Getting Started with Cobalt Strike

In the previous chapters, we have covered some great new tools and some lesser known techniques which could be very helpful in a Penetration Test. In general, a Penetration Tester is expected to find the vulnerabilities and exploit those vulnerabilities to achieve the highest level of access but in reality, very few can fulfil of whats expected of them. Many Penetration Testers won't be able to reach the final goal due to lack of knowledge and practical experience in topics such as post-exploitation, lateral movement, data exfiltration, and especially when new tools and techniques are being released almost on a daily basis. If we ask ourself, what could be the next level as a Penetration Tester? Our answer would be—a Red Teamer. ??A Penetration Tester starts from Ethical Hacking and moves up to the level where he/she can be called as a Penetration Tester but Cyber-criminals don't just do a generic penetration testing on their target. They rather, attack the organization with a harmful intent which led to mass data breaches and Cyber espionage.

To protect the organization, we need to understand the mindset of a Cyber criminal. We have to simulate a real cyber attack just to understand how devastating a cyber attack could be on the organization. That is 'Red Teaming' and this is one of the crucial differences between an effective red-team exercise and a penetration test. To perform a successful red team exercise, the objective, scope, scenario, and Rules of Engagement (RoE) for performing the exercise needs to be accurately laid out at the beginning of the exercise in order to simulate a real adversary and provide maximum value to the client and the stakeholders.

In this chapter, we will cover the following topics:

• Planning a red-team exercise
• Introduction to Cobalt Strike
• Cobalt Strike setup
• Cobalt Strike interface
• Customizing a team server