Live Red Team Labs · 120+ Environments

Think Like
The Adversary.

ThreatForge Academy trains elite red teamers through hands-on labs, real-world attack simulations, and adversarial frameworks used by top-tier security operators worldwide.

3,400+

Operators Trained

120+

Live Labs

18

Specializations

tfa-terminal — recon-module

$ nmap -sV --script vuln 10.10.1.0/24

✓ Discovered 12 live hosts

! CVE-2024-3094 on 10.10.1.42:22

$ exploit --target 10.10.1.42

Network PenetrationWeb App ExploitationSocial EngineeringActive Directory AttacksMalware DevelopmentCloud ExploitationOSINT & ReconEvasion TechniquesLateral MovementPrivilege EscalationC2 InfrastructureKerberos Attacks Network PenetrationWeb App ExploitationSocial EngineeringActive Directory AttacksMalware DevelopmentCloud ExploitationOSINT & ReconEvasion TechniquesLateral MovementPrivilege EscalationC2 InfrastructureKerberos Attacks

// 01 — Learning Paths

Choose Your
Attack Vector

Structured curricula built by operators, for operators. Each path ends with a capstone red team engagement in our live-fire range.

01/04

🔍

Recon & OSINT

Master passive and active recon. Map attack surfaces before a single packet touches the target.

OSINTShodanMaltego

Intermediate

02/04

💀

Adversary Simulation

Emulate real APT groups using MITRE ATT&CK. Run full kill-chain engagements from initial access to exfil.

APT TTPsC2 InfraCobalt Strike

Advanced

03/04

🌐

Web & API Exploitation

Exploit modern web stacks, REST/GraphQL APIs, OAuth flows, and cloud-native misconfigurations.

OWASPBurp SuiteJWT

Intermediate

04/04

🏢

Enterprise Red Team Ops

Full-scope engagements: AD domination, lateral movement, ransomware simulation, and reporting.

Active DirectoryBloodHoundKerberos

Expert

// 02 — Platform Features

Built For
Operators

⚡

Instant Lab Spin-Up

120+ isolated environments launch in under 30 seconds. No setup, no VMs, no excuses. Just attack.

🎯

MITRE ATT&CK Mapped

Every lab maps to ATT&CK techniques. Track your coverage across the full adversary lifecycle.

📊

Real Detection Feedback

Your attacks are scored against real detection rules. Know if you'd have been caught — and why.

🏆

Live Leaderboards

Compete globally. Weekly CTF-style challenges. Build a public operator profile for job applications.

📡

Threat Intel Briefs

Every module opens with real intelligence on the adversary you're emulating. Context before code.

🛡️

Certifications

Earn TFA-certified credentials that signal real-world operator skill to employers and peers.

// Begin Your Engagement

Ready To
Breach Everything?

Join 3,400+ operators already running labs. New content every two weeks. Free tier available — no credit card required.

// Operator Access

Breach
Cleared.
Enter The
Range.

120+ live-fire lab environments ready on demand
Full MITRE ATT&CK kill-chain coverage across all paths
Real-time detection feedback on every attack
Compete on global leaderboards and build your operator rep
Earn TFA certifications recognised by top-tier security teams

Email Address

✉

Enter a valid email address

Password

👁

Password must be at least 8 characters

Keep me signed in Forgot password?

Good morning, Operator AK

You're on a 7-day streak 🔥 · 3 labs in queue · 1 new intel brief

Labs Completed

47

↑ 8 this week

Courses Progress

62%

+4% this week

TFA Points

8,340

+420 today

Global Rank

#214

↑ 32 positions

CVEs Exploited

23

In lab environments

Active Courses

View All →

💀

Adversary Simulation — APT Emulation

Module 4 of 9 · Est. 6h remaining

42%

🌐

Web & API Exploitation Masterclass

Module 7 of 11 · Est. 3h remaining

64%

🔍

OSINT & Recon Specialist Track

Module 9 of 9 · 1 lab remaining

88%

Recommended Labs

Browse All 120+ →

Medium

Kerberoasting A Domain

Enumerate SPNs, request tickets, crack offline via hashcat.

⏱ 45 min👤 5.3k tries

Medium

OAuth Token Theft

Exploit open redirect in IdP to steal Bearer tokens.

⏱ 90 min👤 2.1k tries

Hard

AWS IAM Privilege Escalation

Lambda → admin via IAM policy misconfigurations.

⏱ 3 hrs👤 920 tries

Recent Activity

Completed Lateral Movement via Pass-the-Hash lab

2 hours ago

Started APT29 Emulation — Module 4

Yesterday

Failed Phantom Domain lab — caught by EDR on attempt 2

2 days ago

Earned badge: Kerberos Wrangler

3 days ago

Completed OSINT Module 8 — Open Source Profiling

4 days ago

Top Operators

Full Board →

#1

PR

phantom_r00t

41,200 pts

#2

0x

0xNightCrawler

38,750 pts

#3

VX

vxunderscore

37,100 pts

#4

SH

shelldr0p

29,880 pts

#214

AK

You (AK_operator)

8,340 pts

01 — Threat Intelligence FoundationsDone

What is Threat Intelligence?12m

MITRE ATT&CK Framework Deep Dive28m

Diamond Model of Intrusion Analysis18m

02 — Initial Access TechniquesDone

Phishing Infrastructure Setup35m

Spearphishing with Pretexts24m

Drive-By Compromise22m

Lab: Initial Access Chain🧪 90m

03 — Persistence & EvasionDone

Registry Run Key Persistence20m

Scheduled Tasks & WMI25m

EDR Evasion Fundamentals40m

04 — C2 InfrastructureIn Progress

C2 Architecture & Tradecraft30m

Building Cobalt Strike Profiles45m

Domain Fronting & Redirectors38m

Lab: Build Your C2 Infra🧪 120m

05 — Lateral MovementLocked

Pass-the-Hash & Pass-the-Ticket35m

Kerberoasting & AS-REP Roasting42m

Module 04 — C2 Infrastructure

Building Cobalt Strike Profiles

16:42 / 45:00

Building Cobalt Strike Profiles

Module 04 Advanced ⏱ 45 minutes 📖 Reading: 15 min 🧪 Lab: Optional

Lesson Notes

Resources

Knowledge Check

Discussion (12)

Overview

Cobalt Strike Malleable C2 profiles are configuration files that control how your Beacon communicates with the team server. A well-crafted profile is the difference between being caught in 10 minutes and operating undetected for months.

Key Concepts

A Malleable C2 profile modifies Beacon's network traffic to blend in with legitimate protocols. Common techniques include mimicking CDN traffic (fastly.net), impersonating SaaS tools, or riding over DNS/HTTPS.

# malleable-c2-profile.profile
http-get {
  set uri "/api/v2/auth/token";
  client {
    header "Accept" "application/json";
    header "X-Request-ID" "beacon-id";
    metadata {
      base64url;
      header "Authorization";
    }
  }
}
code-signer { # Optional — sign your payloads
  set keystore "/path/to/codesign.jks";
}

OPSEC Considerations

Never use default profiles in production engagements. Default Cobalt Strike traffic is trivially signatured by every major EDR. Use c2lint to validate your profile before deploying, and test against a PCAP analysis rig.

Advanced operators pair profiles with redirector infrastructure — see the next lesson on Domain Fronting for a complete setup guide that survived a 90-day APT simulation.

📄

Malleable C2 Profile Reference — Official Docs

Complete parameter reference for Cobalt Strike 4.x

↓ PDF

💻

Sample Profiles Repository (GitHub)

200+ community-contributed profiles — educational use only

↗ Link

🧰

c2lint Validation Tool

Validate and score your profiles before deployment

↓ ZIP

📊

PCAP Analysis Lab Files

Traffic captures from default vs hardened profiles for comparison

↓ PCAP

What is the primary purpose of a Malleable C2 profile?

ATo encrypt Beacon's payload during delivery

BTo modify Beacon's network traffic to evade detection

CTo automatically rotate C2 infrastructure

DTo manage operator sessions on the team server

phantom_r00t2h ago

The c2lint tool is essential before any real engagement. Caught 3 critical OPSEC mistakes in my profile that would have flagged Defender immediately.

0xNightCrawler5h ago

Anyone tested the Office365 impersonation profile against SentinelOne? Got caught on the metadata header format — might need custom base64 encoding.

Lesson 5 of 42

Think LikeThe Adversary.

Overview

Key Concepts

OPSEC Considerations

Think Like
The Adversary.