Red Team Infrastructure Wiki is a knowledge base that collects hardening resources for setting up resilient red team infrastructure.
The wiki addresses the problem of maintaining operational security and resilience during red team engagements by documenting infrastructure design principles and implementation techniques. Its approach centers on functional segregation, where different operational roles—phishing SMTP, payload hosting, long-term command and control, and short-term C2—are deployed on separate assets. This isolation ensures that compromise of one component does not cascade to the entire infrastructure. The wiki provides practical guidance on implementing redirectors, domain management, phishing frameworks, DNS and HTTP redirection techniques, C2 traffic modification, domain fronting, and infrastructure obscuration and security hardening.
The tool suits red teamers and penetration testers planning multi-week or multi-month engagements who need to design infrastructure capable of withstanding active defensive response. It covers specific frameworks and tools including Cobalt Strike and Empire, along with techniques applicable to other C2 platforms. The wiki is structured as a reference guide with sections on design considerations, domain acquisition and reputation management, phishing setup options, redirector implementation using tools like socat and Apache mod_rewrite, payload redirection, C2 modification techniques, and deployment automation. It does not position itself against alternatives but rather collects resources and approaches from multiple sources.
The project accepts community contributions through pull requests and issues, indicating openness to expansion and refinement of its content. The wiki explicitly credits both original content authors and contributors, suggesting collaborative development and acknowledgment of the broader red team community's knowledge.
