--- title: "Advanced Penetration Testing & Red Team · VORNAC Research" description: "Past the OWASP basics: chained exploitation, air-gapped lab setup for payload trials, and the operating notes for full-scope adversary simulation." url: https://www.vornac.com/en/research/offensive-tradecraft/advanced-pentest-and-redteam lang: en published: 2026-06-02 updated: 2026-06-02 alternate_de: https://www.vornac.com/research/offensive-tradecraft/advanced-pentest-and-redteam --- [Research Index](https://www.vornac.com/en/research) / [1 · Offensive Tradecraft](https://www.vornac.com/en/research/offensive-tradecraft) / Advanced Penetration Testing & Red Team Featured · [1 Offensive Tradecraft](https://www.vornac.com/en/research/offensive-tradecraft) # Advanced Penetration Testing & Red Team. Past the OWASP basics: chained exploitation, air-gapped lab setup for payload trials, and the operating notes for full-scope adversary simulation. ## Chain patterns we see in production - **Info disclosure → deserialization → RCE.** Stack trace leaks Java framework version; ysoserial CommonsCollections1 against the exposed RMI/JMX endpoint; shell as the app-server user. - **SSRF → cloud IAM compromise.** Web app fetches user-supplied URL; fetch `http://169.254.169.254/latest/meta-data/iam/security-credentials/`; assume the role; pivot via `aws sts assume-role` across trust relationships. - **LDAP injection → AD enumeration → Kerberoast.** Login form passes `(uid=*)` unfiltered into LDAP filter; enumerate users; spray weak passwords; Kerberoast surviving service accounts. - **Subdomain takeover → cookie scope abuse.** Dangling CNAME to a deprovisioned SaaS; register the SaaS resource; set cookies under the parent domain; session-fixation against authenticated users. - **Cache poisoning → stored XSS → admin takeover.** Unkeyed header reflected into cached response; poison the admin-panel HTML; admin browser executes payload; privilege escalation via admin-only IDOR. ## Lab discipline for payload development - **Hypervisor pinning.** ESXi or Proxmox host, no internet-facing management. VLAN tagging at the switch, not the VM. Never trust VM-level isolation alone. - **Three-tier topology.** Build network (internet), staging network (mirrors target tech stack), payload network (air-gapped, all outbound dropped at the gateway). - **Snapshot before every run.** Power off, snapshot, power on. Revert after each test cycle. Snapshots are cheap; not having one is expensive. - **Out-of-band C2 only.** Lab payloads use lab callback hosts only. Production C2 infrastructure never touches lab payloads — separate certs, separate domains, separate VPS. ## Red team operating model - **Objectives in writing.** "Reach the SAP database" or "demonstrate access to the wire-transfer system" — never "find vulnerabilities". - **White cell.** Trusted client contact who knows the engagement is live, available 24/7 for deconfliction. Phone + Signal, not email. - **Evasion budget.** Tolerated IOC count agreed upfront. EDR alerts above the budget = pause and reassess, not escalate. - **After-action.** Joint replay with the blue team. Walk every step, every alert that fired, every alert that should have fired. The engagement's value is in this session, not in the PDF. **Rule of thumb**Chains compound. Two medium findings can produce a critical. Always sketch what each finding could chain into before triaging severity in isolation. Domain [1 · Offensive Tradecraft](https://www.vornac.com/en/research/offensive-tradecraft) Tier Featured Engagement phases MethodologyKnown CVEsReporting Published 2 June 2026 Looking up an acronym? [Open the Glossary](https://www.vornac.com/en/glossary) ## Related notes in this domain - [Featured Comprehensive Pentest Reference](https://www.vornac.com/en/research/offensive-tradecraft/comprehensive-pentest-reference) - [Featured Pentest Methodology — Canonical Reference](https://www.vornac.com/en/research/offensive-tradecraft/pentest-methodology-canon) - [Featured Recon & Discovery](https://www.vornac.com/en/research/offensive-tradecraft/recon-and-discovery) - [Featured Web Server — Attack & Defense](https://www.vornac.com/en/research/offensive-tradecraft/web-server-attack-defense) - [Featured Active Directory Pentest](https://www.vornac.com/en/research/offensive-tradecraft/active-directory-pentest) - [Featured Internal Pivoting & Lateral Movement](https://www.vornac.com/en/research/offensive-tradecraft/internal-pivoting) - [Reference Recon Tooling — Operator Reference](https://www.vornac.com/en/research/offensive-tradecraft/recon-tooling) - [Reference Operator Toolkits — Catalog & Reference](https://www.vornac.com/en/research/offensive-tradecraft/operator-toolkits) - [Reference Automation vs. Manual Testing](https://www.vornac.com/en/research/offensive-tradecraft/automation-vs-manual) - [Background Social Engineering & Phishing](https://www.vornac.com/en/research/offensive-tradecraft/social-engineering-phishing) - [Background Pentester Foundations & CTF Practice](https://www.vornac.com/en/research/offensive-tradecraft/pentester-foundations) [Previous note Pentest Methodology — Canonical Reference](https://www.vornac.com/en/research/offensive-tradecraft/pentest-methodology-canon) [Back to domain](https://www.vornac.com/en/research/offensive-tradecraft) [Next note Recon & Discovery](https://www.vornac.com/en/research/offensive-tradecraft/recon-and-discovery) From reference to evidence ## Run this against your own environment.