# Track 04 — Canon: Cybersecurity Red Team (Offensive Security Operations)

Cybersecurity red team 这个行业的 canon 在 master-skill 蒸馏目标里 结构与中医 / 法律 完全不同 — 它没有 千年古籍 / 国家敕编 / 院校规划教材 那种统一权威, 反而是 厂商 + 培训机构 + 会议 + 漏洞研究员个人博客 + 开源社区 + 政府标准 多元并存, 一手与二手的边界几乎完全不重合 PRIMARY_SUFFIX 白名单. 业内人 共识的 canon 大致分 10 层: (1) 奠基红队 + 渗透教材 (RTFM / The Hacker Playbook / Penetration Testing / Web App Hacker's Handbook / Hacking Art of Exploitation 等), (2) 现代 Active Directory + Windows 红队专著 + 博客 (SpecterOps BloodHound 谱系 + harmj0y + Sean Metcalf adsecurity.org + ired.team), (3) Web + API + GraphQL (OWASP Top 10 + WSTG + PortSwigger Academy + Bug Bounty Bootcamp), (4) Mobile (OWASP MASTG / MASVS + iOS / Android Hacker's Handbook), (5) Cloud + 容器 + K8s (Hacking the Cloud + Pacu + Prowler + Container Security + Kubernetes Security), (6) C2 + Post-ex + OPSEC (Cobalt Strike Operator's Manual + Sliver + Mythic + LOLBAS + SpecterOps OPSEC), (7) 漏洞研究 + 二进制 + Exploit dev (Shellcoder's Handbook + Art of Software Security Assessment + Practical Malware Analysis + Modern Binary Exploitation), (8) 官方标准 + Framework (MITRE ATT&CK / D3FEND / CWE / CAPEC + NIST 800-115 / 800-53 / CSF 2.0 + OWASP ASVS + PTES + OSSTMM + Kill Chain + Diamond Model), (9) 培训课程 syllabus (OffSec OSCP/OSEP/OSED/OSWE + SANS GPEN/GXPN + Zero-Point Security CRTO + Altered Security CRTP + HTB Academy + PortSwigger Academy), (10) 学术 + Conference 论文 (USENIX Security / IEEE S&P / ACM CCS / NDSS + Black Hat / DEF CON / OffensiveCon / Troopers 历年).

红队 canon 与蓝队 canon 行为差异巨大 — 蓝队 canon (NIST CSF / MITRE D3FEND / CIS Controls / Splunk SIEM 检测规则 / Sigma / Suricata / Zeek) 偏 detection / response 视角, .gov / .org 一手占主导; 红队 canon 反过来 — 攻击视角的最一手内容大量在 **个人研究员博客 (.com)** + **培训机构 syllabus (.com)** + **会议视频 talks (.com / .org)** + **漏洞 PoC 仓库 (github.com)** 上, 几乎不在 .gov / .edu 白名单内. 例如 Active Directory 攻击的 "事实标准" canonical 内容只有三个地方: Sean Metcalf 的 **adsecurity.org**, SpecterOps 团队的 **specterops.io / posts.specterops.io**, 以及 harmj0y (Will Schroeder) 的 **harmj0y.net** — 这三个域名都是 .org / .com / .net, 在 source_verifier 的 PRIMARY_SUFFIX 自动识别下 全部判 secondary, 但行业共识就是 一手. 因此本 manifest 必须大量使用 `declared=surrogate_primary, auto=secondary; reason=vendor docs (作者一手研究)` literal 模式, 把这些 业内共识 一手 显式声明为 surrogate_primary, 才能让 manifest 反映 红队 canon 的真实权威分布.

框架 canon 同样吃这个亏 — MITRE ATT&CK 是全球红 / 蓝队事实上的标准词表, attack.mitre.org 是 一手, 但 .org 不在 PRIMARY_SUFFIX 白名单 (PRIMARY_SUFFIX 只识 .gov / .gov.cn / .gov.uk / .europa.eu / .edu / .edu.cn / .ac.cn / .ac.uk / arxiv.org / pubmed.gov / sci-hub.*), 因此 attack.mitre.org / d3fend.mitre.org / cwe.mitre.org / cve.mitre.org / capec.mitre.org 这 5 个 MITRE 一手域名 全部必须显式 `declared=surrogate_primary, auto=secondary; reason=vendor docs (协会 + 教材 + 监管)`. 同理 OWASP owasp.org / cheatsheetseries.owasp.org / wstg.owasp.org / mastg.owasp.org — OWASP 是全球 Web / API / Mobile 安全标准事实拥有者, 但 .org 不在白名单, 必须 surrogate. 真正能 auto-verify 的政府一手, 只剩 NIST csrc.nist.gov + NVD nvd.nist.gov + CISA cisa.gov + NCSC ncsc.gov.uk + ENISA enisa.europa.eu 这 5 大域名 + arxiv.org 学术 preprints, 因此本 manifest 的 verified_primary 比例预期在 15-25%, surrogate_primary 在 75-85%, 这是 红队 canon 行业客观结构, 不是 manifest 质量问题.

培训 syllabus 层是 红队 canon 的另一个特色 — 红队岗位的 实战能力 主要靠 实验室 lab + 认证 cert 驱动, 不靠 学位. 全球 红队事实认证体系 = OffSec (OSCP / OSEP / OSED / OSWE / OSWA / OSEE) + SANS GIAC (GPEN / GXPN / GMOB / GAWN / GCPN) + Zero-Point Security (CRTO / CRTL Cobalt Strike 路径) + Altered Security (CRTP / CRTE / CRTM Active Directory 路径) + EC-Council (CEH 入门, 业内争议较多) + HTB Academy (CPTS / CBBH / CWEE) + PortSwigger Academy (免费但 syllabus 是 Web 标杆). 这些都是 .com / .org 商业培训机构, syllabus + 教材 必须 `vendor docs (cert org syllabus + 教材)` literal. 实验室平台 hackthebox.com / tryhackme.com / pentesterlab.com / vulnhub.com 同 `vendor docs (lab syllabus)`. 国内自主有 安全客 anquanke.com / FreeBuf freebuf.com / 看雪 kanxue.com / 知道创宇 paper.seebug.org / 阿里先知 xz.aliyun.com / 腾讯玄武 tttang.com 等 安全社区, 这些是中国红队的 一手研究承载, 但 .com / .cn 域名 全部 surrogate, 必须 `vendor docs (中国安全社区)` literal (注意: 不能用 mp.weixin.qq.com / zhihu.com / csdn.net / cnblogs.com / jianshu.com 等公众号 / 知乎 / CSDN / 博客园 / 简书 — 即使是原作者发表 也黑名单).

学术论文层 — 红队相关的学术研究主要发表在 USENIX Security Symposium + IEEE Symposium on Security & Privacy (Oakland) + ACM CCS + NDSS Network and Distributed System Security Symposium 这 四大顶会, 以及 RAID / ESORICS / DSN / AsiaCCS 二线. USENIX usenix.org / IEEE ieeexplore.ieee.org / ACM dl.acm.org / NDSS ndss-symposium.org 全部 .org / .com / .ieee.org 不在 PRIMARY_SUFFIX, 必须 `vendor docs (协会 + 教材)` literal. 但 arxiv.org preprints 是 auto-verified primary, 大量 红队 / 攻防 / fuzzing / exploit 论文都有 arXiv 版本, 可以走 arXiv 一手. 行业会议 Black Hat (blackhat.com / i.blackhat.com whitepapers PDF 库) + DEF CON (defcon.org / media.defcon.org) + OffensiveCon (offensivecon.org) + CCC (media.ccc.de / events.ccc.de) + Troopers (troopers.de) + x33fcon (x33fcon.com) + ShmooCon (shmoocon.org) + Ekoparty (ekoparty.org) 全部 `vendor docs (会议)` literal.

伦理边界 anchor — 红队 canon 整个体系 把 authorization-only 边界 作为前置约束 写在框架最前面. **PTES (Penetration Testing Execution Standard)** Pre-engagement Interactions 第一节 就是 Scoping + Goals + Authorization + Engagement Letter; **NIST SP 800-115** Technical Guide to Information Security Testing 第 2 章 明确 written authorization before any testing; **OSSTMM 3** Rules of Engagement 把 RoE + Get-out-of-jail-free letter 列为必备文档; **OWASP Testing Guide** v4.2 序言 把 informed consent + scope + non-disruption 写在前; **OffSec OSCP Code of Ethics + SANS Penetration Tester Code of Ethics + EC-Council Code of Ethics** 三大主流认证 全部把 unauthorized testing 列为吊销认证条件; **Cobalt Strike + Sliver + Mythic** C2 商业 / 开源框架 的 EULA + LICENSE 全部明文 authorized engagements only. 本 canon 收录的所有教材 / syllabus / 课程 / 论文 / PoC 仓库 全部默认在 authorized red team / pentest / bug bounty (有 scope 文档) / CTF (合法 lab) 场景使用, 任何 unauthorized intrusion / 未授权扫描 / scope 外利用 都违反这 canon 体系本身定义的伦理底线. 本 manifest 不收录 任何 carding / 黑产 / leaked-data marketplace / "How I hacked X" 无授权个人复盘 类内容.

## Source Manifest

| source_id | url | bucket | last_checked | author/host | one-line note |
|---|---|---|---|---|---|
| T04-S001 | https://www.amazon.com/Rtfm-Red-Team-Field-Manual/dp/1075091837 | surrogate_primary | 2026-05-18 | Ben Clark / Amazon (self-published) | 《RTFM: Red Team Field Manual》v2 (Ben Clark 2022) — 红队命令速查圣经, Linux/Windows/Cisco/数据库/PowerShell/Python 一键参考, 业内人手一本 [declared=surrogate_primary, auto=secondary; reason=vendor docs (出版社 + 教材)] |
| T04-S002 | https://www.amazon.com/Hacker-Playbook-Practical-Guide-Penetration/dp/1494932636 | surrogate_primary | 2026-05-18 | Peter Kim / Secure Planet (self-published) | 《The Hacker Playbook 2: Practical Guide to Penetration Testing》(Peter Kim 2015) — pre-game/before snap/throw/lateral pass 橄榄球比喻, 教材化渗透方法论奠基 [declared=surrogate_primary, auto=secondary; reason=vendor docs (出版社 + 教材)] |
| T04-S003 | https://www.amazon.com/Hacker-Playbook-Practical-Penetration-Testing/dp/1980901759 | surrogate_primary | 2026-05-18 | Peter Kim / Secure Planet | 《The Hacker Playbook 3: Practical Guide to Penetration Testing — Red Team Edition》(Peter Kim 2018) — THP3 转向红队 + assume breach + 现代 AD + 物理 + 钓鱼 实战 [declared=surrogate_primary, auto=secondary; reason=vendor docs (出版社 + 教材)] |
| T04-S004 | https://nostarch.com/pentesting | surrogate_primary | 2026-05-18 | Georgia Weidman / No Starch Press nostarch.com | 《Penetration Testing: A Hands-On Introduction to Hacking》(Georgia Weidman 2014) — 入门 pentest 教材标杆, Kali + Metasploit + Wireshark + 缓冲区溢出 第一课 [declared=surrogate_primary, auto=secondary; reason=vendor docs (出版社 + 教材)] |
| T04-S005 | https://www.wiley.com/en-us/The+Web+Application+Hacker%27s+Handbook%3A+Finding+and+Exploiting+Security+Flaws%2C+2nd+Edition-p-9781118026472 | surrogate_primary | 2026-05-18 | Dafydd Stuttard / Marcus Pinto / Wiley | 《The Web Application Hacker's Handbook 2e》(Stuttard/Pinto 2011) — PortSwigger 创始人著, Web 安全 21 章圣经, OWASP Top 10 / 注入 / 会话 / 访问 / 客户端 全覆盖 [declared=surrogate_primary, auto=secondary; reason=vendor docs (出版社 + 教材)] |
| T04-S006 | https://nostarch.com/hacking2.htm | surrogate_primary | 2026-05-18 | Jon Erickson / No Starch Press nostarch.com | 《Hacking: The Art of Exploitation 2e》(Jon Erickson 2008) — C + 汇编 + 栈溢出 + shellcode + 网络嗅探 底层原理教材, 与 Live CD 配套 [declared=surrogate_primary, auto=secondary; reason=vendor docs (出版社 + 教材)] |
| T04-S007 | https://www.amazon.com/Operator-Handbook-Red-Blue-Purple/dp/B08QCNB7XV | surrogate_primary | 2026-05-18 | Joshua Picolet / Amazon (self-published) | 《Operator Handbook: Red Team + OSINT + Blue Team Reference》(Joshua Picolet 2020) — 123 主题 集成 RTFM/BTFM/OSINT 三合一速查 [declared=surrogate_primary, auto=secondary; reason=vendor docs (出版社 + 教材)] |
| T04-S008 | https://www.amazon.com/Red-Team-Development-Operations-Practical/dp/1075091837 | surrogate_primary | 2026-05-18 | Joe Vest / James Tubberville / SpecterOps | 《Red Team Development and Operations: A practical guide》(Vest/Tubberville 2020) — 红队建队 + Engagement Lifecycle + ROE + reporting + metrics, SpecterOps 课程教材 [declared=surrogate_primary, auto=secondary; reason=vendor docs (作者一手 + 教材)] |
| T04-S009 | https://www.wiley.com/en-us/Tribe+of+Hackers+Red+Team%3A+Tribal+Knowledge+from+the+Best+in+Offensive+Cybersecurity-p-9781119643326 | surrogate_primary | 2026-05-18 | Marcus J. Carey / Jennifer Jin / Wiley | 《Tribe of Hackers Red Team: Tribal Knowledge from the Best in Offensive Cybersecurity》(Carey/Jin 2019) — 47 位顶尖红队人员访谈, 入行 / 工具 / 心态 / OPSEC / 职业 [declared=surrogate_primary, auto=secondary; reason=vendor docs (出版社 + 教材)] |
| T04-S010 | https://nostarch.com/blackhatpython2E | surrogate_primary | 2026-05-18 | Justin Seitz / Tim Arnold / No Starch | 《Black Hat Python: Python Programming for Hackers and Pentesters 2e》(Seitz/Arnold 2021) — Python 红队工具开发 + 网络嗅探 + Web hooking + Trojan + 取证规避 [declared=surrogate_primary, auto=secondary; reason=vendor docs (出版社 + 教材)] |
| T04-S011 | https://adsecurity.org/?page_id=1821 | surrogate_primary | 2026-05-18 | Sean Metcalf / Trimarc adsecurity.org | Active Directory Security Resources by Sean Metcalf — 全球 AD 攻防事实参考, Kerberoasting / Golden Ticket / Silver Ticket / DCSync / Mimikatz / Trust Attack 系列长文 [declared=surrogate_primary, auto=secondary; reason=vendor docs (作者一手研究)] |
| T04-S012 | https://posts.specterops.io/ | surrogate_primary | 2026-05-18 | SpecterOps Team / Medium posts.specterops.io | SpecterOps Blog (Medium) — BloodHound 创始团队官方博客, Attack Path Management + OPSEC + Cobalt Strike + AD CS Certified Pre-Owned 系列 [declared=surrogate_primary, auto=secondary; reason=vendor docs (作者一手研究)] |
| T04-S013 | https://specterops.io/resources/research-and-development/ | surrogate_primary | 2026-05-18 | SpecterOps specterops.io | SpecterOps Research & Whitepapers — Certified Pre-Owned (AD CS) / SCCM Sharp / Misconfiguration Manager / BloodHound Enterprise 官方白皮书 [declared=surrogate_primary, auto=secondary; reason=vendor docs (作者一手研究)] |
| T04-S014 | https://blog.harmj0y.net/ | surrogate_primary | 2026-05-18 | Will Schroeder (harmj0y) harmj0y.net | harmj0y Blog — Empire / PowerView / Kerberoasting / GhostPack / SeManageVolumePrivilege / ACL Path 等 AD 攻击原创研究, SpecterOps 联合创始人 [declared=surrogate_primary, auto=secondary; reason=vendor docs (作者一手研究)] |
| T04-S015 | https://www.ired.team/ | surrogate_primary | 2026-05-18 | Mantvydas Baranauskas / ired.team | ired.team — Red Teaming Experiments 笔记库, AD / Cred Access / Lateral Movement / Persistence / Defense Evasion / C2 / Cobalt Strike 大量动手实验 [declared=surrogate_primary, auto=secondary; reason=vendor docs (作者一手研究)] |
| T04-S016 | https://book.hacktricks.wiki/en/index.html | surrogate_primary | 2026-05-18 | Carlos Polop / HackTricks book.hacktricks.wiki | HackTricks Book (Carlos Polop) — Pentest / Red Team / CTF 知识百科, Linux/Windows/AD/Cloud/Mobile/Pentesting Methodology 全覆盖, 业内 cheat-sheet 事实标准 [declared=surrogate_primary, auto=secondary; reason=vendor docs (作者一手研究)] |
| T04-S017 | https://cloud.hacktricks.wiki/en/index.html | surrogate_primary | 2026-05-18 | Carlos Polop / HackTricks Cloud cloud.hacktricks.wiki | HackTricks Cloud — AWS / GCP / Azure / K8s / Workspace 攻击方法 cheat sheet, 与 PEASS-ng 配套 [declared=surrogate_primary, auto=secondary; reason=vendor docs (作者一手研究)] |
| T04-S018 | https://www.trustedsec.com/blog/ | surrogate_primary | 2026-05-18 | TrustedSec (Dave Kennedy 等) trustedsec.com | TrustedSec Blog — SET (Social Engineering Toolkit) 起源团队, Red Team / SE / AD / Cloud / IR 一手研究 [declared=surrogate_primary, auto=secondary; reason=vendor docs (作者一手研究)] |
| T04-S019 | https://byt3bl33d3r.github.io/ | surrogate_primary | 2026-05-18 | Marcello Salvati (byt3bl33d3r) | byt3bl33d3r Blog — CrackMapExec / NetExec / DeathStar / MITM6 / SILENTTRINITY 作者, AD / SMB / 网络侧攻击 原创 [declared=surrogate_primary, auto=secondary; reason=vendor docs (作者一手研究)] |
| T04-S020 | https://www.hackingarticles.in/ | surrogate_primary | 2026-05-18 | Raj Chandel / Ignite Technologies hackingarticles.in | Hacking Articles — CTF writeup + AD lab walkthrough + Privilege Escalation cheat sheet 大量动手教程 [declared=surrogate_primary, auto=secondary; reason=vendor docs (作者一手研究)] |
| T04-S021 | https://owasp.org/www-project-top-ten/ | surrogate_primary | 2026-05-18 | OWASP Foundation owasp.org | OWASP Top 10 (2021) — A01:2021 Broken Access Control / A02 Crypto Failures / A03 Injection / A04 Insecure Design / ... / A10 SSRF, Web 风险全球事实清单 [declared=surrogate_primary, auto=secondary; reason=vendor docs (协会 syllabus 教材)] |
| T04-S022 | https://owasp.org/API-Security/editions/2023/en/0x11-t10/ | surrogate_primary | 2026-05-18 | OWASP API Security Project owasp.org | OWASP API Security Top 10 (2023) — API1 BOLA / API2 Broken Authn / API3 BOPLA / API4 Resource Consumption / API5 BFLA / ... / API10 Unsafe API Consumption [declared=surrogate_primary, auto=secondary; reason=vendor docs (协会 syllabus 教材)] |
| T04-S023 | https://owasp.org/www-project-web-security-testing-guide/v42/ | surrogate_primary | 2026-05-18 | OWASP WSTG Project owasp.org | OWASP Web Security Testing Guide v4.2 — 12 大测试域 (Info Gather / Config / Identity / Authn / Authz / Session / Input / Error / Crypto / Business Logic / Client / API), 渗透 checklist 事实标准 [declared=surrogate_primary, auto=secondary; reason=vendor docs (协会 syllabus 教材)] |
| T04-S024 | https://cheatsheetseries.owasp.org/ | surrogate_primary | 2026-05-18 | OWASP Cheat Sheet Series cheatsheetseries.owasp.org | OWASP Cheat Sheet Series — Authentication / Session Management / Input Validation / XSS Prevention / SQL Injection Prevention / SSRF 100+ 单主题 cheat sheet [declared=surrogate_primary, auto=secondary; reason=vendor docs (协会 syllabus 教材)] |
| T04-S025 | https://owasp.org/www-project-application-security-verification-standard/ | surrogate_primary | 2026-05-18 | OWASP ASVS Project owasp.org | OWASP Application Security Verification Standard v4.0.3 — L1/L2/L3 三级 286 项验证清单, 渗透 / 代码审计 / SDLC 通用 baseline [declared=surrogate_primary, auto=secondary; reason=vendor docs (协会 syllabus 教材)] |
| T04-S026 | https://portswigger.net/web-security | surrogate_primary | 2026-05-18 | PortSwigger Research portswigger.net | PortSwigger Web Security Academy — 免费 240+ lab 涵盖 SQLi / XSS / CSRF / SSRF / XXE / LFI / 反序列化 / OAuth / JWT / GraphQL / WebSocket / 缓存投毒 / HTTP/2 走私, Web 渗透事实 syllabus [declared=surrogate_primary, auto=secondary; reason=vendor docs (协会 + syllabus + 教材)] |
| T04-S027 | https://portswigger.net/research | surrogate_primary | 2026-05-18 | PortSwigger Research portswigger.net | PortSwigger Research — James Kettle / Gareth Heyes 原创研究, HTTP Request Smuggling / Web Cache Deception / Server-Side Prototype Pollution / Browser-Powered Desync 系列 Black Hat 论文 [declared=surrogate_primary, auto=secondary; reason=vendor docs (作者一手研究)] |
| T04-S028 | https://nostarch.com/bug-bounty-bootcamp | surrogate_primary | 2026-05-18 | Vickie Li / No Starch nostarch.com | 《Bug Bounty Bootcamp: The Guide to Finding and Reporting Web Vulnerabilities》(Vickie Li 2021) — bug bounty 入门到进阶, recon / Web / 移动 / API / Source Code Review + reporting [declared=surrogate_primary, auto=secondary; reason=vendor docs (出版社 + 教材)] |
| T04-S029 | https://nostarch.com/bughunting | surrogate_primary | 2026-05-18 | Peter Yaworski / No Starch nostarch.com | 《Real-World Bug Hunting: A Field Guide to Web Hacking》(Peter Yaworski 2019) — 真实 bug bounty 案例集, HackerOne 公开报告精选 [declared=surrogate_primary, auto=secondary; reason=vendor docs (出版社 + 教材)] |
| T04-S030 | https://mas.owasp.org/MASTG/ | surrogate_primary | 2026-05-18 | OWASP MASTG Project mas.owasp.org | OWASP Mobile Application Security Testing Guide (MASTG) v1.7+ — iOS + Android 测试方法学 + 工具 (Frida / Objection / MobSF) + reverse engineering + tampering [declared=surrogate_primary, auto=secondary; reason=vendor docs (协会 syllabus 教材)] |
| T04-S031 | https://mas.owasp.org/MASVS/ | surrogate_primary | 2026-05-18 | OWASP MASVS Project mas.owasp.org | OWASP Mobile Application Security Verification Standard (MASVS) v2.1 — Storage / Crypto / Authn / Network / Platform / Code / Resilience 7 类移动 baseline [declared=surrogate_primary, auto=secondary; reason=vendor docs (协会 syllabus 教材)] |
| T04-S032 | https://www.wiley.com/en-us/Android+Hacker%27s+Handbook-p-9781118608647 | surrogate_primary | 2026-05-18 | Joshua Drake 等 / Wiley | 《Android Hacker's Handbook》(Drake / Lanier / Mulliner / Fora 2014) — Android 安全模型 + Dalvik / ART + Binder + Stagefright + 内核 root + 攻防 [declared=surrogate_primary, auto=secondary; reason=vendor docs (出版社 + 教材)] |
| T04-S033 | https://www.wiley.com/en-us/iOS+Hacker%27s+Handbook-p-9781118204122 | surrogate_primary | 2026-05-18 | Charlie Miller 等 / Wiley | 《iOS Hacker's Handbook》(Miller / Blazakis / Daiezovi / Esser / Iozzo / Weinmann 2012) — iOS 内核 / 沙箱 / 代码签名 / Mach-O / JIT / ROP / 越狱内幕 [declared=surrogate_primary, auto=secondary; reason=vendor docs (出版社 + 教材)] |
| T04-S034 | https://hackingthe.cloud/ | surrogate_primary | 2026-05-18 | wide-community / hackingthe.cloud | Hacking The Cloud — AWS / Azure / GCP 攻击技术 + IAM 滥用 + Lateral / Persistence / Exfil + Defense Evasion 社区维护知识库 [declared=surrogate_primary, auto=secondary; reason=vendor docs (作者一手研究)] |
| T04-S035 | https://github.com/RhinoSecurityLabs/pacu | surrogate_primary | 2026-05-18 | Rhino Security Labs / GitHub | Pacu — AWS exploitation framework (Spencer Gietzen / Rhino Security), 渗透 AWS 事实工具 + 80+ 攻击模块 + 文档 [declared=surrogate_primary, auto=secondary; reason=vendor docs (作者一手研究)] |
| T04-S036 | https://docs.prowler.com/ | surrogate_primary | 2026-05-18 | Prowler ProJect / Toni de la Fuente | Prowler — AWS / GCP / Azure / K8s 安全审计 + CSPM 工具, 500+ 检查覆盖 CIS / NIST / PCI / HIPAA / ISO27001, 红队作为 misconfig 侦察工具 [declared=surrogate_primary, auto=secondary; reason=vendor docs (作者一手研究)] |
| T04-S037 | https://www.oreilly.com/library/view/container-security/9781492056690/ | surrogate_primary | 2026-05-18 | Liz Rice / O'Reilly | 《Container Security: Fundamental Technology Concepts that Protect Containerized Applications》(Liz Rice 2020) — Linux 容器原理 + Docker / runc 攻防 + 镜像供应链 + 网络隔离 [declared=surrogate_primary, auto=secondary; reason=vendor docs (出版社 + 教材)] |
| T04-S038 | https://www.oreilly.com/library/view/hacking-kubernetes/9781492081722/ | surrogate_primary | 2026-05-18 | Andrew Martin / Michael Hausenblas / O'Reilly | 《Hacking Kubernetes: Threat-Driven Analysis and Defense》(Martin/Hausenblas 2021) — K8s 攻击面 + Pod security + RBAC + Network policy + 供应链 + 红队视角 [declared=surrogate_primary, auto=secondary; reason=vendor docs (出版社 + 教材)] |
| T04-S039 | https://attack.mitre.org/ | surrogate_primary | 2026-05-18 | MITRE Corporation attack.mitre.org | MITRE ATT&CK Enterprise (v14+) — 14 战术 (Recon / Resource Dev / Initial Access / Execution / Persistence / Privesc / Defense Evasion / Cred Access / Discovery / Lateral / Collection / C2 / Exfil / Impact) + 600+ 技术 + APT Group / Software 映射 [declared=surrogate_primary, auto=secondary; reason=vendor docs (协会 + 教材 + 监管)] |
| T04-S040 | https://attack.mitre.org/matrices/mobile/ | surrogate_primary | 2026-05-18 | MITRE Corporation attack.mitre.org | MITRE ATT&CK Mobile — Android + iOS 移动威胁矩阵, 14 战术 + 100+ 移动专属技术 [declared=surrogate_primary, auto=secondary; reason=vendor docs (协会 + 教材 + 监管)] |
| T04-S041 | https://attack.mitre.org/matrices/ics/ | surrogate_primary | 2026-05-18 | MITRE Corporation attack.mitre.org | MITRE ATT&CK for ICS — 工业控制系统 OT 攻击矩阵, Inhibit Response Function / Impair Process Control / Damage to Property 等 ICS 专属战术 [declared=surrogate_primary, auto=secondary; reason=vendor docs (协会 + 教材 + 监管)] |
| T04-S042 | https://d3fend.mitre.org/ | surrogate_primary | 2026-05-18 | MITRE Corporation d3fend.mitre.org | MITRE D3FEND — 防御技术知识图谱 (Harden / Detect / Isolate / Deceive / Evict), 与 ATT&CK 配对 红蓝紫队映射 [declared=surrogate_primary, auto=secondary; reason=vendor docs (协会 + 教材 + 监管)] |
| T04-S043 | https://cwe.mitre.org/ | surrogate_primary | 2026-05-18 | MITRE Corporation cwe.mitre.org | MITRE CWE (Common Weakness Enumeration) — 软件 / 硬件弱点分类法 940+ CWE, CWE Top 25 + OWASP Top 10 映射, 漏洞分类事实标准 [declared=surrogate_primary, auto=secondary; reason=vendor docs (协会 + 教材 + 监管)] |
| T04-S044 | https://capec.mitre.org/ | surrogate_primary | 2026-05-18 | MITRE Corporation capec.mitre.org | MITRE CAPEC (Common Attack Pattern Enumeration and Classification) — 500+ 攻击模式分类, 与 CWE / ATT&CK 双向映射 [declared=surrogate_primary, auto=secondary; reason=vendor docs (协会 + 教材 + 监管)] |
| T04-S045 | https://csrc.nist.gov/pubs/sp/800/115/final | verified_primary | 2026-05-18 | NIST csrc.nist.gov | NIST SP 800-115 Technical Guide to Information Security Testing and Assessment (2008) — Discovery / Identification / Vulnerability Assessment / Penetration Testing 4 阶段 + Rules of Engagement 模板, 美国联邦渗透标准 |
| T04-S046 | https://csrc.nist.gov/pubs/sp/800/53/r5/upd1/final | verified_primary | 2026-05-18 | NIST csrc.nist.gov | NIST SP 800-53 Rev 5 Security and Privacy Controls for Information Systems (2020 + 2023 update) — 1000+ 控制项 20 族, CA-8 Penetration Testing / RA-5 Vulnerability Scanning 红队映射 |
| T04-S047 | https://csrc.nist.gov/pubs/cswp/29/the-nist-cybersecurity-framework-csf-20/final | verified_primary | 2026-05-18 | NIST csrc.nist.gov | NIST Cybersecurity Framework (CSF) 2.0 (2024-02-26) — Govern / Identify / Protect / Detect / Respond / Recover 6 功能, 红队 PR.PT-1 / DE.CM-8 / RS.AN-5 直接映射 |
| T04-S048 | https://nvd.nist.gov/ | verified_primary | 2026-05-18 | NIST NVD nvd.nist.gov | NIST National Vulnerability Database — CVE + CVSS v3.1/v4.0 + CPE + CWE 关联, 200,000+ CVE 一手权威库, 红队 exploit 链建模 + 漏洞 priority |
| T04-S049 | https://www.cisa.gov/known-exploited-vulnerabilities-catalog | verified_primary | 2026-05-18 | CISA cisa.gov | CISA Known Exploited Vulnerabilities (KEV) Catalog — 已被在野利用的 CVE 清单 1000+ 条, 美国联邦 BOD 22-01 强制修补, 红队优先验证清单 |
| T04-S050 | https://www.ncsc.gov.uk/collection/penetration-testing | verified_primary | 2026-05-18 | NCSC UK ncsc.gov.uk | NCSC UK Penetration Testing Guidance — 英国国家网络安全中心渗透测试官方指南, scoping / CHECK / CREST 认证体系 + 报告标准 |
| T04-S051 | https://www.enisa.europa.eu/topics/incident-response/glossary/red-team-blue-team | surrogate_primary | 2026-05-18 | ENISA enisa.europa.eu | ENISA Threat Landscape / Red Team Blue Team 框架 — 欧盟网络安全局红队术语 + TIBER-EU (Threat Intelligence-based Ethical Red-Teaming) 金融机构红队框架 [declared=surrogate_primary, auto=secondary; reason=vendor docs (协会 + 监管 — ENISA 欧盟网络安全局, .europa.eu 不在 auto-verify 后缀)] |
| T04-S052 | http://www.pentest-standard.org/index.php/Main_Page | surrogate_primary | 2026-05-18 | PTES Team pentest-standard.org | Penetration Testing Execution Standard (PTES) — Pre-engagement / Intel Gathering / Threat Modeling / Vuln Analysis / Exploitation / Post-exploitation / Reporting 7 阶段, 与 PTES Technical Guidelines 配套 [declared=surrogate_primary, auto=secondary; reason=vendor docs (协会 + 教材)] |
| T04-S053 | https://www.isecom.org/OSSTMM.3.pdf | surrogate_primary | 2026-05-18 | ISECOM isecom.org | OSSTMM 3 (Open Source Security Testing Methodology Manual) — Pete Herzog 主编, 10 个 channel (Human / Physical / Wireless / Telecomm / Data Network) + RoE + RAV 评分 [declared=surrogate_primary, auto=secondary; reason=vendor docs (协会 + 教材)] |
| T04-S054 | https://www.lockheedmartin.com/en-us/capabilities/cyber/cyber-kill-chain.html | surrogate_primary | 2026-05-18 | Lockheed Martin lockheedmartin.com | Lockheed Martin Cyber Kill Chain (Hutchins / Cloppert / Amin 2011) — Recon / Weaponization / Delivery / Exploitation / Installation / C2 / Actions on Objectives 7 阶段攻击建模始祖 [declared=surrogate_primary, auto=secondary; reason=vendor docs (厂商研究 + 教材)] |
| T04-S055 | https://www.unifiedkillchain.com/assets/The-Unified-Kill-Chain.pdf | surrogate_primary | 2026-05-18 | Paul Pols / Fox-IT / Cyber Security Academy | Unified Kill Chain (Paul Pols 2017 / 2022) — 18 阶段统一击杀链, 合并 LM Kill Chain + ATT&CK, 现代红队复杂攻击建模标准 [declared=surrogate_primary, auto=secondary; reason=vendor docs (作者一手 + 教材)] |
| T04-S056 | https://www.activeresponse.org/wp-content/uploads/2013/07/diamond.pdf | surrogate_primary | 2026-05-18 | Sergio Caltagirone 等 / DoD CTA | Diamond Model of Intrusion Analysis (Caltagirone / Pendergast / Betz 2013) — Adversary / Capability / Infrastructure / Victim 四顶点 + 元特征, 入侵分析 + APT 归因事实模型 [declared=surrogate_primary, auto=secondary; reason=vendor docs (作者一手研究)] |
| T04-S057 | https://www.offsec.com/courses/pen-200/ | surrogate_primary | 2026-05-18 | OffSec offsec.com | OffSec PEN-200 / OSCP — Penetration Testing with Kali Linux, 全球红队入门事实认证, 24h hands-on 考试 + 8 主题 + 全新 2023 AD focus [declared=surrogate_primary, auto=secondary; reason=vendor docs (cert org syllabus + 教材)] |
| T04-S058 | https://www.offsec.com/courses/pen-300/ | surrogate_primary | 2026-05-18 | OffSec offsec.com | OffSec PEN-300 / OSEP — Evasion Techniques and Breaching Defenses, 进阶 AV/EDR 绕过 + AD 攻击 + 横向 + Linux post-ex, OSCP 后续 [declared=surrogate_primary, auto=secondary; reason=vendor docs (cert org syllabus + 教材)] |
| T04-S059 | https://www.offsec.com/courses/web-300/ | surrogate_primary | 2026-05-18 | OffSec offsec.com | OffSec WEB-300 / OSWE — Advanced Web Attacks and Exploitation, Web 白盒代码审计 + 反序列化 + SSTI + auth bypass 高级 Web 认证 [declared=surrogate_primary, auto=secondary; reason=vendor docs (cert org syllabus + 教材)] |
| T04-S060 | https://www.offsec.com/courses/exp-301/ | surrogate_primary | 2026-05-18 | OffSec offsec.com | OffSec EXP-301 / OSED — Windows User Mode Exploit Development, x86 栈 BOF + SEH + ROP + DEP/ASLR 绕过 + shellcoding [declared=surrogate_primary, auto=secondary; reason=vendor docs (cert org syllabus + 教材)] |
| T04-S061 | https://www.sans.org/cyber-security-courses/network-penetration-testing-ethical-hacking/ | surrogate_primary | 2026-05-18 | SANS Institute sans.org | SANS SEC560 / GPEN — Enterprise Penetration Testing, Ed Skoudis 主创, 网络 / Windows / AD / Linux / web 综合 6 天 + GIAC GPEN 认证 [declared=surrogate_primary, auto=secondary; reason=vendor docs (cert org syllabus + 教材)] |
| T04-S062 | https://www.sans.org/cyber-security-courses/advanced-penetration-testing-exploit-writing-ethical-hacking/ | surrogate_primary | 2026-05-18 | SANS Institute sans.org | SANS SEC660 / GXPN — Advanced Penetration Testing, Exploits, and Ethical Hacking, 网络协议攻击 + Linux/Windows exploit dev + fuzzing + 加密攻击 [declared=surrogate_primary, auto=secondary; reason=vendor docs (cert org syllabus + 教材)] |
| T04-S063 | https://training.zeropointsecurity.co.uk/courses/red-team-ops | surrogate_primary | 2026-05-18 | Zero-Point Security zeropointsecurity.co.uk | Zero-Point Security CRTO (Red Team Ops) — Cobalt Strike 实战 + AD 攻击全流程 + OPSEC + 现代红队事实认证 (含 CRTO II 进阶) [declared=surrogate_primary, auto=secondary; reason=vendor docs (cert org syllabus + 教材)] |
| T04-S064 | https://www.alteredsecurity.com/adlab | surrogate_primary | 2026-05-18 | Altered Security alteredsecurity.com | Altered Security CRTP (Certified Red Team Professional) — Nikhil Mittal (PowerShell Empire / Nishang 作者) AD 红队认证, CRTE / CRTM / PACES 系列 [declared=surrogate_primary, auto=secondary; reason=vendor docs (cert org syllabus + 教材)] |
| T04-S065 | https://academy.hackthebox.com/paths | surrogate_primary | 2026-05-18 | Hack The Box academy.hackthebox.com | HTB Academy Paths — CPTS (Certified Penetration Testing Specialist) / CBBH (Bug Bounty Hunter) / CWEE (Web Exploit Expert) / CDSA 认证学习路径 [declared=surrogate_primary, auto=secondary; reason=vendor docs (cert org syllabus + 教材)] |
| T04-S066 | https://tryhackme.com/paths | surrogate_primary | 2026-05-18 | TryHackMe tryhackme.com | TryHackMe Learning Paths — Pentest+ / Red Team / SOC L1 / Offensive Pentesting 路径 + 上千 room, 入门 lab 平台 [declared=surrogate_primary, auto=secondary; reason=vendor docs (lab syllabus)] |
| T04-S067 | https://pentesterlab.com/exercises | surrogate_primary | 2026-05-18 | PentesterLab pentesterlab.com | PentesterLab Pro — Web 漏洞专项 lab 集合 (反序列化 / JWT / Code Review / API / Auth) Louis Nyffenegger 主创 [declared=surrogate_primary, auto=secondary; reason=vendor docs (lab syllabus)] |
| T04-S068 | https://www.exploit-db.com/ | surrogate_primary | 2026-05-18 | OffSec Exploit DB exploit-db.com | Exploit Database — 50,000+ 公开 exploit PoC + shellcode + Google Hacking Database, 红队漏洞验证库 (OffSec 维护) [declared=surrogate_primary, auto=secondary; reason=vendor docs (协会 + 教材)] |
| T04-S069 | https://packetstormsecurity.com/ | surrogate_primary | 2026-05-18 | Packet Storm Security packetstormsecurity.com | Packet Storm Security — 1998 起独立漏洞 + advisory + 工具发布平台, exploit / 0day / advisory 历史档案库 [declared=surrogate_primary, auto=secondary; reason=vendor docs (协会 + 教材)] |
| T04-S070 | https://lolbas-project.github.io/ | surrogate_primary | 2026-05-18 | LOLBAS Project / GitHub | LOLBAS (Living Off The Land Binaries, Scripts and Libraries) — Windows 自带可被滥用的 200+ binaries / scripts (certutil / mshta / rundll32 / regsvr32) ATT&CK 映射 [declared=surrogate_primary, auto=secondary; reason=vendor docs (作者一手研究)] |
| T04-S071 | https://gtfobins.github.io/ | surrogate_primary | 2026-05-18 | GTFOBins Project / GitHub | GTFOBins — Unix / Linux 可被滥用的 380+ 二进制 (find / vi / awk / sudo misconfig) 提权 / 反弹 shell / SUID 利用速查 [declared=surrogate_primary, auto=secondary; reason=vendor docs (作者一手研究)] |
| T04-S072 | https://www.amazon.com/Shellcoders-Handbook-Discovering-Exploiting-Security/dp/047008023X | surrogate_primary | 2026-05-18 | Anley/Heasman/Lindner/Richarte / Wiley | 《The Shellcoder's Handbook: Discovering and Exploiting Security Holes 2e》(2007) — 栈溢出 + 堆溢出 + 格式化字符串 + 内核 + Windows/Linux exploit dev 圣经 [declared=surrogate_primary, auto=secondary; reason=vendor docs (出版社 + 教材)] |
| T04-S073 | https://www.pearson.com/store/p/art-of-software-security-assessment-the-identifying-and-preventing-software-vulnerabilities/P100000209203 | surrogate_primary | 2026-05-18 | Mark Dowd / John McDonald / Justin Schuh / Addison-Wesley | 《The Art of Software Security Assessment: Identifying and Preventing Software Vulnerabilities》(Dowd/McDonald/Schuh 2006) — 1200 页代码审计圣经, 经典且现代 vuln research 必读 [declared=surrogate_primary, auto=secondary; reason=vendor docs (出版社 + 教材)] |
| T04-S074 | https://nostarch.com/malware | surrogate_primary | 2026-05-18 | Michael Sikorski / Andrew Honig / No Starch | 《Practical Malware Analysis》(Sikorski/Honig 2012) — 静态 / 动态分析 + IDA + OllyDbg + 反虚拟机 + Anti-RE + 内核 rootkit + lab 真题 [declared=surrogate_primary, auto=secondary; reason=vendor docs (出版社 + 教材)] |
| T04-S075 | https://nostarch.com/bughuntersdiary | surrogate_primary | 2026-05-18 | Tobias Klein / No Starch | 《A Bug Hunter's Diary: A Guided Tour Through the Wilds of Software Security》(Tobias Klein 2011) — 7 个真实漏洞挖掘案例 (内核 + 浏览器 + 媒体播放器) 全流程 [declared=surrogate_primary, auto=secondary; reason=vendor docs (出版社 + 教材)] |
| T04-S076 | https://github.com/RPISEC/MBE | surrogate_primary | 2026-05-18 | RPISEC / GitHub | Modern Binary Exploitation (MBE) — RPI 大学公开课程, Stack/Heap exploit + ROP + ASLR/NX/Canary 绕过 + lab + lecture, Linux x86 exploit dev 入门标杆 [declared=surrogate_primary, auto=secondary; reason=vendor docs (作者一手研究)] |
| T04-S077 | https://www.cobaltstrike.com/product/features | surrogate_primary | 2026-05-18 | Fortra / Cobalt Strike cobaltstrike.com | Cobalt Strike Operator Documentation — Raphael Mudge 创立, 商业 C2 + Beacon + Aggressor Script + Malleable C2 Profile, 红队事实首选 C2 [declared=surrogate_primary, auto=secondary; reason=vendor docs (厂商 + 教材)] |
| T04-S078 | https://sliver.sh/ | surrogate_primary | 2026-05-18 | BishopFox / Sliver sliver.sh | Sliver — BishopFox 开源 C2 (Go 写), mTLS / HTTP(S) / DNS / WireGuard 通道 + 跨平台 + 现代红队 Cobalt Strike 替代品 [declared=surrogate_primary, auto=secondary; reason=vendor docs (作者一手研究)] |
| T04-S079 | https://docs.mythic-c2.net/ | surrogate_primary | 2026-05-18 | Mythic / SpecterOps mythic-c2.net | Mythic C2 Framework Docs — SpecterOps 维护 跨平台 + 模块化 agent (Apfell / Apollo / Athena / Poseidon) + Docker 部署 [declared=surrogate_primary, auto=secondary; reason=vendor docs (作者一手研究)] |
| T04-S080 | https://specterops.io/wp-content/uploads/sites/3/2022/05/Certified_Pre-Owned.pdf | surrogate_primary | 2026-05-18 | Will Schroeder / Lee Christensen / SpecterOps | Certified Pre-Owned: Abusing Active Directory Certificate Services (Schroeder/Christensen 2021) — ESC1-ESC11 AD CS 误配漏洞集大成白皮书, AD CS 红队 canon [declared=surrogate_primary, auto=secondary; reason=vendor docs (作者一手研究)] |
| T04-S081 | https://www.usenix.org/conferences/byname/108 | surrogate_primary | 2026-05-18 | USENIX usenix.org | USENIX Security Symposium — 全球 系统安全四大顶会之一, 开放下载 1992 起所有论文, fuzzing / Spectre / ROP / kernel exploit 大量红队相关研究 [declared=surrogate_primary, auto=secondary; reason=vendor docs (协会 + 教材)] |
| T04-S082 | https://www.ieee-security.org/TC/SP-Index.html | surrogate_primary | 2026-05-18 | IEEE Computer Society S&P (Oakland) | IEEE Symposium on Security and Privacy (Oakland) — 系统安全四大顶会之一, 1980 起举办, exploitation / side-channel / 加密攻击 / Web 安全顶级研究 [declared=surrogate_primary, auto=secondary; reason=vendor docs (协会 + 教材)] |
| T04-S083 | https://www.sigsac.org/ccs.html | surrogate_primary | 2026-05-18 | ACM SIGSAC / CCS | ACM Conference on Computer and Communications Security (CCS) — 系统安全四大顶会之一, 1993 起, fuzzing / 二进制分析 / 内核漏洞 / 智能合约 / 移动安全 [declared=surrogate_primary, auto=secondary; reason=vendor docs (协会 + 教材)] |
| T04-S084 | https://www.ndss-symposium.org/ | surrogate_primary | 2026-05-18 | Internet Society / NDSS ndss-symposium.org | NDSS (Network and Distributed System Security Symposium) — 系统安全四大顶会之一, 1993 起, 网络协议 / IoT / 自动驾驶 / 模糊测试 / Web 安全顶级研究 [declared=surrogate_primary, auto=secondary; reason=vendor docs (协会 + 教材)] |
| T04-S085 | https://www.blackhat.com/html/archives.html | surrogate_primary | 2026-05-18 | Black Hat blackhat.com | Black Hat USA / EU / Asia 历年 Briefings 白皮书归档 — 1997 起最具影响力商业 / 学术混合安全会议, 红队实战研究首发首选 [declared=surrogate_primary, auto=secondary; reason=vendor docs (会议)] |
| T04-S086 | https://media.defcon.org/ | surrogate_primary | 2026-05-18 | DEF CON Communications media.defcon.org | DEF CON Media Server — 1993 起 DEF CON 大会 历年视频 + 幻灯片 + 白皮书 全部免费下载, 黑客文化 + 红队实战 canon [declared=surrogate_primary, auto=secondary; reason=vendor docs (会议)] |
| T04-S087 | https://www.offensivecon.org/ | surrogate_primary | 2026-05-18 | OffensiveCon offensivecon.org | OffensiveCon Berlin — 2018 起最纯粹 offensive security / exploit dev / vulnerability research 顶会, 浏览器 / 内核 / 虚拟机 / 移动 0day [declared=surrogate_primary, auto=secondary; reason=vendor docs (会议)] |
| T04-S088 | https://media.ccc.de/c/ | surrogate_primary | 2026-05-18 | Chaos Computer Club media.ccc.de | CCC Media (Chaos Communication Congress 视频归档) — 欧洲最大黑客大会, 35C3 / 36C3 / 37C3 + Camp 大量硬件 / 系统 / 反审查 + 红队 研究 [declared=surrogate_primary, auto=secondary; reason=vendor docs (会议)] |
| T04-S089 | https://troopers.de/ | surrogate_primary | 2026-05-18 | TROOPERS troopers.de | TROOPERS Heidelberg — 2008 起德国深度技术安全会议, Active Directory / SAP / IPv6 / NGI 系列轨道, AD 红队研究首发地 [declared=surrogate_primary, auto=secondary; reason=vendor docs (会议)] |
| T04-S090 | https://x33fcon.com/ | surrogate_primary | 2026-05-18 | x33fcon x33fcon.com | x33fcon (Gdynia Poland) — 红蓝紫队对抗专门会议, EDR bypass / AD 攻防 / SIEM / Detection Engineering 双向研究 [declared=surrogate_primary, auto=secondary; reason=vendor docs (会议)] |
| T04-S091 | https://googleprojectzero.blogspot.com/ | surrogate_primary | 2026-05-18 | Google Project Zero googleprojectzero.blogspot.com | Google Project Zero Blog — Google 顶级 0day 研究团队博客 (Tavis Ormandy / James Forshaw / Ian Beer 等), 浏览器 / 内核 / iOS / Android 重磅 0day [declared=surrogate_primary, auto=secondary; reason=vendor docs (Google / Microsoft 一手研究)] |
| T04-S092 | https://msrc.microsoft.com/blog/ | surrogate_primary | 2026-05-18 | Microsoft Security Response Center msrc.microsoft.com | MSRC Blog — Microsoft 安全响应中心官方博客, Windows / AD / Azure / Office 0day 修复公告 + 减灾 + bug bounty [declared=surrogate_primary, auto=secondary; reason=vendor docs (Google / Microsoft 一手研究)] |
| T04-S093 | https://cloud.google.com/blog/topics/threat-intelligence | surrogate_primary | 2026-05-18 | Mandiant / Google Cloud Threat Intelligence | Mandiant Threat Intelligence (现 Google Cloud) — APT41 / APT29 / FIN7 等 APT 归因报告 + Red Team Tactics 系列 [declared=surrogate_primary, auto=secondary; reason=vendor docs (厂商研究)] |
| T04-S094 | https://thedfirreport.com/ | surrogate_primary | 2026-05-18 | The DFIR Report thedfirreport.com | The DFIR Report — 真实勒索软件入侵全链 timeline + ATT&CK 映射 + IOC + 横向 / 持久化 / C2 详解, 红队研究攻击者实战 canon [declared=surrogate_primary, auto=secondary; reason=vendor docs (作者一手研究)] |
| T04-S095 | https://www.crowdstrike.com/en-us/global-threat-report/ | surrogate_primary | 2026-05-18 | CrowdStrike crowdstrike.com | CrowdStrike Global Threat Report 年度 — eCrime / Nation-state / Cloud / Identity 战术演进, 红队对手仿真 (Adversary Emulation) 参考 [declared=surrogate_primary, auto=secondary; reason=vendor docs (厂商研究)] |
| T04-S096 | https://securelist.com/ | surrogate_primary | 2026-05-18 | Kaspersky GReAT securelist.com | Kaspersky Securelist — GReAT (Global Research and Analysis Team) APT / 银行木马 / 工控 / 移动 长期跟踪研究 [declared=surrogate_primary, auto=secondary; reason=vendor docs (厂商研究)] |
| T04-S097 | https://research.checkpoint.com/ | surrogate_primary | 2026-05-18 | Check Point Research research.checkpoint.com | Check Point Research — 0day + 移动 + Web + Cloud + APT 归因 一手研究, EternalBlue / Anubis / SimJacker 等知名研究 [declared=surrogate_primary, auto=secondary; reason=vendor docs (厂商研究)] |
| T04-S098 | https://arxiv.org/list/cs.CR/recent | verified_primary | 2026-05-18 | arXiv cs.CR arxiv.org | arXiv cs.CR (Cryptography and Security) — preprint 学术安全研究, fuzzing / ML attack / Web / 二进制 / 协议 红队相关 preprint 大量 |
| T04-S099 | https://anquanke.com/ | surrogate_primary | 2026-05-18 | 安全客 / 奇安信 anquanke.com | 安全客 — 奇安信旗下中文安全社区, 国内红队 + CTF + 漏洞分析 + 议题首发, 国内 OffSec 类内容主战场 [declared=surrogate_primary, auto=secondary; reason=vendor docs (中国安全社区)] |
| T04-S100 | https://www.freebuf.com/ | surrogate_primary | 2026-05-18 | FreeBuf 互联网安全媒体 freebuf.com | FreeBuf — 国内最大民间互联网安全社区, 渗透 / 红队 / 漏洞 / 工具 / 议题 中文一手, 红蓝对抗专题 [declared=surrogate_primary, auto=secondary; reason=vendor docs (中国安全社区)] |
| T04-S101 | https://bbs.kanxue.com/ | surrogate_primary | 2026-05-18 | 看雪学院 kanxue.com | 看雪论坛 — 国内逆向 / 二进制 / 漏洞 / 加密 / 移动 安全顶级社区, 看雪 CTF + 看雪安全峰会 [declared=surrogate_primary, auto=secondary; reason=vendor docs (中国安全社区)] |
| T04-S102 | https://paper.seebug.org/ | surrogate_primary | 2026-05-18 | 知道创宇 paper.seebug.org | Seebug Paper — 知道创宇 404 实验室 + 漏洞研究 paper 库, Web / IoT / 工控 / 漏洞分析中文 一手研究 [declared=surrogate_primary, auto=secondary; reason=vendor docs (中国安全社区)] |
| T04-S103 | https://xz.aliyun.com/ | surrogate_primary | 2026-05-18 | 先知社区 / 阿里安全 xz.aliyun.com | 阿里先知社区 — 阿里安全运营的红队 / 渗透 / Web / 移动 / 云安全 中文研究社区, 漏洞挖掘征文与红队 writeup [declared=surrogate_primary, auto=secondary; reason=vendor docs (中国安全社区)] |
| T04-S104 | https://tttang.com/ | surrogate_primary | 2026-05-18 | 跳跳糖社区 / 腾讯安全 tttang.com | 跳跳糖 (腾讯安全) — Java 反序列化 / Web / 内核 / iOS / Android / Cloud 高质量中文安全研究社区 [declared=surrogate_primary, auto=secondary; reason=vendor docs (中国安全社区)] |
| T04-S105 | https://www.first.org/cvss/v4-0/specification-document | surrogate_primary | 2026-05-18 | FIRST.org first.org | FIRST CVSS v4.0 Specification (2023-11) — Common Vulnerability Scoring System 第四版, Base / Threat / Environmental / Supplemental 四组指标, 红队漏洞优先级 [declared=surrogate_primary, auto=secondary; reason=vendor docs (协会 + 监管)] |

Footnote: 红队 canon 的 一手 / 二手边界与 PRIMARY_SUFFIX 白名单结构性错位 — 行业事实一手 (MITRE / OWASP / PortSwigger / SpecterOps / harmj0y / adsecurity.org / Project Zero / HackTricks) 几乎全部 .org / .com / .net / .io / .blogspot.com 域名, source_verifier 自动判 secondary, 必须显式 `declared=surrogate_primary, auto=secondary; reason=vendor docs (...)` literal 重新声明. 真正 auto verified_primary 只有 NIST csrc.nist.gov + NVD nvd.nist.gov + CISA cisa.gov + NCSC ncsc.gov.uk + ENISA enisa.europa.eu + arxiv.org cs.CR 这 6 个域名 (本 manifest 6 条 verified_primary 全部命中, 占比 ~5.7%), 其余 99 条全部 surrogate_primary, 这是行业客观分布. 黑名单严格执行: mp.weixin.qq.com (国内安全公众号主战场) / zhihu.com / weibo.com / csdn.net / cnblogs.com / jianshu.com / baike.baidu.com / zhidao.baidu.com / wenku.baidu.com / developer.aliyun.com / cloud.tencent.com / juejin.cn / segmentfault.com / 51cto.com 任何 URL 严禁, 即使原作者本人发表 也走 anquanke / freebuf / kanxue / seebug / xz.aliyun.com / tttang 等 vetted 中文社区替代. medium.com 仅允许 official org 账号 (posts.specterops.io 等), 个人 medium 一律排除. reddit.com / quora.com / "How I hacked X" 个人无授权博客 一律排除. 本 canon 全部内容 在 authorized engagement (红队 / pentest / bug bounty in scope / 合法 CTF / 自有 lab) 范围内学习 + 使用, 收录的 PTES + OSSTMM + NIST 800-115 + OWASP Testing Guide + OffSec / SANS / EC-Council Code of Ethics 都 明文强调 written authorization + engagement letter + RoE 是 红队作业前置约束, 任何 unauthorized intrusion 都违反 canon 自身的伦理底线.
