Red › Module 4 › Lesson 3
No Weapon Kits
Cyberlium explicitly refuses phishing kits, mass email weapons, ransomware builders, and Cobalt Strike cookbooks — methodology on $LAB_RT only.
Visual · rt_no_weapon_kits
No weapon kits — hard refuse. $LAB_RT only. Original Cyberlium.
Opening
We teach ATT&CK literacy and defender value — not downloadable attack kits against unauthorized targets.
Weapon kits — phishing-as-a-service, mass mailers, ransomware builders, leaked Cobalt Strike playbooks aimed at strangers — cause real harm and violate law. Cyberlium refuses to operationalize them. Red team education here means RoE-bound emulation on $LAB_RT, detection mapping, and purple debrief — not kit shopping lists. If a tutorial sells a kit, close it and return to YOUR lab plan. Next: Access Lab.
1. What we name and refuse
Named for literacy only: phishing kits, mass email campaign tools, ransomware builders, unauthorized Cobalt Strike deployment guides. We map them to ATT&CK and defender mitigations — we do NOT provide procurement, configuration, or targeting steps.
Your $LAB_RT work uses approved lab tools under RoE — not stranger-facing weapons.
Command guide
Try these commands — What we name and refuse
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
No weapon kits — https://www.cisa.gov/resources-tools/resources/red-team-exercises (authorized scope only) LOLBAS project — https://lolbas-project.github.io/ (living-off-the-land literacy — lab only)
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install curl
macOS: Built-in
Windows: Built-in (PowerShell: Invoke-WebRequest)
═══ LINUX / macOS ═══
Command — copy this
curl -sS https://lolbas-project.github.io/ | head -8 curl -sS https://attack.mitre.org/techniques/T1566/ | head -5 cat >> "$HOME/cyberlium-lab/t21-rt/roe.txt" <<'EOF' 2>/dev/null || true refuse: phishing send tools, weaponized attachments, stranger targets EOF
Command — copy this
grep refuse "$HOME/cyberlium-lab/t21-rt/roe.txt" 2>/dev/null | tail -2
Primary tools to practice this lesson: curl, grep. Reference sites: No weapon kits (https://www.cisa.gov/resources-tools/resources/red-team-exercises); LOLBAS project (https://lolbas-project.github.io/). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Why kits are out of scope for education
Kits lower barrier to harm against people who never consented. Academic red team value lives in methodology, detection gaps, and purple loops — reproducible on isolated $LAB_RT without collateral damage.
Professionals use signed engagements and vendor-approved simulation platforms — not random GitHub kit drops on production.
3. Redirect: methodology substitutes kits
Substitutes: ATT&CK technique IDs in plan pack, defender detection checklist, lab-safe initial access fixture on $LAB_RT, debrief gap layers. Report kit solicitation in class chat to instructor.
Ship: NEVER list — kits, mass email, ransomware, real C2 on production/classmates. Next: Access Lab.
4. What you ship: explicit NEVER weapon kit list
NEVER: phishing kits, mass email weapons, ransomware builders, CS cookbooks on strangers/production. $LAB_RT methodology only. chmod 600.
5. What you record before the next lesson
Date. NEVER weapon list. $LAB_RT reaffirmed. File t21-m04-l03-no-weapon-kits.txt chmod 600.
6. Wrong vs right: stranger phishing vs authorized RT lab
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Download phishing kit 'for lab.' Share kit link in Discord. Run ransomware builder on classmate VM.
Right
Write NEVER weapon kit list and methodology redirect. Next: Access Lab.
Mission: freeze explicit refuse list
1) Write NEVER list: kits, mass email, ransomware, unauthorized CS, production/classmate targets. 2) List three methodology substitutes (ATT&CK plan, detection checklist, $LAB_RT fixture). 3) chmod 600.
Stuck? Ask Cyberlium AI Mentor
When content offers a kit, close tab and open YOUR RoE pack.
Knowledge Check
APPLY: Cyberlium on weapon kits:
Multiple choice
Knowledge Check
APPLY: True or False: Ransomware builders are acceptable homework tools.
True or False
Knowledge Check
APPLY: When a tutorial sells a phishing kit you should:
Multiple choice