Forge Offensive

Engagement command

Scope, run and report a simulated engagement end-to-end. Nothing leaves this range — every target, host and service is simulated. What you get is the deliverable spine a real engagement lives or dies on: a locked scope, a rules-of-engagement document, a findings list scored on CVSS 3.1, and an exportable report.

How we run a pentest Red-team playbook See coverage gaps Forge Anvil Platform overview

Engagements: —
Open: —
Consoles: 3
Offensive labs: 10

Start a new engagement

Name it and the client it belongs to. Scope, rules of engagement and findings hang off this record.

Your engagements

Every engagement keeps its own scope, findings register and report.

Loading…

Consoles

Attack-path mapBloodHound-style view of the range's directory. Pick any two objects and see the shortest attack path between them, with membership, admin rights and derived edges drawn out.Open Web proxy workbenchBurp-lite: craft an HTTP request, replay it in the repeater, or fire an intruder payload set against a deterministic vulnerable target. SQLi, XSS, IDOR, traversal, command injection and weak-credential sweeps all decided in the browser.Open C2 consoleSimulated command-and-control fleet: beacons on jittered sleep, task catalog, output timeline, loot drawer. Nothing beacons on any real network.Open

Offensive labs

These attack-side labs already ship. Launch one straight into its simulated Windows or Linux desktop — the lab brings its own range — or run it against a live engagement so its tool activity flows into the kill-chain timeline.

See the catalog

01
External Recon to Foothold
Enumerate a customer's public perimeter from an approved scan window, chain a stale service to a foothold, and file the first finding with CVSS and remediation before you touch anything else.
Launch labFind in catalog· pt-01-external-recon-to-foothold
02
Read the AD Attack Graph
Use the /pentest/attack-graph view to spot the shortest path from a helpdesk account to Domain Admin, walk it end-to-end with the simulated Kerberoast/DCSync tools, and file the delegation finding.
Launch labFind in catalog· pt-02-ad-attack-graph
03
Web App Assessment (OWASP Top 10)
Assess a storefront with the Burp-lite workbench at /pentest/proxy: repeat a login, fuzz an id parameter, catch an IDOR and a stored XSS, and file each finding under its OWASP Top 10 category.
Launch labFind in catalog· pt-03-web-app-assessment
04
Cloud Privilege Escalation
Given an access key with s3:GetObject only, walk a chain of over-permissive roles and trust policies to end up in a shell on a build server. File the trust-policy finding — the fix is one JSON edit.
Launch labFind in catalog· pt-04-cloud-privesc
05
Purple-Team Emulation
Play both seats. Fire five ATT&CK techniques from the C2 console, check the SIEM after each one, and file a detection-gap finding for the two that produced nothing. Score is the ratio of techniques with a signal.
Launch labFind in catalog· pt-05-purple-team-emulation
06
Wireless Assessment
Sit in an authorized coffee-shop parking lot, sweep the 2.4/5 GHz bands, capture the guest-WPA2 handshake, crack it against a scoped wordlist, then file a rotation-and-802.1X finding on the corporate SSID.
Launch labFind in catalog· pt-06-wireless-assessment
07
Authorized Phishing Simulation
Clone the customer's SSO portal, send a hundred lures against a pre-agreed roster, watch clicks and credentials land in the C2, and file a template-plus-training finding without ever holding a real password.
Launch labFind in catalog· pt-07-phishing-simulation
08
Defense Evasion and EDR Sidestep
On an authorized workstation, land a payload past an EDR that is watching AMSI, ETW and the usual hooked syscalls. Every step files an evidence line and a matching detection ask, so the report reads as both an attack write-up and a purple-team gap register.
Launch labFind in catalog· pt-08-defense-evasion
09
C2 Operations and Tunneling
Stand up a small beacon fleet in the /pentest/c2 console, run it over jittered HTTPS and a DNS fallback, stage a compressed collection and file the tunnel-and-egress finding — beacon fingerprints, jitter, callback cadence, all in the report.
Launch labFind in catalog· pt-09-c2-operations-and-tunneling
10
Ransomware Adversary Emulation
Emulate a named ransomware crew end-to-end against the simulated estate: scheduled-task persistence, token-theft privilege escalation, WinRM lateral hop, benign fixture-swap impact, then hand the recovery team a per-stage detection-gap table linked to the RAN track.
Launch labFind in catalog· pt-10-ransomware-emulation