Advanced Redteam

This is a serious offensive security reference covering C2 infrastructure hardening, redirector architecture, and operational security discipline for extended engagements. You get concrete guidance on never exposing team servers directly (always bind localhost, tunnel through Cloudflare or websocat), building smart nginx redirectors that deflect blue team scanners to legitimate sites, and customizing malleable profiles to mimic real traffic like Teams or O365. The tiered infrastructure model is smart: burn high-reputation phishing domains fast, run active ops through short-haul HTTP beacons, and keep a separate long-haul DNS channel sleeping once a day for persistence. Staged payload thinking and LOLBin preference over powershell.exe show real world paranoia. Heavy on Cobalt Strike examples but the OPSEC principles transfer to any framework.

GitHub stars: 280
last updated: May 28, 2026

View on GitHub

Install

$ npx -y skills add hypnguyen1209/offensive-claude --skill advanced-redteam --agent claude-code

Installs into .claude/skills of the current project.

Files

name: advanced-redteam-ops description: Use when designing C2 infrastructure or OPSEC for a long-haul red-team op — redirectors, malleable profiles, tiered/segregated infra, living-off-the-land, data exfiltration metadata: type: offensive phase: operations kill_chain: phase: [c2, actions] step: [6, 7] attck_tactics: [TA0011, TA0008, TA0010] depends_on: [edr-evasion, exploit-development, red-team-ops] feeds_into: [threat-hunting] inputs: [c2_framework, redirector_config] outputs: [c2_infrastructure, opsec_report, exfil_channel]

Advanced Red Team Operations

When to Activate

Planning advanced red team engagements
Designing C2 infrastructure with OPSEC
Understanding APT TTPs and operational security
Long-term persistent access scenarios

C2 Infrastructure Design

Redirectors (Never Expose Team Server Directly)

Rule: Team server ONLY binds to localhost. NEVER bind to 0.0.0.0 or external interface.

# Cobalt Strike team server (bind locally)
./TeamServerImage -Dcobaltstrike.server_port=50050 \
  -Dcobaltstrike.server_bindto=127.0.0.1 \
  -Djavax.net.ssl.keyStore=./cobaltstrike.store \
  teamserver 127.0.0.1 <password>

SKILL.md on GitHub