RedTeam-Agent

AI-Powered Autonomous Red Team Framework

Let AI become your security audit hacker

English | 简体中文 | Documentation | Quick Start

---

Overview

RedTeam-Agent is an AI-powered red team framework using a skill-first terminal workflow. AI reads project skills, discovers tools, executes commands in terminal, and summarizes high-signal findings.

Core philosophy: no manual tool-by-tool operation. Let AI orchestrate the workflow end-to-end.

Key Features

• Plug and play: 15+ tools with automated setup
• AI-driven workflow: Skill + terminal execution
• Token optimized: output filtering and file-first strategy
• AD coverage: BloodHound + impacket + Responder chain
• Multi-client support: Cursor, Claude Desktop, VS Code/Cline

---

Tool Matrix

Network

• gogo: fast asset discovery
• fscan: comprehensive host/service scan

Web

• httpx: HTTP probing and fingerprinting
• nuclei: template-based vulnerability validation
• ffuf: directory and parameter fuzzing

Active Directory

• SharpHound / bloodhound-python
• impacket (GetNPUsers, GetUserSPNs, secretsdump, ntlmrelayx, etc.)
• pywerview, ldapdomaindump

Lateral Movement

• nxc (NetExec)
• impacket-wmiexec
• impacket-psexec

---

Quick Start

1. Requirements

Python 3.8+
Windows 10/11 or Linux/macOS
8GB+ RAM recommended

2. Installation

git clone https://github.com/ktol1/RedTeam-Agent.git
cd RedTeam-Agent

python -m venv venv
# Windows PowerShell
.\venv\Scripts\Activate.ps1
# Linux/macOS
source venv/bin/activate

# Windows
python scripts/install_tools.py

# Linux/macOS
python scripts/install_tools_linux.py

3. Enable Skills Terminal Mode

No extra server setup is required.

cd RedTeam-Agent
dir .\tools

AI will read the repository skill and .github/copilot-instructions.md, then execute terminal commands directly.

4. Example Prompts

First load the redteam skill, then scan 192.168.1.0/24 in terminal,
write output to scan.txt, and summarize high-value findings.

Use SharpHound to collect corp.local data and summarize attack paths.

Set up a chisel proxy and provide upload/run commands.

---

AD Attack Flow

1. Recon: gogo / fscan / kerbrute / pywerview
2. Collection: SharpHound or bloodhound-python
3. Analysis: BloodHound GUI or scripts/bloodhound_analysis.py
4. Attack: Kerberoast / AS-REP Roast / secretsdump / relay
5. Lateral: nxc / wmiexec / psexec / getST

---

Terminal Commands (Skill-driven)