Operational Red Team & Penetration Testing Plan (CKC-Aligned)
— 2025 Toolset
Scope: Web, API, and Network | Outcome: Real-world, reproducible testing mapped to the Cyber
Kill Chain
Pre-Engagement & Rules of Engagement (Before CKC)
• Define scope (in/out-of-scope hosts, apps, APIs), success criteria, test windows, data handling,
and escalation.
• Obtain written authorization, safe-word/kill-switch, and deconfliction contacts.
• Establish evidence collection, chain-of-custody, and logging standards.
• Prepare lab: VPNs, C2 ranges, hardened jump boxes, and version-controlled tooling.
CKC-01 Reconnaissance / OSINT
Goal: Expand the attack surface, enumerate assets, tech stacks, and exposed data for Web, API,
and Network.
Core Techniques
Passive intel: DNS, CT logs, WHOIS, paste sites, Git history, cloud buckets, archived content.
Subdomain & asset mapping; historical URLs and endpoints; secrets discovery.
Service discovery and basic fingerprinting without touching production aggressively.
Primary Tools (Use routinely)
Amass, Subfinder — external attack surface & subdomain discovery.
reconFTW — automated recon pipelines (subdomains, OSINT, vulns).
getallurls (gau) — historical URL harvesting (OTX, Wayback, Common Crawl).
TruffleHog — secrets discovery across Git, repos, and artifacts.
Shodan/Censys — passive service & exposure intelligence.
Nmap (top-ports), Masscan (careful rate limiting) — light active discovery for approved
ranges.
Nice-to-Have / Situational
theHarvester, Assetfinder, GitHub dorks, Wayback Machine, crt.sh, SecurityTrails.
CKC-02 Weaponization (Payloads, Wordlists, Templates)
Goal: Prepare tailored checks, payloads, and templates tied to discovered tech and APIs.
Primary Tools
Nuclei (+ community templates) — signature & behavior checks for web, API, cloud and
infra.
ffuf / Wfuzz — fast wordlist fuzzing for directories, parameters, and vhosts.
Dalfox / XSStrike — XSS discovery & verification.
SQLMap / NoSQLMap — SQL/NoSQL injection detection and exploitation automation.
Commix — OS command injection testing.
jwt_tool — JWT tampering, validation, and signing edge cases.
Wordlists & Data
Seclists (directories, parameters, payloads), bespoke dictionaries from tech-stack and gau
results.
Custom Nuclei templates for organization-specific patterns.
CKC-03 Delivery (Initial Access Vectors)
Goal: Deliver payloads through realistic ingress: web/API endpoints, phishing simulations (if in
scope), exposed services.
Primary Tools
Burp Suite Professional (or Burp DAST/Enterprise) — interception, modification, scanning,
Intruder, Repeater, extensions.
OWASP ZAP — open-source proxy/scanner with automation hooks and CI.
Kiterunner — API route and verb discovery using framework-aware dictionaries.
Arjun — hidden parameter discovery for APIs and forms.
RESTler — stateful REST API fuzzing from OpenAPI/Swagger.
Aikido/Intruder/Acunetix/Invicti (DAST choices per budget) — automated coverage where
appropriate.
Network Service Delivery
Nmap NSE, Masscan → service banners; target specific protocol clients to validate exposure.
CKC-04 Exploitation (Gaining Execution or Data Access)
Goal: Trigger vulnerabilities to obtain code execution, data exposure, or authentication bypass
in line with scope.
Web & API
Burp Suite (manual exploits), Nuclei (POC templates), SQLMap/NoSQLMap, Dalfox/XSStrike,
Commix.
Kiterunner+ffuf for endpoint/verb fuzzing; jwt_tool for token abuse; ZAP active scan/fuzz.
Network & Identity
Impacket toolkit (psexec, wmiexec, secretsdump, GetUserSPNs, ntlmrelayx).
Kerbrute for Kerberos enumeration; Responder/mitm6 for NBNS/LLMNR/DHCPv6 abuse
(lab/approved only).
Hydra for protocol logon testing (with strict rate-limits); RDP/SSH/FTP/SMTP as permitted.
CKC-05 Installation / Persistence (If In Scope)
Goal: Establish controlled, time-boxed footholds to demonstrate risk; minimize business impact
and clean up.
Primary Tools
Sliver C2 — operator-friendly, open-source C2 with HTTP(S)/mTLS/DNS transports.
Evil-WinRM for Windows post-exploitation sessions; Impacket PSExec/WMIExec for lateral
footholds.
Tunneling: chisel, sshuttle, SOCKS proxies; web shells only in lab or explicit approval (e.g.,
Weevely/PhpSploit).
CKC-06 Command & Control (C2/Channel Management)
Goal: Operate implants over authenticated, encrypted channels; maintain strict logging and ROE
compliance.
Sliver multi-user ops; OPSEC profiles; per-target beacons; redirectors where allowed.
All C2 traffic whitelisted in advance; immediate teardown on anomaly.
CKC-07 Actions on Objectives (Data, Privilege, Lateral Movement)
Network & AD Focus
BloodHound (AD/Azure pathing) → identify constrained delegation, ACL abuse, nested
groups.
NetExec / CrackMapExec (or maintained fork) for authentication spraying, shares, command
exec.
Hashcat/John (offline) for password cracking of obtained hashes; secretsdump extraction
where authorized.
Data Validation & Impact
Targeted data access proofs (PII samples, file hashes) without exfiltrating bulk data.
Cloud & API: enumerate scopes, roles, tokens; demonstrate least-privilege gaps.
Continuous & Automated Coverage (Optional)
Schedule Nuclei, ZAP/Burp DAST, and Aikido/Intruder on non-prod or during maintenance
windows.
Feed recon (Amass/Subfinder/gau) into attack surface management; track deltas over time.
Reporting, Retest & Fix Verification (After CKC)
Executive summary, technical findings (CVSS/EPSS where relevant), reproducible steps,
request/response samples, and POCs.
Risk-rated remediation with code/config diffs; retest plan and verification evidence; lessons
learned and hardening roadmap.
Operational QA & Governance
Legal: Authorization letters, contact matrix, emergency stop.
Safety: Throttle scanners, exclude production-critical segments unless approved, back-out
plans.
Evidence: Timestamped logs, PCAPs (Wireshark), screenshots, C2 audit logs.
Change control: All payloads & templates tracked in version control; peer review before use.
Compact Tool Matrix (What We Actually Use)
Phase Web API Network/AD
Recon Amass, Subfinder, Amass, Subfinder, Shodan/Censys,
reconFTW, gau, gau, TruffleHog Nmap (safe),
TruffleHog Masscan (throttled)
Weaponize Nuclei, ffuf, Dalfox, Nuclei, ffuf, Arjun Nuclei (infra),
XSStrike, SQLMap, wordlists (Seclists)
Commix, jwt_tool
Delivery Burp, ZAP Burp, ZAP, Nmap NSE, protocol
Kiterunner, Arjun, clients
RESTler
Exploitation Burp, SQLMap, Burp/ZAP, RESTler, Impacket, Hydra
Dalfox/XSStrike, Kiterunner (rate-limited)
Commix
Install — — Sliver, Evil-WinRM,
chisel
C2 — — Sliver
Objectives Targeted data proofs Scope/role abuse BloodHound,
proofs NetExec/CME,
Hashcat/John
Report/Retest Evidence & fixes Evidence & fixes Evidence & fixes
AI-Powered Tools & 2025 Enhancements
The following additions integrate cutting-edge AI-driven penetration testing tools, as identified
by EC-Council, Mindgard, and recent academic research. These tools enhance reconnaissance,
weaponization, and automation phases while keeping human oversight central.
Reconnaissance Additions
RapidPen – LLM-based automation from IP to candidate exploit paths.
PTHelper – Modular open-source pentest automation with AI-guided recon workflows.
Weaponization Additions
PentestGPT – Generates test cases, PoCs, and rationales using LLM capabilities.
PenHeal – Automates vulnerability detection and provides AI-assisted remediation mapping.
Continuous Automation Additions
RapidPen – Can be integrated into CI/CD or automated pipelines for continuous recon-to-
exploit mapping.
PTHelper – Supports recurring scans and recon tasks with minimal manual intervention.
PenHeal – Provides rolling vulnerability assessments and updates remediation plans in real
time.
AI-Enhanced CKC Phase Mapping
CKC Phase Added AI Tools
Reconnaissance RapidPen, PTHelper
Weaponization PentestGPT, PenHeal
Continuous Automation RapidPen, PTHelper, PenHeal
