RedTeamOps: Automating and Managing Red Team Infrastructure as Code
Mert Can Coşkuner demonstrates automating resilient, disposable red team infrastructure using Infrastructure as Code (Terraform, Ansible), and redirectors.
Summary
The Overhead of Managing Red Team Infrastructure
Deploying and maintaining multi-tiered redirectors, payload delivery servers, and command and control (C2) hosts manually is time-consuming and error-prone.
Applying Infrastructure as Code (IaC) to Red Teaming
Mert Can Coşkuner details using Terraform and Ansible to provision modular, disposable offensive cloud infrastructure across multiple providers in minutes.
Configuring Stealthy Multi-Tiered Redirectors
The author shows how to set up Apache/Nginx reverse proxy redirectors with customized mod_rewrite rules to filter incident response analysts and sandboxes.
Automating Infrastructure Takedown and Ephemeral Operations
The presentation discusses operational security best practices for rotating infrastructure rapidly and leaving minimal forensic footprint.
Related talks
Adversary Village·13 min
Stephan Wampouille
Stephan Wampouille demonstrates autonomous lateral movement in Linux networks, chaining benign system behaviors to traverse internal infrastructure undetected.
Main Track 1·37 min
MEATPISTOL
Open source modular framework for creating malware implants and automating C2 infrastructure.
Village Presentations·40 min
Adam Compton · Eric Gershman
Adam Compton and Eric Gershman introduce the SpeedPhishing Framework (SPF), automating target email harvesting, domain staging, and campaign deployment.