Red › Module 1 › Lesson 1
RT vs Pentest
Red teaming simulates adversaries under written RoE on $LAB_RT you own — methodology literacy, not attacks on strangers or classmates.
Visual · rt_rt_vs_pentest
RT vs pentest literacy. $LAB_RT only. Original Cyberlium.
Opening
Red teaming is adversary simulation with rules — not a license to phish strangers or run C2 on production.
Red teaming exercises simulate realistic adversary behavior to test people, process, and technology under agreed Rules of Engagement (RoE). Penetration testing often focuses on finding and validating vulnerabilities within a defined technical scope. Both require authorization — red team adds campaign narrative, stealth constraints, and purple-team detection goals. Cyberlium Topic 21 teaches red-team methodology literacy on lab VMs YOU control at $LAB_RT with written RoE. You will NOT target classmates, employer production without signed engagement, or internet strangers because a tutorial did. Next: RoE and Objectives.
1. Red team: adversary simulation under RoE
Red team engagements emulate threat actors — initial access, persistence, lateral movement, objectives — while staying inside signed RoE, time windows, and scope boundaries. Success is measured against detection, response, and resilience — not trophy shells on random hosts.
Red team literacy on $LAB_RT means understanding campaign structure: objectives, constraints, reporting, and purple-team feedback loops. Attackers hope you skip RoE and treat any reachable host as homework — you won't.
Command guide
Try these commands — Red team: adversary simulation under RoE
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
MITRE ATT&CK — https://attack.mitre.org/ (adversary behavior vocabulary for YOUR lab) Red Team vs Pentest — https://www.cisa.gov/resources-tools/resources/red-team-exercises (scope and objectives literacy) Purple Team — https://attack.mitre.org/resources/adversary-emulation-plans/ (defender collaboration framing)
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install curl sudo apt install python3
macOS:
Command — copy this
brew install python3
Windows: Built-in (PowerShell: Invoke-WebRequest) Download https://python.org/downloads/
═══ LINUX / macOS ═══
Command — copy this
python3 -c "print('Red team: emulate adversary TTPs on authorized lab only')"
curl -sS https://attack.mitre.org/ | head -8
curl -sS -o /dev/null -w "ATT&CK HTTP %{http_code}
" https://attack.mitre.org/Primary tools to practice this lesson: curl, python3. Reference sites: MITRE ATT&CK (https://attack.mitre.org/); Red Team vs Pentest (https://www.cisa.gov/resources-tools/resources/red-team-exercises); Purple Team (https://attack.mitre.org/resources/adversary-emulation-plans/). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Penetration test: scoped technical assessment
Penetration tests typically validate security controls against a defined asset list — find issues, demonstrate impact within scope, report findings. Less emphasis on long-running stealth campaigns or social engineering unless explicitly in scope.
Both pentest and red team require authorization. Cyberlium labs assume intentional practice VMs at $LAB_RT with RoE you wrote or received from an instructor — not dorm LANs, café Wi-Fi, or classmate deploy URLs.
3. What this topic will never call practice
Phishing strangers, mass email campaigns, ransomware trials on production, Cobalt Strike weapon cookbooks against real networks, or C2 beacons on classmates' projects. Those harm people and violate law — not homework.
Ship a sentence: red team literacy here means adversary simulation methodology on MY $LAB_RT under written RoE with defender detection value. Next lesson covers RoE and Objectives.
4. What you ship: RT vs pentest definition scoped to $LAB_RT
Write RT = adversary sim under RoE; pentest = scoped technical assessment. Dest = $LAB_RT you own with written RoE. NEVER strangers, classmates, production without engagement. Notes chmod 600.
5. What you record before the next lesson
Date (UTC). RT vs pentest. Lab = $LAB_RT with RoE. NEVER stranger targets, mass phishing, real C2 on production. Path: $HOME/cyberlium-lab/t21-m01-l01-rt-vs-pentest.txt chmod 600.
6. Wrong vs right: stranger phishing vs authorized RT lab
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Call any nmap scan 'red teaming.' Phish a classmate 'to learn RT.' Run C2 on employer production without signed RoE.
Right
Define RT vs pentest and name $LAB_RT as the only dest. Next: RoE and Objectives.
Mission: define red team vs pentest for YOUR lab
1) Write RT vs pentest in one paragraph each. 2) Write a NEVER list (stranger phishing, mass email, ransomware, real C2 on production/classmates). 3) Name $LAB_RT as your placeholder. Never test hosts outside YOUR lab RoE.
Stuck? Ask Cyberlium AI Mentor
Ask Mentor: 'Hint only: RT vs pentest?' — not how to phish a classmate.
Knowledge Check
APPLY: Red teaming on Cyberlium means:
Multiple choice
Knowledge Check
APPLY: True or False: Red teaming authorizes phishing strangers for practice.
True or False
Knowledge Check
APPLY: Red team success is often measured by:
Multiple choice