No Weapon Kits
Cyberlium explicitly refuses phishing kits, mass email weapons, ransomware builders, and Cobalt Strike cookbooks — methodology on $LAB_RT only.
Visual · rt_no_weapon_kits
No weapon kits — hard refuse. $LAB_RT only. Original Cyberlium.
We teach ATT&CK literacy and defender value — not downloadable attack kits against unauthorized targets.
Weapon kits — phishing-as-a-service, mass mailers, ransomware builders, leaked Cobalt Strike playbooks aimed at strangers — cause real harm and violate law. Cyberlium refuses to operationalize them. Red team education here means RoE-bound emulation on $LAB_RT, detection mapping, and purple debrief — not kit shopping lists. If a tutorial sells a kit, close it and return to YOUR lab plan. Next: Access Lab.
1. What we name and refuse
Named for literacy only: phishing kits, mass email campaign tools, ransomware builders, unauthorized Cobalt Strike deployment guides. We map them to ATT&CK and defender mitigations — we do NOT provide procurement, configuration, or targeting steps.
Your $LAB_RT work uses approved lab tools under RoE — not stranger-facing weapons.
Command guide
Try these commands — What we name and refuse
═══ LINUX / macOS (Terminal Practice) ═══
Check system state and user context
Command — copy this
id whoami uname -a
Inspect network sockets listening for connections
Command — copy this
ss -tuln 2>/dev/null || netstat -tuln
Audit active processes
Command — copy this
ps aux | grep -v "\[" | head -15
═══ WINDOWS (POWERSHELL) ═══ Query user identity and system information
Command — copy this
whoami /all Get-ComputerInfo | Select-Object CsName, OsName, OsVersion
Primary tools to practice this lesson: curl, grep. Reference sites: No weapon kits (https://www.cisa.gov/resources-tools/resources/red-team-exercises); LOLBAS project (https://lolbas-project.github.io/). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Why kits are out of scope for education
Kits lower barrier to harm against people who never consented. Academic red team value lives in methodology, detection gaps, and purple loops — reproducible on isolated $LAB_RT without collateral damage.
Professionals use signed engagements and vendor-approved simulation platforms — not random GitHub kit drops on production.
3. Redirect: methodology substitutes kits
Substitutes: ATT&CK technique IDs in plan pack, defender detection checklist, lab-safe initial access fixture on $LAB_RT, debrief gap layers. Report kit solicitation in class chat to instructor.
Ship: NEVER list — kits, mass email, ransomware, real C2 on production/classmates. Next: Access Lab.
4. What you ship: explicit NEVER weapon kit list
NEVER: phishing kits, mass email weapons, ransomware builders, CS cookbooks on strangers/production. $LAB_RT methodology only. chmod 600.
5. What you record before the next lesson
Date. NEVER weapon list. $LAB_RT reaffirmed. File t21-m04-l03-no-weapon-kits.txt chmod 600.
6. Wrong vs right: stranger phishing vs authorized RT lab
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
- Wrong: Download phishing kit 'for lab.' Share kit link in Discord. Run ransomware builder on classmate VM.
- Right: Write NEVER weapon kit list and methodology redirect. Next: Access Lab.
Mission: freeze explicit refuse list
1) Write NEVER list: kits, mass email, ransomware, unauthorized CS, production/classmate targets. 2) List three methodology substitutes (ATT&CK plan, detection checklist, $LAB_RT fixture). 3) chmod 600.
Stuck? Ask Cyberlium AI Mentor
When content offers a kit, close tab and open YOUR RoE pack.
APPLY: Cyberlium on weapon kits:
APPLY: True or False: Ransomware builders are acceptable homework tools.
APPLY: When a tutorial sells a phishing kit you should: