# How to Orchestrate Full Attack Chains with the Red Team Module in reverse-skill

> Learn to orchestrate full attack chains with reverse-skill's red team module. Coordinate multi-stage penetration tests, validate tools, track evidence, and generate reports.

- Repository: [ZhaoXu/reverse-skill](https://github.com/zhaoxuya520/reverse-skill)
- Tags: how-to-guide
- Published: 2026-08-07

---

**The red team module in reverse-skill uses the `attack-chain` skill to coordinate multi-stage penetration tests by routing authorized requests through a structured kill-chain that validates tools, tracks evidence, and generates final reports.**

The **reverse-skill** repository provides a structured framework for authorized penetration testing and red-team exercises. When you need to orchestrate full attack chains with the red team module, the system leverages the centralized `attack-chain` skill to manage everything from initial reconnaissance to final reporting, ensuring that multi-stage operations remain organized and auditable.

## Architecture of the Red Team Module

The red team module is embodied by the **`attack-chain`** skill located in [`skills/attack-chain/SKILL.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/attack-chain/SKILL.md). This component acts as the central coordinator for any multi-stage penetration test, red-team exercise, or "hack-with-purpose" (HW) scenario, deliberately remaining agnostic to specific techniques while enforcing strict operational workflow.

### Mission Brief Validation

Before execution begins, the orchestrator collects the mission brief by reading the user request and validating authorization. According to [`skills/attack-chain/SKILL.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/attack-chain/SKILL.md), the system enforces an *ACTION REQUIRED* checklist that must be completed before the chain initiates, ensuring all activities are properly scoped and authorized.

### Kill-Chain Planning

The module builds a decision tree that maps the target type, current foothold, final objective, and operational constraints—such as privacy, stealth, and time—into a standardized sequence of phases: Recon → Initial Access → Privilege Escalation → Lateral Movement → Impact.

## How to Orchestrate Full Attack Chains

The orchestration logic ensures that any request spanning more than one phase must pass through this module, while single-stage tasks bypass it entirely.

### Phase Routing to Specialist Skills

For each phase, the orchestrator routes work to appropriate specialist skills via the routing matrix defined in [`skills/routing.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/routing.md). The system delegates to:

- **`pentest-tools`** for network scanning and enumeration phases
- **`windows-ad`** for Active Directory exploitation (as defined in [`skills/windows-ad/SKILL.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/windows-ad/SKILL.md))
- **`apk-reverse`** for mobile payload development and analysis

### Tool Validation and Bootstrapping

Before executing any phase, the system validates tool availability by loading [`tool-index.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/tool-index.md). If a required tool is missing, the orchestrator triggers **[`kali/scripts/bootstrap-reverse.sh`](https://github.com/zhaoxuya520/reverse-skill/blob/main/kali/scripts/bootstrap-reverse.sh)** to auto-install missing penetration testing tools rather than failing with path errors.

### Evidence Tracking and Timeline Generation

Every command, result, and finding is recorded in **[`timeline.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/timeline.md)** and **[`workitems.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/workitems.md)** within the case directory. When a phase completes, evidence is promoted to a *Finding* that feeds back into the next planning step, creating a complete audit trail.

## Step-by-Step Implementation

To orchestrate a full attack chain from the red-team console:

```bash

# 1️⃣ Initialise a new case and set the scope (must be authorized)

../scripts/case-init.ps1   # creates <case>/scope.md

```

```bash

# 2️⃣ Invoke the attack‑chain orchestrator with the high‑level goal

../skills/attack-chain/run.sh "From external network to domain controller"

```

```bash

# 3️⃣ The orchestrator asks you to confirm tool availability

#    (it will automatically pull missing tools via the bootstrap script)

../tools/bootstrap-reverse.sh   # runs only if a tool is missing

```

```bash

# 4️⃣ After each phase, inspect the generated timeline

cat work/<case>/timeline.md

```

```bash

# 5️⃣ When the chain is complete, generate the final report

../docs-generator/generate.sh <case>

```

Note that the actual [`run.sh`](https://github.com/zhaoxuya520/reverse-skill/blob/main/run.sh) script simply reads the *ACTION REQUIRED* section and follows the checklist—you do **not** need to edit any code to start a new attack chain.

## Key Files in the Red Team Module

- **[`skills/attack-chain/SKILL.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/attack-chain/SKILL.md)** – Core orchestration definition, phases, and authorization checklist
- **[`skills/routing.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/routing.md)** – Routing matrix that forwards multi-stage requests to `attack-chain`
- **[`skills/windows-ad/SKILL.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/windows-ad/SKILL.md)** – Example specialist skill for AD attacks callable from the chain
- **[`kali/scripts/bootstrap-reverse.sh`](https://github.com/zhaoxuya520/reverse-skill/blob/main/kali/scripts/bootstrap-reverse.sh)** – Auto-installs missing pentest tools when required
- **[`docs-generator/generate.sh`](https://github.com/zhaoxuya520/reverse-skill/blob/main/docs-generator/generate.sh)** – Produces the final evidence-rich report after chain completion

## Summary

- The `attack-chain` skill in [`skills/attack-chain/SKILL.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/attack-chain/SKILL.md) serves as the central orchestrator for multi-stage red-team operations.
- Single-stage tasks bypass the orchestrator and route directly to specialist skills, while multi-stage requests must pass through the full chain.
- The system enforces authorization via the *ACTION REQUIRED* checklist before executing any attack chain.
- Tool validation occurs through [`tool-index.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/tool-index.md), with automatic bootstrapping via [`kali/scripts/bootstrap-reverse.sh`](https://github.com/zhaoxuya520/reverse-skill/blob/main/kali/scripts/bootstrap-reverse.sh) for missing dependencies.
- Evidence collection happens continuously in [`timeline.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/timeline.md) and [`workitems.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/workitems.md), feeding into the final report generated by [`docs-generator/generate.sh`](https://github.com/zhaoxuya520/reverse-skill/blob/main/docs-generator/generate.sh).

## Frequently Asked Questions

### What authorization is required before running an attack chain?

According to [`skills/attack-chain/SKILL.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/attack-chain/SKILL.md), you must complete the *ACTION REQUIRED* checklist to validate that the activity is authorized before the orchestrator initializes the kill-chain. This ensures all penetration testing activities have proper scope and approval.

### How does the orchestrator handle missing penetration testing tools?

The system validates tool availability by loading [`tool-index.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/tool-index.md). If a required tool is missing, the orchestrator triggers [`kali/scripts/bootstrap-reverse.sh`](https://github.com/zhaoxuya520/reverse-skill/blob/main/kali/scripts/bootstrap-reverse.sh) to auto-install the dependency rather than attempting to execute with missing binaries or incorrect paths.

### Can I run single-stage attacks without the full attack-chain orchestrator?

Yes. Single-stage tasks—such as running a port scan—bypass the `attack-chain` orchestrator and route directly to the relevant specialist skill (e.g., `pentest-tools`). The red team module only activates when a request spans multiple phases.

### Where is the evidence stored during and after an attack chain?

During execution, evidence is recorded in `work/<case>/timeline.md` and [`workitems.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/workitems.md) within the case directory. When the chain completes, the [`docs-generator/generate.sh`](https://github.com/zhaoxuya520/reverse-skill/blob/main/docs-generator/generate.sh) script produces a structured final report containing the complete evidence chain from all phases.