◇ OpenCyber Academy
Technologist · Chapter 17 · English

Chapter 17 — Authorized offensive security and red team: tooling

Open, free learning for anyone who wants to protect people and technology. No account is required to read this text or its worked answers.

Chapter 17 — Authorized offensive security and red team: tooling

Lesson map

Lesson 17 published. Map, example, EX049.

flowchart TD
  N0["Learning outcomes"]
  N1["17.1 Tools are in scope of governance"]
  N2["17.2 Change control mid-flight"]
  N3["17.3 Supply chain of tools"]
  N4["17.4 Classroom constraint"]
  N5["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5
  N5 --> EX["Worked example"]
  EX --> Q["Exercise EX049"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["17.1 Tools are in scope of governance"]
  N2["17.2 Change control mid-flight"]
  N3["17.3 Supply chain of tools"]
  N4["17.4 Classroom constraint"]
  N5["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> Q["EX049"]

[Learning outcomes]
    |
    v
[17.1 Tools are in scope of governance]
    |
    v
[17.2 Change control mid-flight]
    |
    v
[17.3 Supply chain of tools]
    |
    v
[17.4 Classroom constraint]
    |
    v
[Synthesis]
    |
    v
[Worked example] --> [Exercise EX049]

Learning outcomes

You will (1) inventory assessment tools with owner, purpose and data handled; (2) apply a change-control note before upgrading a tool mid-engagement; (3) explain supply-chain risk for assessment tooling; (4) keep classroom labs on the Python standard library.

17.1 Tools are in scope of governance

Anything that touches client systems or client data is part of the engagement's attack surface — including the tester's own laptop and scanners. An inventory lists each tool, who maintains it, what data it stores, and whether it may leave the approved environment.

For ENG-712 each laptop and scanner gets an inventory row that records disk encryption and how long any local evidence cache is kept. Evidence held on a tester's machine runs on the same retention clock as evidence in the vault. A lost laptop follows the same incident path as a lost badge, because either one can expose client data.

17.2 Change control mid-flight

Upgrading a scanner halfway through a window can change its behaviour and invalidate comparisons. Note the version at kickoff; defer upgrades unless the white team agrees that a security fix in the tool itself requires it.

Pinned versions protect the before and after comparisons in purple-team work: if the scanner changes between runs, a difference in results might come from the tool rather than the client's controls. When a security fix in the tool itself cannot wait, the white team initials the upgrade, and the initials are stored next to the version pin in the log.

17.3 Supply chain of tools

Assessment software comes from vendors and open-source projects. Prefer signed releases, verify checksums when provided, and avoid random scripts from the internet. ATT&CK T1195 Supply Chain Compromise is usually discussed as an adversary technique against the client; it applies to the testing team too.

Priya verifies checksums before the window opens, and the step is a line on the kickoff checklist. A script found online that claims only to parse JSON is still refused if it is unsigned and unreviewed, because it would run on a machine holding client evidence. A compromised testing tool could do exactly the harm that T1195 describes for clients.

17.4 Classroom constraint

Every lab in this book uses only the Python 3 standard library and synthetic data. That is intentional: learners practise decision logic without depending on commercial scanners or building attack tooling.

The constraint also keeps every lab reproducible on any machine with Python 3, without licences or network access. Commercial scanners may appear later at work, but they arrive through TRT's procurement and change control, with their own inventory rows and version pins. The decisions practised here, about gates, scope and evidence, carry over unchanged to those tools.

Worked example

Northpoint's kit list for TRT names two inventory scanners (versions pinned), a note-taking vault, and the ROE checkers from this course. A junior suggests adding a new "credential checker" found online. Priya rejects it: no owner, no checksum, no change-control entry, and the ROE does not list credential-guessing activities.

Synthetic case. The kit list and the rejected tool are invented.

Errors and limits

A pinned old version with a known tool vulnerability is also a risk; plan upgrades between engagements. Personal cloud sync of tool output can leak evidence.

Exercises

Synthesis

Inventory the kit, pin versions, treat tool supply chain seriously, and keep teaching labs boring by design.

Continue studying — chapter 17 of 30

← Chapter 16 (draft) · Course chapter index · Chapter 18 (draft) →