opsec

Operational Security (OPSEC) Knowledge Base

OPSEC ensures the red team engagement remains covert, controlled, and within authorized scope. Poor OPSEC burns the engagement — detected scans alert the blue team, taint findings, and waste client resources. This skill applies across all recon phases.

1. Core OPSEC Principles

The OPSEC Mindset

1. Every packet is a signal — assume the target has IDS/IPS, SIEM, and SOC analysts
2. Minimize footprint — collect only what you need, no more
3. Blend with normal traffic — timing, volume, and patterns should look legitimate
4. Know your tools' signatures — every scanner has a fingerprint
5. Document everything — if you can't prove it was authorized, it wasn't

Engagement Scope Awareness

Before ANY active operation:

• Written Rules of Engagement (ROE) on file
• Target IP ranges and domains explicitly listed
• Out-of-scope assets clearly identified
• Testing window defined (dates, times)
• Emergency contact for the client (for accidental impact)
• Get-out-of-jail letter accessible

2. Network OPSEC

Scan Rate Limiting

Traffic Shaping

# nmap with specific rate limiting
nmap -sS --max-rate 10 --max-retries 1 -p 80,443 <target>

# ffuf with rate limiting
ffuf -u https://<target>/FUZZ -w wordlist.txt -rate 5

# nuclei with rate limiting
nuclei -u https://<target> -rl 5 -c 2

# curl with delay between requests
for url in $(cat urls.txt); do
    curl -s -o /dev/null -w "%{http_code} $url\n" "$url"
    sleep 2
done

Timing Considerations

• Business hours (9am-5pm target timezone): Higher baseline traffic → scanning blends in
• Weekends/holidays: Lower baseline → scans stand out more
• Maintenance windows: If known, ideal for aggressive scanning
• Burst vs sustained: Short bursts with long pauses are less detectable than sustained scanning