By Charles Joseph | Cybersecurity Researcher

 Published on May 16th, 2024

Staying ahead of potential threats requires advanced penetration testing and red team tools. These tools are essential for simulating attacks, identifying vulnerabilities, and strengthening an organization’s defenses.

In this post, we’ll explore some of the industry’s most powerful and widely used tools, detailing their features, uses, and where to obtain them.

1. Cobalt Strike

Cobalt Strike is a commercial penetration testing tool developed by Raphael Mudge in 2012. Fortra, LLC (formerly HelpSystems) is the current owner. It simulates advanced persistent threat (APT) attacks, conducts red team operations, and performs post-exploitation activities.

Cobalt Strike offers features such as payload generation, network reconnaissance, and attack automation, making it a comprehensive tool for adversary simulations and security assessments. It also includes capabilities for command and control, lateral movement, and data exfiltration.

More information and purchase options are available at Cobalt Strike.

2. Metasploit

Metasploit, developed by Rapid7, is an open-source penetration testing framework to develop and execute exploit code against remote target machines. It is widely used by security researchers and penetration testers to discover and test vulnerabilities.

Metasploit includes a vast database of exploits, payloads, and auxiliary modules, and it supports tasks such as vulnerability scanning, exploitation, and post-exploitation. The framework’s extensibility and integration capabilities make it a versatile tool for security assessments.

More details can be found at Metasploit.

3. Interactsh HTTP

Interactsh is an open-source tool developed by ProjectDiscovery for interacting with HTTP endpoints. It is primarily used for identifying and testing HTTP-related vulnerabilities, such as server-side request forgery (SSRF) and other web-based attack vectors. Interactsh allows security professionals to interact with target systems through crafted HTTP requests and analyze responses to uncover potential security weaknesses.

For more information, visit the Interactsh GitHub repository.

4. Sliver

Sliver is an innovative project from Bishop Fox, designed as an open-source, cross-platform adversary emulation and red team framework. Primarily written in Go, Sliver targets Windows, Linux, and Mac systems, though Bishop Fox notes that compatibility may vary across different environments. The tool is known for supporting multi-user operations and multi-C2 channels, enhanced by robust encryption and pivoting capabilities. Its completely text-based interface may appeal to users who prefer a command-line experience.

The popularity of Sliver among red teamers and security enthusiasts is noteworthy. While Cobalt Strike continues to dominate the market, Sliver’s appeal is bolstered by its open-source and free nature, making it an accessible tool for many. This has made it a favored choice for adversary emulation and as a learning resource in the cybersecurity community.

Sliver’s dynamic payload generation for multiple platforms and its ability to establish persistence, spawn shells, and exfiltrate data highlights its versatility and effectiveness in penetration testing and red team operations.

Sliver supports various communication protocols, including HTTP, HTTPS, DNS, TCP, and WireGuard, ensuring flexible and stealthy C2 traffic. The Bishop Fox team, with over two decades of experience in offensive security, has ensured that Sliver is feature-rich and secure.

Their significant presence at DEFCON and other cybersecurity forums attests to their expertise and influence. Sliver’s GitHub repository, with 79 releases (as of 5/16/2024) and over 1,000 forks, reflects its active development and strong community support.

The tool’s advanced features include dynamic code generation, compile-time obfuscation, multiplayer mode, staged payloads, secure C2 channels, and asymmetric encryption keys.

Although the codebase is predominantly in Go, it also incorporates Python, C, Docker, Rust, and Makefile, showcasing a diverse technological foundation.

Users can execute specific commands to resolve common errors, such as the “connection to server failed context deadline exceeded” issue, ensuring smoother operations.

Operational commands within Sliver, such as “PS” for listing process IDs, “Get Privs” for retrieving process integrity levels, “Generate” for creating implant binaries, and “Shell” for starting a remote shell, provide comprehensive control over target systems.

Additional tools like User Account Control (UAC) bypasses, system process injection, and the Armory for downloading and installing extensions and aliases further enhance its functionality. However, users should be aware of potential challenges, such as detected default payloads by antivirus software like Windows Defender, necessitating careful planning and execution in real-world scenarios.

In summary, Sliver stands out as a powerful and flexible tool for adversary emulation and red team activities, supported by Bishop Fox’s extensive expertise. Its open-source nature and comprehensive feature set make it a valuable asset for professional and aspiring security practitioners.

For more information, visit the Sliver GitHub repository.

Sliver C2 Framework Review (Video)

5. GoPhish

GoPhish is an open-source phishing toolkit designed to help organizations conduct phishing campaigns and security awareness training. It provides a user-friendly interface for creating and managing phishing emails, landing pages, and campaigns. GoPhish is used by security teams to simulate phishing attacks, assess employee susceptibility, and improve overall security awareness. The tool is easy to set up and use, making it accessible for organizations of all sizes.

More information can be found at GoPhish.

6. Mythic

Mythic is an open-source, cross-platform command and control (C2) framework for red team operations and adversary emulation. Developed to provide a highly customizable and modular approach to C2, Mythic supports multiple programming languages and communication protocols. It includes implant management, tasking, and operational security features, making it suitable for complex red team engagements.

More details are available on the Mythic GitHub repository.

7. Covenant

Covenant is an open-source .NET command and control (C2) framework for red team engagements and post-exploitation activities. It provides a web-based interface for managing implants, executing commands, and monitoring operations. Covenant supports advanced features such as encrypted communication, task scheduling, and module integration, making it a powerful tool for adversary simulations and security testing.

For more information, visit the Covenant GitHub repository.

8. PoshC2

PoshC2 is an open-source command and control (C2) framework developed by Nettitude. It is used for command and control operations, post-exploitation, and red team exercises. PoshC2 supports various communication channels, including HTTP/S, DNS, and TCP, and offers features such as implant management, task automation, and operational security. It is designed to be highly extensible and adaptable to different operational needs.

More information can be found at PoshC2.

9. BRC4

BRC4 is a commercial red teaming tool. It’s used for advanced adversary simulation, red team operations, and threat emulation. BRC4 provides a comprehensive set of features for attack simulation, including payload generation, network reconnaissance, and lateral movement. It aims to help organizations test and improve their security defenses against sophisticated cyber threats. More information and purchase options are available at BRC4.

10. Empire

Empire is an open-source post-exploitation framework for red team operations, post-exploitation, and adversary emulation. It provides a modular architecture for managing implants, executing commands, and maintaining persistence on target systems. Empire supports various communication protocols and includes features for operational security and evasion. It is widely used by security professionals to simulate advanced attack scenarios and improve defense strategies.

More details are available on the Empire GitHub repository.

11. Deimos

Deimos is an open-source command and control (C2) framework for command and control operations and red team activities. It provides a flexible and scalable platform for managing implants, executing tasks, and conducting post-exploitation activities. Deimos supports multiple communication channels and offers features for operational security and evasion. It is designed to help security professionals simulate realistic attack scenarios and test their defenses.

More information can be found on the Deimos GitHub repository.