red-team-mastercourse
Free, up-to-date, full-spectrum red-team curriculum (fundamentals → AD → evasion → web → AI/LLM red teaming → AI-in-your-workflow). Consolidates Microsoft AI Red Team 101, Zero-Point Security RTO structure, OWASP GenAI/LLM Top 10, MITRE ATT&CK/ATLAS, and the free lab ecosystem. Every module has real commands/code and a mapped free lab. Includes a hard ethical boundary (authorized-only, no attribution evasion).
Resources
5Install
npx skillscat add albashmohandes/red-team-mastercourse Install via the SkillsCat registry.
Red Team Mastercourse (Free, Current, Full-Spectrum)
A single self-contained curriculum that covers what the best paid red-team courses teach
(Zero-Point Security RTO / CRTO / OSEP / SANS) using only free material, then adds the
AI/LLM red-team track and AI-in-your-workflow that legacy courses omit.
⚠️ AUTHORIZED USE ONLY. Every technique here is for systems you have written permission
to test. This course refuses attribution evasion (no IP spoofing, no Tor-to-hide, no
traffic morphing). Low-and-slow polite scanning and local isolation are allowed OPSEC.
How to use this skill
Load with skill_view(name='red-team-mastercourse'). Each module is a reference file:
references/00-setup.md— Kali + lab build, tool install, ethics/legal, OPSEC baselinereferences/01-fundamentals.md— Linux, networking, Python, AD, PowerShellreferences/02-recon.md— OSINT, subdomain/port scan, web fuzz, JS/secret huntingreferences/03-initial-access.md— phishing, payloads, spraying, Metasploit, CVEsreferences/04-c2.md— Sliver / Havoc / Mythic setup, implants, OPSEC profilesreferences/05-post-exploitation.md— enumeration, privesc, creds, persistencereferences/06-ad-attacks.md— Kerberos suite, DCSync, ADCS, GPO, BloodHound, forestsreferences/07-evasion.md— EDR/AV, AMSI, LOLBins, AppLocker, OPSEC failuresreferences/08-web-app.md— OWASP Web Top 10 2021 + live payloads + PortSwigger mapreferences/09-ai-redteam.md— OWASP LLM Top 10, prompt injection, PyRIT/garak/deepteamreferences/10-ai-integration.md— LLM triage, report gen, red-team copilot, Ollamareferences/11-reporting-career.md— RoE, ATT&CK mapping, purple teaming, cert roadmapscripts/— runnable Python/shell for your Kali box (authorized targets only)
Interactive course platform (NEW — 80% practical)
A portable offline web app that turns the above into a hands-on course with labs, gotchas,
alternative tools, verify checklists, per-module quizzes, progress tracking, and a capstone exam.
Located at templates/platform/:
templates/platform/index.html— open it (orpython3 -m http.server 8080inside the folder)templates/platform/assets/app.js— UI engine (sidebar, localStorage progress, quiz grading, capstone cert)templates/platform/assets/style.css— dark themetemplates/platform/data/index.js— course metadata + capstonetemplates/platform/data/m0.js … m11.js— the 12 modules, each with:- a real-world scenario + objective + estimated time
- prereq (forgotten-basics links into references/)
- visuals (ASCII mental-model diagrams)
- 2–3 labs with exact commands, expected output, Gotchas (real errors + fixes), Alternative tools
- scenarios (alternate real-world contexts)
- a Verify checklist (prove you did it, not just read it)
- a scenario-based quiz AND a cert-style assessment (pass 70%), both graded in-browser
- certmap (which industry cert it maps to) + interview questions
templates/platform/data/deep/m0.js … m11.js— the Detailed Walkthroughs: 3–6 long-form sections per module with step-by-step explanation, exact commands, what the blue team detects, and pitfalls. This is the real instructional depth that makes the graduate job-ready.templates/platform/README.md— run + authoring guide
To launch on Kali: cd templates/platform && python3 -m http.server 8080 then open http://localhost:8080.
The scripts/ tools (recon_secret_hunter.py, ai_triage.py, report_gen.py, ai_redteam_scan.py)
are referenced and runnable from the labs.
Free resource master list (current 2025–2026; verify via install commands)
| Resource | Type | Cost | How to get |
|---|---|---|---|
| Microsoft AI Red Team 101 (10 eps + PyRIT labs) | Video + labs | Free | learn.microsoft.com/security/ai-red-team/training |
| OWASP GenAI / LLM Top 10 v1.1 | Standard | Free | genai.owasp.org, github.com/OWASP/www-project-top-10-for-large-language-model-applications |
| MITRE ATT&CK + ATLAS | Framework | Free | attack.mitre.org, atlas.mitre.org |
| TryHackMe (free rooms) | Range | Free tier | tryhackme.com (rooms: Intro to AD, Red Team, etc.) |
| HackTheBox (free + retired) | Range | Free tier | hackthebox.com |
| PicoCTF | Range | Free | picoctf.org |
| CyberDefenders | Range | Free + paid | cyberdefenders.org |
| PortSwigger Web Security Academy | Range | Free | portswigger.net/web-security |
| TCM Security PEH (free modules) | Course | Free | tcm-security.com |
| Google Cybersecurity Cert | Course | Free audit | Coursera audit mode |
| NIST NICE 65 exercises | Exercises | Free | csrc.nist.gov |
| PyRIT (Microsoft) | AI test tool | Free/OSS | github.com/Azure/PyRIT |
| garak (NVIDIA) | AI vuln scanner | Free/OSS | github.com/NVIDIA/garak |
| deepteam (Confident AI) | AI red-team eval | Free/OSS | github.com/confident-ai/deepteam |
| Sliver / Havoc / Mythic / Merlin | C2 | Free/OSS | github.com/BishopFox/sliver, github.com/HavocFramework/Havoc, github.com/its-a-feature/Mythic, github.com/Ne0nd0g/merlin |
Study roadmap (self-paced, ~16–24 weeks)
- Phase A: M0 + M1 (lab + fundamentals)
- Phase B: M2 → M3 → M4 → M5 (offense core)
- Phase C: M6 + M7 (AD depth + evasion)
- Phase D: M8 + M9 + M10 (web + AI)
- Phase E: M11 + capstone on a free range (e.g., THM "Intro to AD" / HTB.retired)
Ethical boundary (non-negotiable — same as ai-redteam-recon skill)
- Targets must have written authorization.
- NO attribution evasion: no IP spoofing, no anonymizing routing to hide from target, no traffic morphing.
- ALLOWED: polite low-and-slow rate-limited scanning, VM/container isolation, no phone-home, localhost-only GUIs.
- AI jailbreak material = taxonomy + defensive tooling (garak/deepteam/PyRIT) for authorized evaluation only. No live weaponized payloads.