Java (JSP) - Bring Your Own Jar](https://red.0xbad53c.com/red-team-operations/initial-access/webshells/java-jsp-bring-your-own-jar.md): On this page, we will explore how to reflectively load a class from a Java library and call its main method. In red team context, this can be used to stage additional java code without touching disk.
- [IIS - SOAP](https://red.0xbad53c.com/red-team-operations/initial-access/webshells/iis-soap.md): This page describes how to run shellcode from a webshell with a .soap extension. Sometimes web applications use upload blacklists and forget about this extension type.
- [Macro Attacks](https://red.0xbad53c.com/red-team-operations/initial-access/macro-attacks.md): This category talks about Office macro attacks, which are often used in combination with phishing to establish a foothold on the victim's machine.
- [Talking Documents with SpVoice COM](https://red.0xbad53c.com/red-team-operations/initial-access/macro-attacks/talking-documents-with-spvoice-com.md): This page describes how to use the Microsoft Speech API to let your office document talk to the end user.
- [Binary File Write via Microsoft Speech API](https://red.0xbad53c.com/red-team-operations/initial-access/macro-attacks/binary-file-write-via-microsoft-speech-api.md): This page describes how to use the Microsoft Speech API to write binary files from office documents.
- [Mark-Of-The-Web Bypass with 7-zip](https://red.0xbad53c.com/red-team-operations/initial-access/macro-attacks/mark-of-the-web-bypass-with-7-zip.md)
- [Azure and O365](https://red.0xbad53c.com/red-team-operations/azure-and-o365.md)
- [PRT Abuse from Userland with Cobalt Strike](https://red.0xbad53c.com/red-team-operations/azure-and-o365/prt-abuse-from-userland-with-cobalt-strike.md): This page describes how to acquire an Azure AD Single Sign-On session from a non-privileged user session on a Windows machine. The acquired token is later used to enumerate Azure AD via ROADTools.
- [Enumerate Azure AD with AzureHound from Userland](https://red.0xbad53c.com/red-team-operations/azure-and-o365/enumerate-azure-ad-with-azurehound-from-userland.md): This page describes how to enumerate Azure AD with AzureHound, starting from a non-privileged user session on a Windows machine.
- [AWS](https://red.0xbad53c.com/red-team-operations/aws.md)
- [Role Abuse: SSM](https://red.0xbad53c.com/red-team-operations/aws/role-abuse-ssm.md): This page describes how a compromised machine with the default AmazonSSMRoleForInstancesQuickSetup role can allow an attacker to move laterally to all other machines holding this role in the VPC.
- [OffSecOps](https://red.0xbad53c.com/red-team-operations/offsecops.md)
- [Arsenal Aggressor Script](https://red.0xbad53c.com/red-team-operations/offsecops/arsenal-aggressor-script.md): Aggressor script to automatically download and load an arsenal of open source and private tooling. Hopefully, this saves other teams time and helps the community!