RedTeam-Tools as a curated attack-technique reference map for authorized engagements

A-poc/RedTeam-Tools is a curated GitHub repository cataloguing 150+ offensive security tools and tradecraft tips organized by the MITRE ATT&CK kill chain for red teamers and penetration testers working under explicit authorization.

Tool	A-poc/RedTeam-Tools — a curated index of 150+ red team tools and 19 tradecraft tips mapped to MITRE ATT&CK phases
Category	Curated tool directory / tradecraft cheatsheet
Primary Use	Orientation and capability mapping during scoping, lab training, and purple-team research, using entries like LinPEAS, nuclei, and Responder as reference points
Safe Use	Intended for authorized penetration tests, red team engagements with written scope, and isolated lab environments; the README explicitly states the materials are for informational and educational purposes only
Telemetry Note	The repository itself is passive documentation, but the tools it catalogs — Responder, Empire, evil-winrm, Hydra — generate well-known network and endpoint artifacts (LLMNR/NBT-NS poisoning traffic, WinRM connections, authentication throttling) that defenders can build detections around

What A-poc/RedTeam-Tools offers is not a piece of software you install, but a structured map of the offensive tooling landscape, and that framing matters for how you should read it. The repository gathers more than 150 tools and resources that the author considers useful for red teaming, and rather than dumping them into a flat list, it organizes everything by MITRE ATT&CK tactic: Reconnaissance, Resource Development, Initial Access, Execution, Persistence, Privilege Escalation, and beyond. For a professional, this turns the repo into a planning artifact — a way to sanity-check that your engagement toolkit covers the phases you are authorized to exercise, and to identify gaps where you might be over-invested in one tactic and blind in another.

The most immediately useful section for many operators will be the Reconnaissance block, which lists 24 tools spanning OSINT, subdomain enumeration, and content discovery. Names like spiderfoot for automated attack surface mapping, reconftw for subdomain and vulnerability recon, nuclei as a template-driven vulnerability scanner, and the Rust-based feroxbuster for fast content discovery sit alongside more specialized entries such as spoofcheck for SPF/DMARC record validation and CloudBrute for cloud infrastructure discovery. The breadth here is a fair snapshot of what external-facing assessment work actually looks like in 2024-2026, mixing general-purpose scanners with narrow-purpose utilities like jsendpoints for extracting DOM links from pages.

Credential exposure gets its own attention within reconnaissance, which reflects how much of modern attack surface work is about leaked secrets rather than unpatched services. The repo indexes truffleHog and GitHarvester for scanning GitHub history for credentials, Gitrob for broader sensitive-file detection in source repositories, and AWSBucketDump for S3 bucket enumeration. From a defensive standpoint, this cluster doubles as a checklist of the exact mistakes that lead to breaches, and blue teams reading this list should treat it as a prioritization guide for secret-scanning CI controls and bucket permission audits.

The Resource Development and Initial Access sections are where the content becomes more sensitive, and it is worth being precise about what the README actually provides. Entries such as Chimera for PowerShell obfuscation, msfvenom for payload generation, Shellter for shellcode injection, and Freeze for EDR-evasion payload creation are catalogued with short descriptors and links to upstream projects, not with operational recipes. The same applies to the Initial Access block, which covers password spraying tools like TREVORspray and CredMaster, phishing frameworks such as EvilGoPhish and King Phisher, and SquarePhish for OAuth/QR-code phishing. The documentation level is a directory with one-line summaries — enough to know what exists, not a walkthrough for conducting attacks.

Where the repo earns analytical value is in the Execution and post-exploitation coverage, because it doubles as a de facto curriculum for Windows internals knowledge. The Execution section pairs familiar frameworks — Responder for LLMNR/NBT-NS/MDNS poisoning, evil-winrm as a WinRM shell, Donut for in-memory .NET execution — with reference material like NTAPI Undocumented Functions and Kernel Callback Functions, which are documentation resources rather than tools. The Privilege Escalation block is similarly well balanced: LinPEAS and WinPEAS for enumeration, Certify for Active Directory certificate abuse, Watson and Sherlock for missing-patch detection, and ADFSDump for AD FS credential work.

The Persistence section is notably thin at four entries — Impacket, Empire, SharPersist, and ligolo-ng for TUN-interface tunneling — which is an honest reflection of the ecosystem: long-term persistence tradecraft is concentrated in a few mature frameworks rather than distributed across many utilities. ligolo-ng is an interesting inclusion because it straddles persistence and Command and Control, using a TUN interface to route engagement traffic in a way that mimics legitimate VPN behavior. Analysts should note that tunneling tools of this class are exactly what network baselining and egress monitoring are meant to catch.

A distinctive feature is the Red Team Tips section, 19 short tradecraft notes attributed to individual researchers including Alh4zr3d, pr0xylife, and malmoeb. Topics range from VM detection checks and AppLocker rule enumeration to browser bookmark mining for internal endpoints and proxy-aware PowerShell usage. Read as a whole, the tips list is essentially a summary of where Windows post-exploitation friction lives in real environments — hardening gaps, logging blind spots, and policy misconfigurations that experienced operators keep rediscovering. Each tip is also, read from the other side, a detection engineering prompt.

The repo carries roughly 9.7k stars and a topic set covering red-team, pentest-tools, cheatsheet, mitre-attack, and both windows and linux, which signals sustained community relevance rather than a vanity project. The README includes an explicit warning that the materials are for informational and educational purposes only, and the author cross-links a companion BlueTeam-Tools repository for defenders — a pairing that makes the project's dual-use intent explicit and gives detection teams a mirrored starting point. There is no license recorded in the metadata, which is worth remembering if you plan to derive training material from the structure rather than just reading it.

For authorized use, the practical role of A-poc/RedTeam-Tools is threefold: a scoping aid when building a lab curriculum mapped to ATT&CK, a gap-analysis reference when assembling an engagement toolkit against a defined statement of work, and a study index for operators preparing for certifications that assume breadth across the kill chain. It should not be treated as a quality guarantee — inclusion is curation, not vetting, and some indexed upstream projects age quickly or carry their own risks in how they are built and distributed. Verify every referenced tool against its own repository before deployment in any environment you control.

The defensive takeaway deserves emphasis because it is the repo's most underrated property. A catalog of offensive capability organized by tactic is, in mirror image, a detection coverage map: every entry in Reconnaissance implies external attack surface monitoring, every Initial Access tool implies authentication hardening and phishing controls, and every Execution and Persistence entry corresponds to EDR and logging telemetry you should be able to demonstrate. Purple team exercises built directly from this list — picking one tool per tactic and validating that your stack produces an observable — are a cheap, high-yield way to convert a red team resource into measurable defensive improvement.

Official project repository for A-poc/RedTeam-Tools.

Download Tool

Educational analysis for authorized security professionals. Use only in controlled, authorized environments.