“There is a huge difference between a penetration test and a Red Team exercise. A pentest finds vulnerabilities; a Red Team operation simulates a real-world adversary to test the organization’s detection and response capabilities.”
Ask a room of red teamers which book actually changed how they work, and The Hacker Playbook 3 comes up more than almost anything else on the shelf. The first two volumes taught penetration testing method. The Red Team Edition changed the question being asked. It is not about finding bugs—it is about operating as a resourced, patient adversary running a full campaign against an organisation’s people, processes, and technology, and seeing whether anyone notices.
The Assumed Breach Philosophy
The book opens with a claim that still starts arguments: the Assumed Breach. Instead of burning three weeks trying to phish through a well-tuned email gateway, Kim argues that a mature engagement should start from the premise that access already happened—a compromised laptop, a stolen VPN credential, a rogue insider. The trade-off is real: you skip measuring the perimeter, and some clients hate paying for an engagement that doesn’t. But it buys you the answer that actually matters, which is whether the blue team can detect and contain an adversary who is already inside and moving.
The Command & Control Arsenal
The book surveys the Command and Control (C2) frameworks a red team reaches for, and is candid about where each one shows its seams:
- Cobalt Strike: The commercial default for adversary simulation—Beacon implants, Malleable C2 profiles, and lateral-movement tooling. It is also the framework every EDR vendor writes signatures for, which is exactly why the Malleable profiles matter.
- PowerShell Empire & PoshC2: In-memory, PowerShell-native post-exploitation that never touches disk, sliding past antivirus that only inspects files. The cost is that script-block logging and AMSI, if the defender has turned them on, light this activity up.
- Merlin, Pupy, & dnscat2: Alternative channels that tunnel command traffic over HTTP/2, DNS, and encrypted protocols to slip past network monitoring tuned for the obvious beacons.
The Full Campaign Lifecycle
What sets the book apart is the shape of it. It runs like a football playbook, each chapter a phase of the campaign:
- Pregame (Setup): Standing up resilient external attack infrastructure spread across several cloud providers, so losing one redirector doesn’t lose the operation.
- Recon (Before the Snap): Deep OSINT, cloud asset enumeration, subdomain discovery, and harvesting secrets accidentally committed to GitHub.
- Web Exploitation (The Throw): Hitting modern application frameworks with NoSQL injection, Server-Side Request Forgery (SSRF), deserialisation attacks, and chained XSS.
- Network Compromise (The Drive): Lateral movement with Responder for NTLM relay, CrackMapExec for domain enumeration, and pulling cleartext credentials straight out of LSASS memory.
- Social Engineering (The Lateral): Building narrowly targeted phishing campaigns and weaponised document payloads.
- Detection Evasion (The Onside Kick): Getting past modern EDR, AMSI, and application whitelisting—the section that ages fastest, and the one you should read alongside current research.
Who Is This Book REALLY For?
- Professional Red Team Operators: Not optional. Most serious red team leads keep a copy within reach, dog-eared.
- Blue Team & SOC Leaders: You cannot build detection for a playbook you have never read. This is the playbook.
- Security Leaders & CISOs: The Assumed Breach argument is the cleanest case you will find for funding detection and response instead of pouring another budget cycle into the perimeter.
The Bottom Line
The Hacker Playbook 3: Red Team Edition did more than catalogue techniques. It moved the industry’s conversation from “find the vulnerabilities” to “simulate the adversary,” and years on it is still one of the most-cited operational manuals in the field. A fair warning: the specific tooling dates, as offensive tooling always does. The method underneath it has not.
