Red Team Arsenalย 
Red Team Arsenal is a inhouse framework created by flipkart security team which monitors the external attack surface of the company's online assets and provide an holistic security view of any security anomalies. It's a closely linked collection of various security engines and tools to conduct/simulate attacks and monitor public facing assets for anomalies and leaks.
It's an intelligent framework that detects security anomalies in all layer 7 assets and reports the same.
As companies continue to expand their footprint on INTERNET via various acquisitions and geographical expansions, human driven security engineering is not scalable, hence, companies need feedback driven automated systems to stay put.
Installation
Supported Platforms
RTA has been tested both on Ubuntu/Debian (apt-get based distros) distros, it will also work with Mac-OS (but do replace the binaries folder with the binaries of the programs that match with your system architecture if you are running it on Mac OS)
Prerequisites:
There are a few packages which are necessary before proceeding with the installation:
- Python 3.8, which is installed by default in most systems
- Python pip:
sudo apt-get install python3-pip
Also, you will need to update the config file and config_mail yml files with the following data
- Google Chat Webhook URL
- SMTP Credentials
- Github Token
- Mailing List
- Custom Search Engine (API Key)
You can install all the requirements by running sudo pip3 install -r requirements.txt
Usage
Mention the domains you want to monitor inside 'input_files/domains.txt'
python3 scheduler.py
Configuring Google Chat:
You can receive notifications in Google Chat, this can be configured by adding the webhook URL to config.yml file.
Contributors
- Anirudh Anand (@a0xnirudh)
- Mohan KK (@MohanKallepalli)
- Ankur Bhargava (@_AnkurB)
- Prajal Kulkarni (@prajalkulkarni)
- Himanshu Kumar Das (@mehimansu)
- Mandeep Jadon (@1337tr0lls)
- Vivek Srivastav (@vivek_15887)
- Abhishek S (@abhiabhi2306)
References
Thanks to the authors of the below creations.
- Amass: https://github.com/owasp-amass/amass
- Aquatone: https://github.com/michenriksen/aquatone
- Assetfinder: https://github.com/tomnomnom/assetfinder
- Chaos-Client: https://github.com/projectdiscovery/chaos-client
- Chrome Driver: https://chromedriver.chromium.org/downloads
- Ffuf: https://github.com/ffuf/ffuf
- Finddomain: https://github.com/Findomain/Findomain
- Gau: https://github.com/lc/gau
- Https: https://github.com/projectdiscovery/httpx
- Naabu: https://github.com/projectdiscovery/naabu
- Nmap: https://nmap.org/
- Subfinder: https://github.com/projectdiscovery/subfinder
- Scweet: https://pypi.org/project/Scweet/
- Cloud Enum: https://github.com/initstring/cloud_enum
- DNStwist: https://github.com/elceef/dnstwist
- Phonebook: https://phonebook.cz/
- SSLyze: https://github.com/nabla-c0d3/sslyze
- Shodan: https://shodan.io